60.368 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.844 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-62874 | CRIT 10.0 | microsoft azure_billing Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network. | 0.3% | — |
| CVE-2025-59215 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2025-55228 | HIGH 7.8 | microsoft windows_10_21h2 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-88074 | HIGH 7.8 | microsoft windows_11_23h2 Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69278 | HIGH 7.8 | microsoft visual_studio_code Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 0.3% | — |
| CVE-2026-58650 | HIGH 7.8 | microsoft visual_studio_code Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 0.3% | — |
| CVE-2026-45476 | HIGH 8.2 | microsoft azure_network_adapter Use after free in Linux MANA Driver allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2025-49665 | HIGH 7.8 | microsoft windows_10_1507 Concurrent execution using shared resource with improper synchronization ('race condition') in Workspace Broker allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-97009 | HIGH 7.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-96996 | HIGH 7.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-83837 | HIGH 7.8 | microsoft windows_10_1607 Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-83792 | HIGH 7.8 | microsoft windows_10_21h2 Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-83791 | HIGH 7.8 | microsoft windows_10_1809 Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-83654 | HIGH 7.8 | microsoft windows_10_21h2 Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-83586 | HIGH 7.8 | microsoft windows_11_23h2 Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69945 | HIGH 8.8 | microsoft windows_10_21h2 Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-80093 | HIGH 7.0 | microsoft windows_10_1809 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69771 | MED 4.7 | microsoft windows_11_23h2 Improper link resolution before file access ('link following') in Windows Container Manager Service allows an authorized attacker to bypass a security feature locally. | 0.3% | — |
| CVE-2026-32200 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-88070 | HIGH 7.8 | microsoft windows_10_1607 Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-85338 | HIGH 7.8 | microsoft windows_10_1809 Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69534 | HIGH 7.8 | microsoft windows_10_1607 Improper neutralization of special elements used in a command ('command injection') in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-50523 | HIGH 7.8 | microsoft powershell Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-68792 | HIGH 7.8 | microsoft 365_apps Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-65673 | HIGH 7.8 | microsoft entra_connect Incorrect authorization in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges over a network. | 0.3% | — |