59.703 CVE tracked
805 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.320 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-20838 | MED 5.5 | microsoft windows_11_23h2 Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally. | 0.7% | — |
| CVE-2025-47972 | HIGH 8.0 | microsoft windows_10_1507 Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges over a network. | 0.7% | — |
| CVE-2025-47164 | HIGH 8.4 | microsoft 365_apps Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.7% | — |
| CVE-2025-21315 | HIGH 7.8 | microsoft windows_11_24h2 Microsoft Brokering File System Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2024-43547 | MED 6.5 | microsoft windows_10_1507 Windows Kerberos Information Disclosure Vulnerability | 0.7% | — |
| CVE-2024-38163 | HIGH 7.8 | microsoft windows_10_21h2 Windows Update Stack Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2024-37304 | MED 6.1 | microsoft nugetgallery NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately | 0.7% | — |
| CVE-2021-40470 | HIGH 7.8 | microsoft windows_10 DirectX Graphics Kernel Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2021-40466 | HIGH 7.8 | microsoft windows_10 Windows Common Log File System Driver Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2021-40443 | HIGH 7.8 | microsoft windows_10 Windows Common Log File System Driver Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2021-33759 | HIGH 7.8 | microsoft windows_10 Windows Desktop Bridge Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2021-33743 | HIGH 7.8 | microsoft windows_10 Windows Projected File System Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2025-48804 | MED 6.8 | microsoft windows_10_1507 Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | 0.7% | — |
| CVE-2024-43503 | HIGH 7.8 | microsoft sharepoint_server Microsoft SharePoint Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2024-26245 | HIGH 7.8 | microsoft windows_10_1507 Windows SMB Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2023-35323 | HIGH 7.8 | microsoft windows_11_21h2 Windows OLE Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2023-35313 | HIGH 7.8 | microsoft windows_10_1507 Windows Online Certificate Status Protocol (OCSP) SnapIn Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2022-26788 | HIGH 7.8 | microsoft powershell PowerShell Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2026-64900 | HIGH 7.3 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-55126 | HIGH 7.3 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-45481 | HIGH 7.3 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2025-49722 | MED 5.7 | microsoft windows_10_1507 Uncontrolled resource consumption in Windows Print Spooler Components allows an authorized attacker to deny service over an adjacent network. | 0.6% | — |
| CVE-2025-49698 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2025-29977 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2024-43614 | MED 5.5 | microsoft defender_for_endpoint Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally. | 0.6% | — |