56.932 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
Microsoft vulnerabilities
15.479 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-49697 | HIGH 8.4 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.5% | — |
| CVE-2026-58531 | HIGH 7.5 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an authorized attacker to elevate privileges over a network. | 0.5% | — |
| CVE-2026-56648 | HIGH 7.5 | microsoft windows_10_1607 Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network. | 0.5% | — |
| CVE-2026-50665 | HIGH 7.8 | microsoft 365_apps Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-50379 | HIGH 7.5 | microsoft windows_11_24h2 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network. | 0.5% | — |
| CVE-2026-20876 | MED 6.7 | microsoft windows_11_23h2 Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2025-62564 | HIGH 7.8 | microsoft 365_apps Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.5% | — |
| CVE-2025-62561 | HIGH 7.8 | microsoft 365_apps Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.5% | — |
| CVE-2025-62560 | HIGH 7.8 | microsoft 365_apps Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.5% | — |
| CVE-2025-24065 | MED 5.5 | microsoft windows_10_1507 Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2025-62555 | HIGH 7.0 | microsoft 365_apps Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 0.5% | — |
| CVE-2025-49745 | MED 5.4 | microsoft dynamics_365 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to perform spoofing over a network. | 0.5% | — |
| CVE-2025-32717 | HIGH 8.4 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 0.5% | — |
| CVE-2023-32043 | MED 6.8 | microsoft windows_10_1507 Windows Remote Desktop Security Feature Bypass Vulnerability | 0.5% | — |
| CVE-2026-58295 | HIGH 8.3 | microsoft edge_chromium Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. | 0.5% | — |
| CVE-2026-24293 | HIGH 7.8 | microsoft windows_10_21h2 Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2023-32012 | HIGH 7.8 | microsoft windows_10_21h2 Windows Container Manager Service Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2026-62778 | HIGH 8.1 | microsoft windows_10_1607 Use after free in Windows DNS allows an unauthorized attacker to elevate privileges over a network. | 0.5% | — |
| CVE-2026-56169 | HIGH 8.1 | microsoft windows_admin_center Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. | 0.5% | — |
| CVE-2026-50294 | MED 6.2 | microsoft windows_10_1607 Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-49807 | MED 6.2 | microsoft windows_10_1809 Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-24305 | CRIT 9.3 | microsoft entra_id Azure Entra ID Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2022-22036 | HIGH 7.0 | microsoft windows_10 Performance Counters for Windows Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2026-48562 | MED 4.6 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.5% | — |
| CVE-2026-47641 | MED 4.6 | microsoft sharepoint_server Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.5% | — |