60.267 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.794 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-83500 | MED 6.1 | microsoft windows_10_1607 Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | 0.5% | — |
| CVE-2025-21340 | MED 5.5 | microsoft windows_10_1809 Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability | 0.5% | — |
| CVE-2026-70295 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-70294 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-70293 | MED 5.5 | microsoft windows_10_1607 Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-70292 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-70284 | MED 5.5 | microsoft windows_10_1607 Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-70211 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-69999 | MED 5.5 | microsoft windows_11_23h2 Out-of-bounds read in Windows Update allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-96948 | MED 5.5 | microsoft windows_10_1607 Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-96944 | MED 5.5 | microsoft windows_11_24h2 Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-85793 | MED 5.5 | microsoft windows_10_1607 Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-50419 | LOW 3.3 | microsoft windows_10_1607 Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-50416 | LOW 3.3 | microsoft windows_11_24h2 Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-69673 | HIGH 7.8 | microsoft windows_11_23h2 Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2026-69785 | HIGH 7.8 | microsoft windows_10_1607 Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2026-69328 | HIGH 7.8 | microsoft windows_10_1607 Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2026-56174 | HIGH 7.8 | microsoft windows_10_1809 Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2026-50462 | HIGH 7.8 | microsoft windows_10_1607 External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2026-45501 | MED 6.5 | microsoft exchange_server Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. | 0.5% | — |
| CVE-2025-48815 | HIGH 7.8 | microsoft windows_10_1507 Access of resource using incompatible type ('type confusion') in Windows SSDP Service allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2026-42901 | CRIT 10.0 | microsoft entra_id Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. | 0.5% | — |
| CVE-2026-20940 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2025-29833 | HIGH 7.7 | microsoft windows_10_1507 Time-of-check time-of-use (toctou) race condition in Windows Virtual Machine Bus allows an unauthorized attacker to execute code locally. | 0.5% | — |
| CVE-2025-25003 | HIGH 7.3 | microsoft visual_studio_2019 Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally. | 0.5% | — |