60.368 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.844 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-20924 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-20918 | HIGH 7.8 | microsoft windows_10_1809 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-20877 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-83991 | MED 5.5 | microsoft windows_10_1809 Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-73004 | MED 5.5 | microsoft windows_10_21h2 Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-72966 | MED 5.5 | microsoft windows_10_1607 Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-72964 | MED 5.5 | microsoft windows_10_1607 Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-69674 | MED 5.5 | microsoft windows_10_1809 Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally. | 0.3% | — |
| CVE-2026-69554 | MED 5.5 | microsoft windows_10_1607 Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-69531 | MED 5.5 | microsoft windows_10_1607 Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-69453 | MED 5.5 | microsoft windows_10_1607 Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-69321 | MED 5.5 | microsoft windows_10_1607 Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-61936 | MED 5.5 | microsoft windows_10_1809 Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally. | 0.3% | — |
| CVE-2026-50495 | MED 6.1 | microsoft windows_10_1809 Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-50295 | MED 5.5 | microsoft windows_11_24h2 Improper privilege management in Microsoft Windows DNS allows an authorized attacker to bypass a security feature locally. | 0.3% | — |
| CVE-2026-41092 | HIGH 7.8 | microsoft windows_10_1607 Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-45494 | MED 5.4 | microsoft edge_chromium Microsoft Edge (Chromium-based) Spoofing Vulnerability | 0.3% | — |
| CVE-2026-45492 | MED 5.4 | microsoft edge_chromium Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. | 0.3% | — |
| CVE-2026-96220 | HIGH 7.8 | microsoft windows_10_1809 Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-70122 | MED 6.5 | microsoft windows_10_21h2 Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-42901 | CRIT 10.0 | microsoft entra_id Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. | 0.3% | — |
| CVE-2026-88193 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-83931 | HIGH 7.8 | microsoft windows_11_23h2 Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-83924 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-83900 | HIGH 7.0 | microsoft windows_11_23h2 Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. | 0.3% | — |