59.356 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.099 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-58729 | MED 6.5 | microsoft windows_10_1507 Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. | 1.1% | — |
| CVE-2024-38033 | HIGH 7.3 | microsoft windows_10_1507 PowerShell Elevation of Privilege Vulnerability | 1.1% | — |
| CVE-2024-37970 | HIGH 8.0 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 1.1% | — |
| CVE-2023-21695 | HIGH 7.5 | microsoft windows_10 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability | 1.1% | — |
| CVE-2022-22049 | HIGH 7.8 | microsoft windows_10 Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability | 1.1% | — |
| CVE-2022-35821 | MED 4.4 | microsoft azure_sphere Azure Sphere Information Disclosure Vulnerability | 1.1% | — |
| CVE-2020-0731 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0691, CVE-2020-0719, CVE-2020-0720, CVE-2020- | 1.1% | — |
| CVE-2020-0635 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0644. | 1.1% | — |
| CVE-2019-0973 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system | 1.1% | — |
| CVE-2026-65770 | CRIT 10.0 | microsoft azure_managed_instance_for_apache_cassandra Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network. | 1.1% | — |
| CVE-2026-32194 | CRIT 9.8 | microsoft bing_images Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network. | 1.1% | — |
| CVE-2026-32191 | CRIT 9.8 | microsoft bing_images Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network. | 1.1% | — |
| CVE-2020-17097 | LOW 3.3 | microsoft windows_10 Windows Digital Media Receiver Elevation of Privilege Vulnerability | 1.1% | — |
| CVE-2025-62821 | CRIT 9.1 | microsoft heif_image_extension Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copy_size = str | 1.1% | — |
| CVE-2026-40365 | HIGH 8.8 | microsoft sharepoint_server Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 1.1% | — |
| CVE-2020-17126 | MED 5.5 | microsoft 365_apps Microsoft Excel Information Disclosure Vulnerability | 1.1% | — |
| CVE-2026-25185 | MED 5.3 | microsoft windows_10_1607 Exposure of sensitive information to an unauthorized actor in Windows Shell Link Processing allows an unauthorized attacker to perform spoofing over a network. | 1.1% | — |
| CVE-2025-29819 | MED 6.2 | microsoft windows_admin_center External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally. | 1.1% | — |
| CVE-2026-85322 | HIGH 7.5 | microsoft windows_10_1607 Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2019-0727 | HIGH 7.8 | microsoft visual_studio An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, a | 1.0% | — |
| CVE-2024-49041 | MED 4.3 | microsoft edge_chromium Microsoft Edge (Chromium-based) Spoofing Vulnerability | 1.0% | — |
| CVE-2019-1272 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system, aka 'Wi | 1.0% | — |
| CVE-2013-1275 | HIGH 7.0 | microsoft windows_7 Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently | 1.0% | — |
| CVE-2013-1265 | HIGH 7.0 | microsoft windows_7 Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently | 1.0% | — |
| CVE-2013-1253 | HIGH 7.0 | microsoft windows_7 Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently | 1.0% | — |