58.507 CVE tracked
796 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
16.469 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2007-0028 | HIGH 9.3 | microsoft excel Microsoft Excel 2000, 2002, 2003, Viewer 2003, Office 2004 for Mac, and Office v.X for Mac does not properly handle certain opcodes, which allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file, which results in an "Improper Mem | 33.2% | — |
| CVE-2007-0220 | MED 6.8 | microsoft exchange_server Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, scrip | 33.1% | — |
| CVE-2003-0806 | HIGH 7.5 | microsoft windows_2000 Buffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to execute arbitrary code. | 33.1% | — |
| CVE-2006-0010 | HIGH 9.3 | microsoft windows_2000 Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type | 33.1% | — |
| CVE-2022-24502 | MED 4.3 | microsoft windows_10 Windows HTML Platforms Security Feature Bypass Vulnerability | 33.1% | — |
| CVE-2010-1262 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 6 SP1 and SP2, 7, and 8 allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, related to the CStyleSheet object and a free of | 33.1% | — |
| CVE-2005-1205 | MED 5.0 | microsoft windows_2003_server The Telnet client for Microsoft Windows XP, Windows Server 2003, and Windows Services for UNIX allows remote attackers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command. | 33.0% | — |
| CVE-2016-0118 | HIGH 7.8 | microsoft windows_10 The PDF library in Microsoft Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka "Windows Remote Code Execution Vulnerability." | 33.0% | — |
| CVE-2008-4025 | HIGH 9.3 | microsoft office Integer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2 | 32.9% | — |
| CVE-2019-0697 | CRIT 9.8 | microsoft windows_10 A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0698, CVE-2019-0726. | 32.9% | — |
| CVE-2014-1799 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014 | 32.9% | — |
| CVE-2010-2730 | HIGH 9.3 | microsoft internet_information_services Buffer overflow in Microsoft Internet Information Services (IIS) 7.5, when FastCGI is enabled, allows remote attackers to execute arbitrary code via crafted headers in a request, aka "Request Header Buffer Overflow Vulnerability." | 32.8% | — |
| CVE-2005-1979 | MED 5.0 | microsoft windows_2000 Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction | 32.8% | — |
| CVE-2010-4588 | HIGH 9.3 | microsoft wmi_administrative_tools The WBEMSingleView.ocx ActiveX control 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier allows remote attackers to execute arbitrary code via a crafted argument to the ReleaseContext method, a different vector than CVE-2010-3973, possibly an u | 32.8% | — |
| CVE-2018-8172 | HIGH 7.8 | microsoft expression_blend A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka "Visual Studio Remote Code Execution Vulnerability." This affects Microsoft Visual Studio, Expressio | 32.8% | — |
| CVE-2007-4675 | HIGH 9.3 | apple mac_os_x Heap-based buffer overflow in the QuickTime VR extension 7.2.0.240 in QuickTime.qts in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via a QTVR (QuickTime Virtual Reality) movie file containing a large size field in the atom head | 32.8% | — |
| CVE-2006-2218 | HIGH 9.3 | microsoft internet_explorer Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a v | 32.8% | — |
| CVE-2007-1754 | HIGH 9.3 | microsoft publisher PUBCONV.DLL in Microsoft Office Publisher 2007 does not properly clear memory when transferring data from disk to memory, which allows user-assisted remote attackers to execute arbitrary code via a malformed .pub page via a certain negative value, which bypass | 32.8% | — |
| CVE-2004-2434 | MED 5.0 | microsoft ie Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (browser crash) via a link with "::{" (colon colon left brace), which triggers a null dereference when the user attempts to save the link using "Save As" and Internet Expl | 32.8% | — |
| CVE-2004-0844 | MED 5.0 | microsoft ie Internet Explorer 6 on Double Byte Character Set (DBCS) systems allows remote attackers to alter displayed address bars and spoof web pages via a URL containing special characters, facilitating phishing attacks, aka the "Address Bar Spoofing on Double Byte Cha | 32.8% | — |
| CVE-2013-3143 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-316 | 32.7% | — |
| CVE-2005-1184 | MED 5.0 | microsoft windows_2000 The TCP/IP stack in multiple operating systems allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the correct sequence number but the wrong Acknowledgement number, which generates a large number of "keep alive" packets | 32.7% | — |
| CVE-2022-22025 | HIGH 7.5 | microsoft windows_10 Windows Internet Information Services Cachuri Module Denial of Service Vulnerability | 32.7% | — |
| CVE-2014-0254 | HIGH 7.8 | microsoft windows_8 The IPv6 implementation in Microsoft Windows 8, Windows Server 2012, and Windows RT does not properly validate packets, which allows remote attackers to cause a denial of service (system hang) via crafted ICMPv6 Router Advertisement packets, aka "TCP/IP Versio | 32.7% | — |
| CVE-2025-47981 | CRIT 9.8 | microsoft windows_10_1507 Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network. | 32.7% | — |