60.368 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.844 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-77887 | MED 6.4 | microsoft windows_10_1607 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-73017 | HIGH 7.5 | microsoft windows_10_1809 Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-71338 | MED 6.4 | microsoft windows_10_1607 Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69890 | HIGH 7.5 | microsoft windows_10_1809 Use after free in Windows Virtual Trusted Platform Module allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69878 | MED 6.4 | microsoft windows_10_1607 Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-56179 | HIGH 8.3 | microsoft windows_11_24h2 Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network. | 0.3% | — |
| CVE-2026-56181 | HIGH 8.3 | microsoft windows_11_24h2 Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network. | 0.3% | — |
| CVE-2026-95943 | HIGH 7.0 | microsoft windows_11_23h2 Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-87713 | HIGH 7.5 | microsoft windows_10_1607 Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network. | 0.3% | — |
| CVE-2026-83846 | HIGH 7.0 | microsoft windows_10_1809 Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-83741 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69964 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-70212 | HIGH 7.0 | microsoft windows_10_1607 Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-41108 | HIGH 7.0 | microsoft windows_10_1607 Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2025-49762 | HIGH 7.0 | microsoft windows_10_1507 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2023-33156 | MED 6.3 | microsoft malware_protection_engine Microsoft Defender Elevation of Privilege Vulnerability | 0.3% | — |
| CVE-2026-40397 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-21237 | HIGH 7.0 | microsoft windows_10_21h2 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-21234 | HIGH 7.0 | microsoft windows_10_1809 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2025-59278 | HIGH 7.8 | microsoft windows_10_1507 Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2025-59275 | HIGH 7.8 | microsoft windows_10_1507 Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2023-35340 | HIGH 7.8 | microsoft windows_10_1507 Windows CNG Key Isolation Service Elevation of Privilege Vulnerability | 0.3% | — |
| CVE-2023-24861 | HIGH 7.0 | microsoft windows_10_1507 Windows Graphics Component Elevation of Privilege Vulnerability | 0.3% | — |
| CVE-2026-88208 | MED 4.6 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.3% | — |
| CVE-2026-40417 | HIGH 7.8 | microsoft dynamics_365_business_central Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally. | 0.3% | — |