59.432 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.157 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-16941 | MED 4.1 | microsoft sharepoint_enterprise_server <p>An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. An attacker who took advantage of this information disclosure could view the folder path of scripts | 0.9% | — |
| CVE-2020-0730 | HIGH 7.1 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'. | 0.9% | — |
| CVE-2025-29817 | MED 5.7 | microsoft power_automate_for_desktop Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2025-26627 | HIGH 7.0 | microsoft azure_arc Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally. | 0.9% | — |
| CVE-2024-38172 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Remote Code Execution Vulnerability | 0.9% | — |
| CVE-2019-1270 | MED 5.5 | microsoft windows_10 An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to symbolic link attack, aka 'Microsoft Windows Store Installer Elevation of Privilege Vulnerability'. | 0.9% | — |
| CVE-2013-1292 | HIGH 7.4 | microsoft windows_7 Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted applicat | 0.9% | — |
| CVE-2026-102867 | MED 6.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-69723 | MED 5.7 | microsoft windows_10_1607 Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-69591 | MED 5.7 | microsoft windows_10_1809 Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-69572 | MED 5.7 | microsoft windows_10_1607 Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-69552 | MED 5.7 | microsoft windows_10_1607 Generation of error message containing sensitive information in Windows Print Spooler Components allows an authorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-69507 | MED 5.7 | microsoft windows_11_23h2 Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Search Component allows an authorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-69393 | MED 5.7 | microsoft windows_10_1607 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-69349 | MED 5.7 | microsoft windows_10_1607 Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-69317 | MED 5.7 | microsoft windows_10_1607 Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-68874 | MED 5.7 | microsoft windows_10_1607 Out-of-bounds read in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-65812 | MED 6.8 | microsoft teams Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-26118 | HIGH 8.8 | microsoft azure_mcp_server Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2024-30004 | MED 6.8 | microsoft windows_10_1809 Windows Mobile Broadband Driver Remote Code Execution Vulnerability | 0.9% | — |
| CVE-2024-26178 | HIGH 7.8 | microsoft windows_10_1507 Windows Kernel Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2024-26173 | HIGH 7.8 | microsoft windows_10_1507 Windows Kernel Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2026-96924 | CRIT 9.8 | microsoft windows_10_1607 Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-96909 | CRIT 9.8 | microsoft windows_11_23h2 Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-96219 | CRIT 9.8 | microsoft windows_10_1809 Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. | 0.9% | — |