59.967 CVE tracked
807 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.565 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-26133 | HIGH 7.1 | microsoft 365_copilot AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2025-62202 | HIGH 7.1 | microsoft 365_apps Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 0.6% | — |
| CVE-2025-49680 | HIGH 7.3 | microsoft windows_10_1507 Improper link resolution before file access ('link following') in Windows Performance Recorder allows an authorized attacker to deny service locally. | 0.6% | — |
| CVE-2023-21694 | MED 6.8 | microsoft windows_10 Windows Fax Service Remote Code Execution Vulnerability | 0.6% | — |
| CVE-2022-44710 | HIGH 7.8 | microsoft windows_11 DirectX Graphics Kernel Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2022-44678 | HIGH 7.8 | microsoft windows_10 Windows Print Spooler Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2022-30225 | HIGH 7.1 | microsoft windows_10 Windows Media Player Network Sharing Service Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2026-96252 | CRIT 9.1 | microsoft windows_10_1607 Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2025-53739 | HIGH 7.8 | microsoft 365_apps Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2025-53735 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2025-21359 | HIGH 7.8 | microsoft windows_10_1507 Windows Kernel Security Feature Bypass Vulnerability | 0.6% | — |
| CVE-2024-30007 | HIGH 8.8 | microsoft windows_server_2022_23h2 Microsoft Brokering File System Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-42312 | HIGH 7.8 | microsoft defender_for_iot Microsoft Defender for IoT Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2024-20695 | MED 5.7 | microsoft skype_for_business_server Skype for Business Information Disclosure Vulnerability | 0.6% | — |
| CVE-2022-37986 | HIGH 7.8 | microsoft windows_10 Windows Win32k Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2022-23255 | MED 5.9 | microsoft onedrive Microsoft OneDrive for Android Security Feature Bypass Vulnerability | 0.6% | — |
| CVE-2026-45485 | LOW 3.3 | microsoft 365_apps Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | 0.6% | — |
| CVE-2026-21259 | HIGH 7.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2026-50426 | MED 6.8 | microsoft windows_10_1607 Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network. | 0.6% | — |
| CVE-2026-26123 | MED 5.5 | microsoft authenticator Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally. | 0.6% | — |
| CVE-2025-62556 | HIGH 7.8 | microsoft 365_apps Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2022-44679 | MED 6.5 | microsoft windows_10 Windows Graphics Component Information Disclosure Vulnerability | 0.6% | — |
| CVE-2022-44674 | MED 5.5 | microsoft windows_10 Windows Bluetooth Driver Information Disclosure Vulnerability | 0.6% | — |
| CVE-2022-41074 | MED 5.5 | microsoft windows_10 Windows Graphics Component Information Disclosure Vulnerability | 0.6% | — |
| CVE-2021-42319 | MED 4.7 | microsoft visual_studio_2017 Visual Studio Elevation of Privilege Vulnerability | 0.6% | — |