60.267 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.794 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-21236 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-21232 | HIGH 7.8 | microsoft windows_11_23h2 Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-49180 | MED 5.5 | microsoft windows_10_1607 Improper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-20962 | MED 4.4 | microsoft windows_10_1809 Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2025-62216 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2025-62205 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2025-49705 | HIGH 7.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2025-49700 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2023-24946 | HIGH 7.8 | microsoft windows_10_1507 Windows Backup Service Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2026-70348 | MED 5.5 | microsoft windows_11_24h2 Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally. | 0.4% | — |
| CVE-2026-62869 | HIGH 8.8 | microsoft entra_id Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-49177 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows TCP/IP allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-45649 | HIGH 7.1 | microsoft excel Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally. | 0.4% | — |
| CVE-2026-21522 | MED 6.7 | microsoft confcom Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2022-33644 | HIGH 7.0 | microsoft windows_10 Xbox Live Save Service Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2026-83840 | HIGH 7.8 | microsoft windows_10_1607 Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-83944 | CRIT 10.0 | microsoft azure_logic_apps Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. | 0.4% | — |
| CVE-2026-80097 | HIGH 8.6 | microsoft authenticator Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-58283 | HIGH 8.1 | microsoft edge_chromium Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2025-29842 | HIGH 7.5 | microsoft windows_10_1507 Acceptance of extraneous untrusted data with trusted data in UrlMon allows an unauthorized attacker to bypass a security feature over a network. | 0.4% | — |
| CVE-2024-49097 | HIGH 7.0 | microsoft windows_10_1809 Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2024-49095 | HIGH 7.0 | microsoft windows_10_1809 Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2026-88210 | HIGH 7.8 | microsoft 365_apps Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | 0.4% | — |
| CVE-2026-87705 | HIGH 7.4 | microsoft windows_10_1607 Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network. | 0.4% | — |
| CVE-2026-70220 | HIGH 7.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 0.4% | — |