59.529 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.194 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-41051 | HIGH 7.8 | microsoft azure_rtos_guix_studio Azure RTOS GUIX Studio Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2019-1447 | MED 5.4 | microsoft office_online_server A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1445. | 0.8% | — |
| CVE-2019-1445 | MED 5.4 | microsoft office_online_server A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1447. | 0.8% | — |
| CVE-2026-88092 | CRIT 9.4 | microsoft asp.net_core Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. | 0.8% | — |
| CVE-2026-26144 | HIGH 7.5 | microsoft 365_apps Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 0.8% | — |
| CVE-2025-62222 | HIGH 8.8 | microsoft github_copilot_chat Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2023-36026 | MED 4.3 | microsoft edge_chromium Microsoft Edge (Chromium-based) Spoofing Vulnerability | 0.8% | — |
| CVE-2023-35335 | HIGH 8.2 | microsoft dynamics_365 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | 0.8% | — |
| CVE-2026-21253 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally. | 0.8% | — |
| CVE-2025-27741 | HIGH 7.8 | microsoft windows_10_1507 Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally. | 0.8% | — |
| CVE-2023-36872 | MED 5.5 | microsoft vp9_video_extensions VP9 Video Extensions Information Disclosure Vulnerability | 0.8% | — |
| CVE-2022-38030 | MED 4.3 | microsoft windows_10 Windows USB Serial Driver Information Disclosure Vulnerability | 0.8% | — |
| CVE-2022-22712 | MED 5.6 | microsoft windows_10 Windows Hyper-V Denial of Service Vulnerability | 0.8% | — |
| CVE-2025-21215 | MED 4.6 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 0.8% | — |
| CVE-2024-21363 | HIGH 7.8 | microsoft windows_10_1507 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2023-36557 | HIGH 7.8 | microsoft windows_10_1507 PrintHTML API Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2025-21373 | HIGH 7.8 | microsoft windows_10_1507 Windows Installer Elevation of Privilege Vulnerability | 0.8% | — |
| CVE-2024-41145 | HIGH 7.1 | microsoft teams A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious applicati | 0.8% | — |
| CVE-2024-43465 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Elevation of Privilege Vulnerability | 0.8% | — |
| CVE-2026-20926 | HIGH 7.5 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2026-20919 | HIGH 7.5 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2023-21567 | MED 5.6 | microsoft visual_studio_2017 Visual Studio Denial of Service Vulnerability | 0.8% | — |
| CVE-2026-96952 | HIGH 8.8 | microsoft windows_10_1809 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-83934 | HIGH 8.8 | microsoft windows_10_1607 Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-69865 | CRIT 10.0 | microsoft azure_container_registry Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network. | 0.8% | — |