60.368 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.844 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-58616 | MED 4.4 | microsoft edge_chromium Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network. | 0.3% | — |
| CVE-2026-50375 | MED 6.3 | microsoft windows_10_1809 Heap-based buffer overflow in Windows DirectX allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2023-21733 | HIGH 7.0 | microsoft windows_10_20h2 Windows Bind Filter Driver Elevation of Privilege Vulnerability | 0.3% | — |
| CVE-2026-88158 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose information locally. | 0.3% | — |
| CVE-2025-59192 | HIGH 7.8 | microsoft windows_10_1507 Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-32196 | MED 6.1 | microsoft windows_admin_center Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network. | 0.3% | — |
| CVE-2026-20874 | HIGH 7.8 | microsoft windows_10_1809 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-20873 | HIGH 7.8 | microsoft windows_10_1809 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-20869 | HIGH 7.0 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-20867 | HIGH 7.8 | microsoft windows_10_1809 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-20866 | HIGH 7.8 | microsoft windows_10_1809 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-20861 | HIGH 7.8 | microsoft windows_10_1809 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-20858 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-20815 | HIGH 7.0 | microsoft windows_11_24h2 Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-20814 | HIGH 7.0 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-20808 | HIGH 7.0 | microsoft windows_11_24h2 Concurrent execution using shared resource with improper synchronization ('race condition') in Printer Association Object allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-41102 | HIGH 7.1 | microsoft powerpoint Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally. | 0.3% | — |
| CVE-2026-41101 | HIGH 7.1 | microsoft word Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally. | 0.3% | — |
| CVE-2026-34339 | MED 5.5 | microsoft windows_10_1607 Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service locally. | 0.3% | — |
| CVE-2026-32221 | HIGH 8.4 | microsoft windows_11_24h2 Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-32198 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.3% | — |
| CVE-2025-55678 | HIGH 7.0 | microsoft windows_10_1507 Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-97811 | HIGH 7.8 | microsoft windows_10_1809 Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69874 | HIGH 8.2 | microsoft windows_10_1809 Untrusted pointer dereference in Windows ALPC allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-42902 | HIGH 7.8 | microsoft powertoys Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges locally. | 0.3% | — |