[ Vendor · 1,865 CVEs ]
Microsoft
CVEs affecting Microsoft published in the last 30 days, plus any Microsoft CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-97785 | 22 Oct 2026 | CVSS 10.0 | Microsoft Entra application proxyImproper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-96185 | 22 Oct 2026 | CVSS 7.5 | Microsoft Exchange OnlineStack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network. | |
| CVE-2026-83938 | 22 Oct 2026 | CVSS 10.0 | Microsoft Azure Kubernetes Configuration ServiceMissing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a… | |
| CVE-2026-110063 | 22 Oct 2026 | CVSS 10.0 | Microsoft VM Inspector for Azure Virtual MachinesImproper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate… | |
| CVE-2026-108456 | 22 Oct 2026 | CVSS 7.7 | Microsoft Azure AI FoundryServer-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-105014 | 22 Oct 2026 | CVSS 9.1 | Microsoft Azure PipelinesImproper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute… | |
| CVE-2026-80092 | 16 Oct 2026 | CVSS 5.3 | microsoft-identity-webAuthentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-109461 | 16 Oct 2026 | CVSS 5.9 | Microsoft Identity Client for NodeJSOrigin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-109468 | 15 Oct 2026 | CVSS 7.5 | Microsoft Visual Studio 2022 version 17.14Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-108453 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108454 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseBuffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108455 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108445 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseStack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108446 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108447 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108448 | 15 Oct 2026 | CVSS 7.5 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108449 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108450 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108451 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseNumeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108452 | 15 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionImproper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to… | Fix |
| CVE-2026-108436 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108437 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108438 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108439 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108440 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseStack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108441 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108442 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108443 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseOff-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108444 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108428 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108429 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108430 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108431 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseStack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108432 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108433 | 15 Oct 2026 | CVSS 7.8 | Microsoft 365 Apps for EnterpriseReliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | |
| CVE-2026-108434 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108435 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseUntrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108426 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108427 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88164 | 14 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionMissing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-96956 | 13 Oct 2026 | CVSS 8.0 | Microsoft SQL Server 2017 (GDR)Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-94512 | 13 Oct 2026 | CVSS 8.8 | Microsoft SQL Server 2017 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | |
| CVE-2026-94520 | 13 Oct 2026 | CVSS 4.9 | Microsoft SQL Server 2017 (GDR)Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network. | |
| CVE-2026-88085 | 13 Oct 2026 | CVSS 6.4 | Microsoft SQL Server 2017 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88086 | 13 Oct 2026 | CVSS 5.3 | Microsoft SQL Server 2019 (GDR)Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network. | |
| CVE-2026-88088 | 13 Oct 2026 | CVSS 7.0 | Microsoft SQL Server 2019 (GDR)Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88089 | 13 Oct 2026 | CVSS 6.7 | Microsoft SQL Server 2017 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. | |
| CVE-2026-88081 | 13 Oct 2026 | CVSS 7.7 | Microsoft SQL Server 2017 (GDR)Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-88082 | 13 Oct 2026 | CVSS 7.0 | Microsoft SQL Server 2019 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88083 | 13 Oct 2026 | CVSS 7.5 | Microsoft SQL Server 2022 (CU 26)Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88084 | 13 Oct 2026 | CVSS 5.3 | Microsoft SQL Server 2019 (GDR)Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network. | |
| CVE-2026-85919 | 13 Oct 2026 | CVSS 7.0 | Microsoft SQL Server 2019 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85886 | 13 Oct 2026 | CVSS 8.5 | Microsoft SQL Server 2017 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | |
| CVE-2026-85888 | 13 Oct 2026 | CVSS 7.7 | Microsoft SQL Server 2017 (GDR)Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-85876 | 13 Oct 2026 | CVSS 7.0 | Microsoft SQL Server 2019 (GDR)Use after free in SQL Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83945 | 13 Oct 2026 | CVSS 6.6 | Microsoft SQL Server 2022 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | |
| CVE-2026-70189 | 13 Oct 2026 | CVSS 6.7 | Microsoft SQL Server 2017 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. | |
| CVE-2026-65674 | 13 Oct 2026 | CVSS 8.8 | Microsoft SQL Server 2019 (GDR)Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. | |
| CVE-2026-67625 | 13 Oct 2026 | CVSS 8.5 | Microsoft SQL Server 2017 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | |
| CVE-2026-67626 | 13 Oct 2026 | CVSS 6.5 | Microsoft SQL Server 2022 (GDR)Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network. | |
| CVE-2026-67628 | 13 Oct 2026 | CVSS 4.9 | Microsoft SQL Server 2017 (GDR)Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-68883 | 13 Oct 2026 | CVSS 8.5 | Microsoft SQL Server 2017 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-62840 | 13 Oct 2026 | CVSS 7.0 | Microsoft Linux 3P (Third Party) DistrosTime-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70098 | 13 Oct 2026 | CVSS 8.8 | Microsoft Visual Studio CodeMissing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102855 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102234 | 13 Oct 2026 | CVSS 7.4 | Microsoft Visual Studio CodeReliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | |
| CVE-2026-102235 | 13 Oct 2026 | CVSS 8.8 | Microsoft Visual Studio CodeImproper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102238 | 13 Oct 2026 | CVSS 9.6 | Microsoft Visual Studio CodeImproper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code… | |
| CVE-2026-97844 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97839 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97840 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97841 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97842 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97843 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97833 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97834 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97835 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97836 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97837 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97838 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97828 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Buffer over-read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97829 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97830 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 11 version 23H2Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-97831 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97832 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97823 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97824 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97825 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97826 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97827 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97816 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1809Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-97817 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97819 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97820 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97821 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97822 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-97809 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-97810 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-97811 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-97812 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. | Fix |
Page 1 of 19