60.368 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
17.844 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-26166 | HIGH 7.0 | microsoft windows_11_23h2 Double free in Windows Shell allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-85863 | HIGH 7.8 | microsoft windows_10_1607 Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-85861 | HIGH 7.8 | microsoft windows_10_1607 Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-83510 | HIGH 7.0 | microsoft windows_10_1607 Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-81971 | HIGH 7.0 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-96306 | HIGH 7.8 | microsoft windows_10_1607 Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-88189 | HIGH 7.8 | microsoft windows_10_1809 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-88180 | HIGH 7.8 | microsoft windows_10_1809 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-88177 | HIGH 7.8 | microsoft windows_10_1607 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-88080 | HIGH 7.8 | microsoft windows_10_1607 Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-87712 | HIGH 7.8 | microsoft windows_10_1607 Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-87711 | HIGH 7.8 | microsoft windows_10_1607 Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-42838 | MED 5.4 | microsoft edge_chromium Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | 0.2% | — |
| CVE-2026-27920 | HIGH 7.8 | microsoft windows_10_1607 Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-27916 | HIGH 7.8 | microsoft windows_10_1607 Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-26184 | HIGH 7.8 | microsoft windows_10_1809 Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2025-49728 | MED 4.0 | microsoft pc_manager Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally. | 0.2% | — |
| CVE-2026-83798 | MED 5.5 | microsoft windows_10_1607 Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally. | 0.2% | — |
| CVE-2026-49161 | HIGH 7.8 | microsoft pc_manager Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally. | 0.2% | — |
| CVE-2026-21221 | HIGH 7.0 | microsoft windows_11_24h2 Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-88088 | HIGH 7.0 | microsoft sql_server_2019 Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-88082 | HIGH 7.0 | microsoft sql_server_2019 Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-85919 | HIGH 7.0 | microsoft sql_server_2019 Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-70283 | HIGH 7.0 | microsoft windows_10_1607 Incorrect authorization in Windows Win32K allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-50325 | HIGH 7.0 | microsoft windows_10_1607 Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. | 0.2% | — |