59.727 CVE tracked
805 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.343 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-28916 | HIGH 8.8 | microsoft xbox_gaming_services Xbox Gaming Services Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-33784 | HIGH 7.8 | microsoft windows_10 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2026-69987 | HIGH 7.5 | microsoft windows_10_1607 Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 0.6% | — |
| CVE-2026-69986 | HIGH 7.5 | microsoft windows_10_1607 Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 0.6% | — |
| CVE-2026-69984 | HIGH 7.5 | microsoft windows_10_1607 Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 0.6% | — |
| CVE-2026-69976 | HIGH 7.5 | microsoft windows_10_1607 Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 0.6% | — |
| CVE-2022-24496 | HIGH 7.8 | microsoft windows_10 Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2022-24488 | HIGH 7.8 | microsoft windows_10 Windows Desktop Bridge Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2026-69375 | MED 6.5 | microsoft exchange_server Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. | 0.6% | — |
| CVE-2026-62915 | MED 6.5 | microsoft exchange_server Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network. | 0.6% | — |
| CVE-2026-58279 | MED 6.5 | microsoft azure_cyclecloud Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. | 0.6% | — |
| CVE-2026-42830 | MED 6.5 | microsoft azure_monitor_agent Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2026-35422 | MED 6.5 | microsoft windows_10_1607 Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network. | 0.6% | — |
| CVE-2026-20828 | MED 4.6 | microsoft windows_10_1607 Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical attack. | 0.6% | — |
| CVE-2025-29976 | HIGH 7.8 | microsoft sharepoint_server Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2023-32041 | MED 5.5 | microsoft windows_10_1607 Windows Update Orchestrator Service Information Disclosure Vulnerability | 0.6% | — |
| CVE-2022-37995 | HIGH 7.8 | microsoft windows_10 Windows Kernel Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2025-62211 | HIGH 8.7 | microsoft dynamics_365 Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2025-62210 | HIGH 8.7 | microsoft dynamics_365 Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2025-21367 | HIGH 7.8 | microsoft windows_10_1809 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2024-49053 | HIGH 7.6 | microsoft dynamics_365_sales Microsoft Dynamics 365 Sales Spoofing Vulnerability | 0.6% | — |
| CVE-2021-34536 | HIGH 7.8 | microsoft windows_10 Windows Storage Spaces Controller Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-33773 | HIGH 7.8 | microsoft windows_10 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2026-88075 | HIGH 8.8 | microsoft configuration_manager_2503 Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. | 0.6% | — |
| CVE-2026-45502 | MED 5.0 | microsoft exchange_server Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network. | 0.6% | — |