59.967 CVE tracked
807 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.565 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-26235 | HIGH 7.8 | microsoft windows_server_2022_23h2 Windows Update Stack Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2026-32172 | HIGH 8.0 | microsoft power_apps Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network. | 0.6% | — |
| CVE-2025-59286 | CRIT 9.3 | microsoft 365_copilot_chat Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2025-59272 | CRIT 9.3 | microsoft 365_copilot_chat Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosure locally. | 0.6% | — |
| CVE-2025-59252 | CRIT 9.3 | microsoft 365_word_copilot Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2025-53740 | HIGH 8.4 | microsoft 365_apps Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2025-53731 | HIGH 8.4 | microsoft 365_apps Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2025-48807 | MED 6.7 | microsoft windows_10_1607 Improper restriction of communication channel to intended endpoints in Windows Hyper-V allows an authorized attacker to execute code locally. | 0.6% | — |
| CVE-2025-49667 | HIGH 7.8 | microsoft windows_10_1507 Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2024-38246 | HIGH 7.0 | microsoft windows_10_21h2 Win32k Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2024-28924 | MED 6.7 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 0.6% | — |
| CVE-2021-34475 | MED 5.4 | microsoft edge_chromium Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2025-62565 | HIGH 7.3 | microsoft windows_10_1607 Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2025-60704 | HIGH 7.5 | microsoft windows_10_1607 Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network. | 0.6% | — |
| CVE-2023-28298 | MED 5.5 | microsoft windows_10_1607 Windows Kernel Denial of Service Vulnerability | 0.6% | — |
| CVE-2026-69543 | HIGH 8.5 | microsoft azure_virtual_machines Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network. | 0.6% | — |
| CVE-2025-24065 | MED 5.5 | microsoft windows_10_1507 Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. | 0.6% | — |
| CVE-2024-38248 | HIGH 7.0 | microsoft windows_10_21h2 Windows Storage Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2023-38150 | HIGH 7.8 | microsoft windows_11_21h2 Windows Kernel Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-34460 | HIGH 7.8 | microsoft windows_10 Windows Storage Spaces Controller Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2023-36888 | MED 6.3 | microsoft edge_chromium Microsoft Edge for Android (Chromium-based) Tampering Vulnerability | 0.6% | — |
| CVE-2022-24480 | MED 6.3 | microsoft outlook Outlook for Android Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-40455 | MED 5.5 | microsoft windows_10 Windows Installer Spoofing Vulnerability | 0.6% | — |
| CVE-2021-27088 | HIGH 7.8 | microsoft windows_10 Windows Event Tracing Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2026-58284 | HIGH 8.3 | microsoft edge_chromium Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 0.6% | — |