60.267 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.794 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-50152 | HIGH 7.8 | microsoft windows_10_1507 Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-55317 | HIGH 7.8 | microsoft autoupdate Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-55245 | HIGH 7.8 | microsoft xbox_gaming_services Improper link resolution before file access ('link following') in Xbox allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-54115 | HIGH 7.0 | microsoft windows_10_1809 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-88118 | HIGH 7.8 | microsoft windows_10_1607 Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-83848 | HIGH 7.8 | microsoft windows_10_1607 Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-83830 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-83699 | HIGH 7.8 | microsoft windows_10_1607 Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-70286 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-41090 | CRIT 9.3 | microsoft 365_copilot Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network. | 0.4% | — |
| CVE-2026-32217 | MED 5.5 | microsoft windows_10_1607 Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2024-21381 | MED 6.8 | microsoft azure_active_directory Microsoft Azure Active Directory B2C Spoofing Vulnerability | 0.4% | — |
| CVE-2023-36568 | HIGH 7.0 | microsoft 365_apps Microsoft Office Click-To-Run Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2026-108433 | HIGH 7.8 | microsoft 365_apps Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | 0.4% | — |
| CVE-2026-58286 | HIGH 8.1 | microsoft edge_chromium Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-58282 | HIGH 8.1 | microsoft edge_chromium Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-42973 | MED 5.5 | microsoft windows_10_1607 Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-42970 | MED 5.5 | microsoft windows_10_1607 Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2025-59229 | MED 5.5 | microsoft 365_apps Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally. | 0.4% | — |
| CVE-2026-105713 | MED 5.7 | microsoft sharepoint_server Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network. | 0.4% | — |
| CVE-2026-83769 | HIGH 7.8 | microsoft windows_10_1809 Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-83646 | MED 4.8 | microsoft windows_10_1607 Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2025-53730 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2024-43580 | MED 5.4 | microsoft edge_chromium Microsoft Edge (Chromium-based) Spoofing Vulnerability | 0.4% | — |
| CVE-2026-32181 | MED 5.5 | microsoft windows_10_21h2 Improper privilege management in Microsoft Windows allows an authorized attacker to deny service locally. | 0.4% | — |