59.422 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.155 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2019-0707 | HIGH 7.0 | microsoft windows_10 An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it.To exploit the vulnerability, in a local attack scenario, an attacker could ru | 0.9% | — |
| CVE-2026-55034 | HIGH 7.3 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.9% | — |
| CVE-2026-55021 | HIGH 7.3 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.9% | — |
| CVE-2020-1021 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vul | 0.9% | — |
| CVE-2021-34509 | MED 5.5 | microsoft windows_10 Storage Spaces Controller Information Disclosure Vulnerability | 0.9% | — |
| CVE-2020-16891 | HIGH 8.8 | microsoft windows_10 <p>A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application o | 0.9% | — |
| CVE-2021-26441 | HIGH 7.8 | microsoft windows_10 Storage Spaces Controller Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2019-1164 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, | 0.9% | — |
| CVE-2024-26203 | HIGH 7.3 | microsoft azure_data_studio Azure Data Studio Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2022-44691 | HIGH 7.8 | microsoft 365_apps Microsoft Office OneNote Remote Code Execution Vulnerability | 0.9% | — |
| CVE-2021-1685 | HIGH 7.3 | microsoft windows_10 Windows AppX Deployment Extensions Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2026-70244 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in DNS Server allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-69940 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-62906 | HIGH 7.4 | microsoft discovery_studio Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2025-21387 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Remote Code Execution Vulnerability | 0.9% | — |
| CVE-2017-8562 | HIGH 7.0 | microsoft windows_10 Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Windows improperly handling calls to Advanced Local Procedure Call (ALPC) | 0.9% | — |
| CVE-2013-1278 | HIGH 7.4 | microsoft windows_7 Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges | 0.9% | — |
| CVE-2025-21415 | CRIT 9.9 | microsoft azure_ai_face_service Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2025-21354 | HIGH 8.4 | microsoft 365_apps Microsoft Excel Remote Code Execution Vulnerability | 0.9% | — |
| CVE-2024-49093 | HIGH 8.8 | microsoft windows_11_24h2 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2020-16902 | HIGH 7.8 | microsoft windows_10 <p>An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.</p> <p>A locally authenticated attacker could run arbitrary code with elevat | 0.9% | — |
| CVE-2020-1429 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. | 0.9% | — |
| CVE-2026-70324 | HIGH 8.8 | microsoft sharepoint_server Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-64921 | HIGH 8.8 | microsoft sharepoint_server Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-62827 | HIGH 8.8 | microsoft sharepoint_server Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 0.9% | — |