60.267 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.794 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-47986 | HIGH 8.8 | microsoft windows_10_1507 Use after free in Universal Print Management Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-85916 | MED 6.2 | microsoft windows_11_23h2 Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally. | 0.4% | — |
| CVE-2025-62557 | HIGH 8.4 | microsoft 365_apps Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2024-49059 | HIGH 7.0 | microsoft 365_apps Microsoft Office Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2024-38137 | HIGH 7.0 | microsoft windows_10_21h2 Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2023-32009 | HIGH 8.8 | microsoft windows_10_1607 Windows Collaborative Translation Framework Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2025-55339 | HIGH 7.8 | microsoft windows_11_22h2 Out-of-bounds read in Windows NDIS allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2022-22008 | HIGH 7.8 | microsoft windows_10 Windows Hyper-V Remote Code Execution Vulnerability | 0.4% | — |
| CVE-2026-83761 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-70303 | HIGH 7.8 | microsoft windows_10_1607 Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-70104 | HIGH 7.8 | microsoft windows_10_1809 Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-45595 | MED 5.4 | microsoft windows_10_1607 Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network. | 0.4% | — |
| CVE-2024-21362 | MED 5.5 | microsoft windows_10_1507 Windows Kernel Security Feature Bypass Vulnerability | 0.4% | — |
| CVE-2026-88174 | HIGH 8.1 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network. | 0.4% | — |
| CVE-2026-69384 | HIGH 7.1 | microsoft windows_10_1607 Null pointer dereference in Virtual Hard Disk (VHD) Miniport Driver allows an unauthorized attacker to deny service locally. | 0.4% | — |
| CVE-2026-32081 | MED 5.5 | microsoft windows_10_1607 Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2023-21804 | HIGH 7.8 | microsoft windows_10 Windows Graphics Component Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2026-41611 | HIGH 7.8 | microsoft visual_studio_code Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2026-41134 | HIGH 7.8 | microsoft kiota Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings | 0.4% | — |
| CVE-2026-32215 | MED 5.5 | microsoft windows_10_1809 Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2025-59255 | HIGH 7.8 | microsoft windows_10_1809 Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-59207 | HIGH 7.8 | microsoft windows_10_1809 Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-58728 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-55677 | HIGH 7.8 | microsoft windows_11_24h2 Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-50175 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. | 0.4% | — |