59.529 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.194 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-43552 | HIGH 7.3 | microsoft windows_11_22h2 Windows Shell Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2024-38243 | HIGH 7.8 | microsoft windows_10_1507 Kernel Streaming Service Driver Elevation of Privilege Vulnerability | 0.8% | — |
| CVE-2026-97781 | HIGH 8.8 | microsoft 365_apps Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2025-47162 | HIGH 8.4 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.8% | — |
| CVE-2025-24053 | HIGH 7.2 | microsoft dataverse Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2024-43579 | HIGH 7.6 | microsoft edge_chromium Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2024-43578 | HIGH 7.6 | microsoft edge_chromium Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2024-43489 | MED 6.5 | microsoft edge_chromium Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2023-36404 | MED 5.5 | microsoft windows_10_1607 Windows Kernel Information Disclosure Vulnerability | 0.8% | — |
| CVE-2023-36800 | HIGH 7.6 | microsoft dynamics_365 Dynamics Finance and Operations Cross-site Scripting Vulnerability | 0.8% | — |
| CVE-2022-44694 | HIGH 7.8 | microsoft 365_apps Microsoft Office Visio Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2021-27086 | HIGH 7.8 | microsoft windows_10 Windows Services and Controller App Elevation of Privilege Vulnerability | 0.8% | — |
| CVE-2025-27737 | HIGH 8.6 | microsoft windows_10_1507 Improper input validation in Windows Security Zone Mapping allows an unauthorized attacker to bypass a security feature locally. | 0.8% | — |
| CVE-2023-35389 | MED 6.5 | microsoft dynamics_365 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2022-22048 | MED 6.1 | microsoft windows_10 BitLocker Security Feature Bypass Vulnerability | 0.8% | — |
| CVE-2021-31972 | MED 5.5 | microsoft windows_10 Event Tracing for Windows Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-31960 | MED 5.5 | microsoft windows_10 Windows Bind Filter Driver Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-31191 | MED 5.5 | microsoft windows_10 Windows Projected File System FS Filter Driver Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-28479 | MED 5.5 | microsoft windows_10 Windows CSC Service Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-28446 | HIGH 7.1 | microsoft windows_10 Windows Portmapping Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-28441 | MED 6.5 | microsoft windows_10 Windows Hyper-V Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-28437 | MED 5.5 | microsoft windows_10 Windows Installer Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-28435 | MED 5.5 | microsoft windows_10 Windows Event Tracing Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-28318 | MED 5.5 | microsoft windows_10 Windows GDI+ Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-21140 | MED 6.8 | google chrome Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform out of bounds memory access via via a USB device. | 0.8% | — |