59.422 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.155 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-54917 | MED 4.3 | microsoft windows_10_1507 Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. | 0.9% | — |
| CVE-2025-48802 | MED 6.5 | microsoft windows_11_22h2 Improper certificate validation in Windows SMB allows an authorized attacker to perform spoofing over a network. | 0.9% | — |
| CVE-2020-0697 | HIGH 7.8 | microsoft office_365_proplus An elevation of privilege vulnerability exists in Microsoft Office OLicenseHeartbeat task, where an attacker who successfully exploited this vulnerability could run this task as SYSTEM.To exploit the vulnerability, an authenticated attacker would need to place | 0.9% | — |
| CVE-2019-1018 | HIGH 7.0 | microsoft windows_10 An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delet | 0.9% | — |
| CVE-2019-1017 | HIGH 7.0 | microsoft windows_10 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install pr | 0.9% | — |
| CVE-2019-1014 | HIGH 7.0 | microsoft windows_10 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install pr | 0.9% | — |
| CVE-2019-0984 | HIGH 7.0 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. To exploit the vuln | 0.9% | — |
| CVE-2019-0960 | HIGH 7.0 | microsoft windows_7 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install pr | 0.9% | — |
| CVE-2024-21382 | MED 4.3 | microsoft edge_chromium Microsoft Edge for Android Information Disclosure Vulnerability | 0.9% | — |
| CVE-2023-36561 | HIGH 7.3 | microsoft azure_devops_server Azure DevOps Server Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2026-69843 | CRIT 10.0 | microsoft fabric Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-73025 | CRIT 9.8 | microsoft windows_10_1607 Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network. | 0.9% | — |
| CVE-2026-65801 | CRIT 10.0 | microsoft exchange_online Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-56162 | CRIT 10.0 | microsoft azure_sql_database Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-66803 | CRIT 10.0 | microsoft azure_cosmos_db Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-57106 | CRIT 10.0 | microsoft purview_data_governance Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-56163 | CRIT 10.0 | microsoft azure_kubernetes_service Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-56191 | CRIT 10.0 | microsoft exchange_online Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network. | 0.9% | — |
| CVE-2026-45480 | CRIT 10.0 | microsoft azure_active_directory Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-47280 | CRIT 10.0 | microsoft azure_resource_manager Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-42822 | CRIT 10.0 | microsoft azure_local Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-35431 | CRIT 10.0 | microsoft entra_id Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network. | 0.9% | — |
| CVE-2026-32186 | CRIT 10.0 | microsoft bing Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-33107 | CRIT 10.0 | microsoft azure_databricks Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-33105 | CRIT 10.0 | microsoft azure_kubernetes_service Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |