60.267 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.794 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-53724 | HIGH 7.8 | microsoft windows_10_1507 Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-53152 | HIGH 7.8 | microsoft windows_10_1507 Use after free in Desktop Windows Manager allows an authorized attacker to execute code locally. | 0.4% | — |
| CVE-2025-49707 | HIGH 7.9 | microsoft dcadsv5-series_azure_vm_firmware Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally. | 0.4% | — |
| CVE-2026-85884 | HIGH 7.8 | microsoft windows_11_24h2 Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-69417 | HIGH 7.3 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-69402 | HIGH 7.3 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-62914 | HIGH 7.3 | microsoft exchange_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-55045 | HIGH 8.4 | microsoft 365_apps Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2026-58300 | MED 6.2 | microsoft edge_chromium Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-47288 | HIGH 7.1 | microsoft windows_server_2012 Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network. | 0.4% | — |
| CVE-2026-45458 | HIGH 8.4 | microsoft 365_apps Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2026-45456 | HIGH 8.4 | microsoft 365_apps Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2026-40367 | HIGH 8.4 | microsoft 365_apps Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2026-24288 | MED 6.8 | microsoft windows_10_21h2 Heap-based buffer overflow in Windows Mobile Broadband allows an unauthorized attacker to execute code with a physical attack. | 0.4% | — |
| CVE-2026-21246 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-47976 | HIGH 7.8 | microsoft windows_10_1507 Use after free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-21199 | MED 6.7 | microsoft azure_agent Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2024-49046 | HIGH 7.8 | microsoft windows_10_1507 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2023-21561 | HIGH 7.8 | microsoft windows_10_1607 Microsoft Cryptographic Services Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2023-21551 | HIGH 7.8 | microsoft windows_10_1809 Microsoft Cryptographic Services Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2026-83636 | MED 6.5 | microsoft windows_10_21h2 Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally. | 0.4% | — |
| CVE-2026-70248 | MED 6.5 | microsoft windows_10_1607 Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally. | 0.4% | — |
| CVE-2026-21251 | HIGH 7.8 | microsoft windows_server_2016 Use after free in Windows Cluster Client Failover allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-21245 | HIGH 7.8 | microsoft windows_11_24h2 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-21239 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | 0.4% | — |