60.282 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.807 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-58278 | MED 5.4 | microsoft edge_chromium Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-42893 | HIGH 7.4 | microsoft outlook Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network. | 0.4% | — |
| CVE-2025-53769 | MED 5.5 | microsoft windows_security_app External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally. | 0.4% | — |
| CVE-2025-50170 | HIGH 7.8 | microsoft windows_10_1809 Improper handling of insufficient permissions or privileges in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2024-30031 | HIGH 7.8 | microsoft windows_10_1507 Windows CNG Key Isolation Service Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2026-85831 | MED 5.5 | microsoft windows_10_1809 Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-85830 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-33838 | HIGH 7.8 | microsoft windows_10_1607 Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-33102 | CRIT 9.3 | microsoft 365_copilot Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. | 0.4% | — |
| CVE-2025-47968 | HIGH 7.8 | microsoft autoupdate Improper input validation in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2024-38207 | MED 6.3 | microsoft edge_chromium Microsoft Edge (HTML-based) Memory Corruption Vulnerability | 0.4% | — |
| CVE-2026-83926 | MED 4.4 | microsoft windows_10_1809 Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally. | 0.4% | — |
| CVE-2026-42909 | HIGH 7.5 | microsoft remote_desktop_client Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 0.4% | — |
| CVE-2023-21704 | HIGH 7.8 | microsoft sql_server Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability | 0.4% | — |
| CVE-2023-21528 | HIGH 7.8 | microsoft sql_server Microsoft SQL Server Remote Code Execution Vulnerability | 0.4% | — |
| CVE-2026-96860 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-96859 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-88140 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-85935 | MED 5.5 | microsoft windows_10_1607 Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-85852 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-69902 | MED 6.7 | microsoft windows_10_1607 Untrusted pointer dereference in Windows NTFS allows an authorized attacker to execute code locally. | 0.4% | — |
| CVE-2025-58719 | MED 4.7 | microsoft windows_10_1607 Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2023-36565 | HIGH 7.0 | microsoft 365_copilot Microsoft Office Graphics Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2026-83927 | HIGH 7.8 | microsoft windows_10_21h2 Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-83896 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | 0.4% | — |