59.967 CVE tracked
807 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.565 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-38671 | HIGH 7.8 | microsoft windows_10 Windows Print Spooler Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-38667 | HIGH 7.8 | microsoft windows_10 Windows Print Spooler Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2026-63523 | MED 6.5 | microsoft skype_for_business_server Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-81394 | MED 5.5 | microsoft 365_apps Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 0.6% | — |
| CVE-2026-81387 | MED 5.5 | microsoft 365_apps Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 0.6% | — |
| CVE-2026-20864 | HIGH 7.8 | microsoft windows_10_1809 Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2025-59500 | HIGH 7.7 | microsoft azure_notification_service Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network. | 0.6% | — |
| CVE-2026-96218 | MED 5.5 | microsoft windows_10_1809 Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally. | 0.6% | — |
| CVE-2025-62209 | MED 5.5 | microsoft windows_10_1507 Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. | 0.6% | — |
| CVE-2025-62208 | MED 5.5 | microsoft windows_10_1507 Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. | 0.6% | — |
| CVE-2025-49682 | HIGH 7.3 | microsoft windows_10_21h2 Use after free in Windows Media allows an authorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2022-41050 | HIGH 7.8 | microsoft windows_10 Windows Extensible File Allocation Table Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-41346 | MED 5.3 | microsoft windows_10 Console Window Host Security Feature Bypass Vulnerability | 0.6% | — |
| CVE-2021-40464 | HIGH 8.0 | microsoft windows_10 Windows Nearby Sharing Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2026-97842 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2026-97834 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2026-97833 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2026-97832 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2026-23663 | HIGH 7.5 | microsoft global_secure_access Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network. | 0.6% | — |
| CVE-2025-47989 | HIGH 7.0 | microsoft azure_connected_machine_agent Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2024-21339 | MED 6.4 | microsoft windows_10_1809 Windows USB Generic Parent Driver Remote Code Execution Vulnerability | 0.6% | — |
| CVE-2023-24934 | MED 6.2 | microsoft malware_protection_platform Microsoft Defender Security Feature Bypass Vulnerability | 0.6% | — |
| CVE-2021-42285 | HIGH 7.8 | microsoft windows_10 Windows Kernel Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2026-88133 | HIGH 7.8 | microsoft windows_10_1607 Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2026-56167 | HIGH 8.5 | microsoft azure_ai_search Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network. | 0.5% | — |