59.239 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
16.993 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-20679 | MED 6.5 | microsoft azure_stack_hub Azure Stack Hub Spoofing Vulnerability | 1.3% | — |
| CVE-2022-34707 | HIGH 7.8 | microsoft windows_10 Windows Kernel Elevation of Privilege Vulnerability | 1.3% | — |
| CVE-2021-38652 | HIGH 7.6 | microsoft sharepoint_enterprise_server Microsoft SharePoint Server Spoofing Vulnerability | 1.3% | — |
| CVE-2021-38651 | HIGH 7.6 | microsoft sharepoint_enterprise_server Microsoft SharePoint Server Spoofing Vulnerability | 1.3% | — |
| CVE-2019-0632 | HIGH 7.8 | microsoft powershell_core A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0627, CVE-2019-0631. | 1.3% | — |
| CVE-2019-0631 | HIGH 7.8 | microsoft powershell_core A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0627, CVE-2019-0632. | 1.3% | — |
| CVE-2025-24045 | HIGH 8.1 | microsoft windows_server_2012 Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. | 1.3% | — |
| CVE-2020-17135 | MED 6.4 | microsoft azure_devops_server Azure DevOps Server Spoofing Vulnerability | 1.3% | — |
| CVE-1999-1370 | HIGH 7.2 | microsoft internet_explorer The setup wizard (ie5setup.exe) for Internet Explorer 5.0 disables (1) the screen saver, which could leave the system open to users with physical access if a failure occurs during an unattended installation, and (2) the Task Scheduler Service, which might prev | 1.3% | — |
| CVE-2025-21408 | HIGH 8.8 | microsoft edge_chromium Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 1.3% | — |
| CVE-2026-23666 | HIGH 7.5 | microsoft .net_framework Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network. | 1.3% | — |
| CVE-2020-1505 | MED 5.5 | microsoft sharepoint_enterprise_server An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit t | 1.3% | — |
| CVE-2009-2516 | HIGH 7.1 | microsoft windows_2000 The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly validate data sent from user mode, which allows local users to gain privileges via a crafted PE .exe file that triggers a NULL | 1.3% | — |
| CVE-2024-38165 | MED 6.5 | microsoft windows_11_22h2 Windows Compressed Folder Tampering Vulnerability | 1.3% | — |
| CVE-2023-29355 | MED 5.3 | microsoft windows_server_2012 DHCP Server Service Information Disclosure Vulnerability | 1.3% | — |
| CVE-2020-0700 | MED 5.4 | microsoft azure_devops_server A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'. | 1.3% | — |
| CVE-2011-1881 | HIGH 8.4 | microsoft windows_2003_server win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted applica | 1.3% | — |
| CVE-2026-21248 | HIGH 7.3 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. | 1.3% | — |
| CVE-2026-21244 | HIGH 7.3 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. | 1.3% | — |
| CVE-2023-36718 | HIGH 7.8 | microsoft windows_10_1507 Microsoft Virtual Trusted Platform Module Remote Code Execution Vulnerability | 1.3% | — |
| CVE-2019-1254 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists when Windows Hyper-V writes uninitialized memory to disk, aka 'Windows Hyper-V Information Disclosure Vulnerability'. | 1.3% | — |
| CVE-2025-33064 | HIGH 8.8 | microsoft windows_10_1507 Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. | 1.3% | — |
| CVE-2024-20690 | MED 6.5 | microsoft windows_10_1809 Windows Nearby Sharing Spoofing Vulnerability | 1.3% | — |
| CVE-2021-36975 | HIGH 7.8 | microsoft windows_10 Win32k Elevation of Privilege Vulnerability | 1.3% | — |
| CVE-2024-0590 | MED 6.1 | microsoft clarity The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the edit_clarity_project_id() function. This makes it possible for unauthenticated at | 1.3% | — |