59.952 CVE tracked
805 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.550 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-21524 | HIGH 7.4 | microsoft azure_data_explorer Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2025-62563 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2025-21345 | HIGH 7.8 | microsoft 365_apps Microsoft Office Visio Remote Code Execution Vulnerability | 0.6% | — |
| CVE-2024-21354 | HIGH 7.8 | microsoft windows_10_1507 Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2022-41123 | HIGH 7.8 | microsoft exchange_server Microsoft Exchange Server Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2026-21521 | HIGH 7.4 | microsoft 365_word_copilot Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2026-65767 | HIGH 8.8 | microsoft teams Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2025-59186 | MED 5.5 | microsoft windows_server_2016 Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. | 0.6% | — |
| CVE-2025-53795 | CRIT 9.1 | microsoft pc_manager Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network. | 0.6% | — |
| CVE-2025-30376 | HIGH 7.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2025-30375 | HIGH 7.8 | microsoft 365_apps Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2025-27489 | HIGH 7.8 | microsoft azure_stack_hci_22h2 Improper input validation in Azure Local allows an authorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2025-25008 | HIGH 7.1 | microsoft windows_server_2016 Improper link resolution before file access ('link following') in Microsoft Windows allows an authorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2024-28919 | MED 6.7 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 0.6% | — |
| CVE-2024-20669 | MED 6.7 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 0.6% | — |
| CVE-2023-21572 | MED 6.5 | microsoft dynamics_365 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | 0.6% | — |
| CVE-2021-24092 | HIGH 7.8 | microsoft endpoint_protection Microsoft Defender Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2025-21281 | HIGH 7.8 | microsoft windows_10_1507 Microsoft COM for Windows Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2024-38086 | MED 6.4 | microsoft azure_kinect_software_development_kit Azure Kinect SDK Remote Code Execution Vulnerability | 0.6% | — |
| CVE-2023-36719 | HIGH 7.8 | microsoft windows_10_1507 Microsoft Speech Application Programming Interface (SAPI) Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2023-36408 | HIGH 7.8 | microsoft windows_10_1607 Windows Hyper-V Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2026-69363 | HIGH 8.0 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network. | 0.6% | — |
| CVE-2026-62804 | HIGH 7.8 | microsoft 365_apps External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2026-50528 | HIGH 8.2 | microsoft .net Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. | 0.6% | — |
| CVE-2025-53774 | MED 6.5 | microsoft 365_copilot_chat Microsoft 365 Copilot BizChat Information Disclosure Vulnerability | 0.6% | — |