59.239 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
16.993 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-29362 | HIGH 8.8 | microsoft remote_desktop_client Remote Desktop Client Remote Code Execution Vulnerability | 1.3% | — |
| CVE-2021-36959 | MED 5.5 | microsoft windows_10 Windows Authenticode Spoofing Vulnerability | 1.3% | — |
| CVE-2026-26106 | HIGH 8.8 | microsoft sharepoint_server Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 1.3% | — |
| CVE-2011-0671 | HIGH 8.4 | microsoft windows_2003_server Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain | 1.3% | — |
| CVE-2009-1922 | MED 6.9 | microsoft windows_2000 The Message Queuing (aka MSMQ) service for Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold does not properly validate unspecified IOCTL request data from user mode before passing this data to kernel mode, which allows local users to gain pr | 1.3% | — |
| CVE-2024-29066 | HIGH 7.2 | microsoft windows_server_2008 Windows Distributed File System (DFS) Remote Code Execution Vulnerability | 1.3% | — |
| CVE-2022-37956 | HIGH 7.8 | microsoft windows_10 Windows Kernel Elevation of Privilege Vulnerability | 1.3% | — |
| CVE-2010-0484 | MED 6.8 | microsoft windows_2000 The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 "do not properly validate changes in certain kernel objects," which allows local users to execute arbi | 1.3% | — |
| CVE-2025-32714 | HIGH 7.8 | microsoft windows_10_1507 Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally. | 1.3% | — |
| CVE-2025-29967 | HIGH 8.8 | microsoft windows_10_1507 Heap-based buffer overflow in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. | 1.3% | — |
| CVE-2005-0921 | MED 4.6 | microsoft outlook_connector Microsoft Outlook 2002 Connector for IBM Lotus Domino 2.0 allows local users to save passwords and login credentials locally, even when password caching is disabled by a group policy. | 1.3% | — |
| CVE-2023-32042 | MED 6.5 | microsoft windows_10_1507 OLE Automation Information Disclosure Vulnerability | 1.3% | — |
| CVE-2003-0897 | MED 4.6 | microsoft windows_xp "Shatter" vulnerability in CommCtl32.dll in Windows XP may allow local users to execute arbitrary code by sending (1) BCM_GETTEXTMARGIN or (2) BCM_SETTEXTMARGIN button control messages to privileged applications. | 1.3% | — |
| CVE-2025-24996 | MED 6.5 | microsoft windows_10_1507 External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | 1.3% | — |
| CVE-2024-43583 | HIGH 7.8 | microsoft windows_10_1507 Winlogon Elevation of Privilege Vulnerability | 1.3% | — |
| CVE-2020-1075 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists when Windows Subsystem for Linux improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. A attacker could e | 1.3% | — |
| CVE-2003-1482 | MED 4.6 | microsoft mn-500_wireless_base_station The backup configuration file for Microsoft MN-500 wireless base station stores administrative passwords in plaintext, which allows local users to gain access. | 1.3% | — |
| CVE-2024-21403 | CRIT 9.0 | microsoft azure_kubernetes_service Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability | 1.3% | — |
| CVE-2021-43220 | LOW 3.1 | microsoft edge_ios Microsoft Edge for iOS Spoofing Vulnerability | 1.3% | — |
| CVE-2021-42308 | LOW 3.1 | microsoft edge_chromium Microsoft Edge (Chromium-based) Spoofing Vulnerability | 1.3% | — |
| CVE-2019-1282 | MED 5.5 | microsoft windows_10 An information disclosure exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle sandbox checks, aka 'Windows Common Log File System Driver Information Disclosure Vulnerability'. | 1.3% | — |
| CVE-2019-1274 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel Information Disclosure Vulnerability'. | 1.3% | — |
| CVE-2020-35609 | MED 5.5 | microsoft azure_sphere A denial-of-service vulnerability exists in the asynchronous ioctl functionality of Microsoft Azure Sphere 20.05. A sequence of specially crafted ioctl calls can cause a denial of service. An attacker can write shellcode to trigger this vulnerability. | 1.3% | — |
| CVE-2020-1194 | MED 5.5 | microsoft windows_10 A denial of service vulnerability exists when Windows Registry improperly handles filesystem operations, aka 'Windows Registry Denial of Service Vulnerability'. | 1.3% | — |
| CVE-2022-24495 | HIGH 7.0 | microsoft windows_10 Windows Direct Show Remote Code Execution Vulnerability | 1.3% | — |