[ Vendor · 1,865 CVEs ]
Microsoft
CVEs affecting Microsoft published in the last 30 days, plus any Microsoft CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-70250 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows Server 2012Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network. | |
| CVE-2026-70251 | 13 Oct 2026 | CVSS 7.5 | Microsoft SharePoint Server Subscription EditionServer-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-70243 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70244 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-70245 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to… | |
| CVE-2026-70246 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionIncorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-70247 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally. | |
| CVE-2026-70235 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 11 Version 24H2Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally. | |
| CVE-2026-70236 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70237 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70238 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70241 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70242 | 13 Oct 2026 | CVSS 9.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70228 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70229 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70230 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70232 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information… | Fix |
| CVE-2026-70233 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70234 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Buffer over-read in Desktop Window Manager allows an authorized attacker to disclose information locally. | |
| CVE-2026-70223 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70225 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to… | |
| CVE-2026-70227 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 11 version 23H2Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally. | |
| CVE-2026-70222 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70214 | 13 Oct 2026 | CVSS 5.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | |
| CVE-2026-70215 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70216 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Insufficient granularity of access control in Windows Mobile Device Management allows an authorized attacker to perform tampering locally. | |
| CVE-2026-70217 | 13 Oct 2026 | CVSS 4.9 | Microsoft SharePoint Server Subscription EditionImproper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | Fix |
| CVE-2026-70218 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 Version 24H2Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70219 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-70220 | 13 Oct 2026 | CVSS 7.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | |
| CVE-2026-70209 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70210 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-70211 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-70212 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges… | |
| CVE-2026-70213 | 13 Oct 2026 | CVSS 8.0 | Microsoft Power Apps for AndroidOrigin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network. | |
| CVE-2026-70199 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information… | Fix |
| CVE-2026-70201 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows Server 2012Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service locally. | |
| CVE-2026-70202 | 13 Oct 2026 | CVSS 7.5 | Microsoft SharePoint Server Subscription EditionServer-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-70205 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to… | |
| CVE-2026-70206 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-70207 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network. | |
| CVE-2026-70208 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to disclose information locally. | |
| CVE-2026-70188 | 13 Oct 2026 | CVSS 9.1 | Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature BypassInconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security… | Fix |
| CVE-2026-70190 | 13 Oct 2026 | CVSS 7.3 | Microsoft .NET 10.0 runtimeImproper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70194 | 13 Oct 2026 | CVSS 6.5 | Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature BypassImproper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network. | Fix |
| CVE-2026-70195 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1607Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally. | |
| CVE-2026-70196 | 13 Oct 2026 | CVSS 5.9 | Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of ServiceInefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-70197 | 13 Oct 2026 | CVSS 8.1 | Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code ExecutionOut-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-70198 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70179 | 13 Oct 2026 | CVSS 7.5 | Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of PrivilegeAuthentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-70181 | 13 Oct 2026 | CVSS 7.5 | Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of ServiceAllocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-70183 | 13 Oct 2026 | CVSS 7.5 | Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature BypassConcurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate… | Fix |
| CVE-2026-70184 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 21H2Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70185 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-70186 | 13 Oct 2026 | CVSS 7.5 | Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of ServiceDeadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-70187 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows Server 2012Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70170 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Windows Kernel allows an authorized attacker to deny service over a network. | Fix |
| CVE-2026-70172 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70173 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | |
| CVE-2026-70174 | 13 Oct 2026 | CVSS 8.8 | Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code ExecutionImproperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-70175 | 13 Oct 2026 | CVSS 8.1 | Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of PrivilegeImproper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-70176 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70177 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70164 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70165 | 13 Oct 2026 | CVSS 6.7 | Microsoft .NET 10.0 runtimeImproper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70166 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network. | |
| CVE-2026-70167 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows Server 2022Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network. | |
| CVE-2026-70168 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70169 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an… | |
| CVE-2026-70157 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70158 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | |
| CVE-2026-70159 | 13 Oct 2026 | CVSS 7.5 | Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of ServiceAllocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-70160 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70161 | 13 Oct 2026 | CVSS 7.3 | Microsoft .NET 10.0 runtimeImproper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70162 | 13 Oct 2026 | CVSS 5.9 | Microsoft Security Advisory CVE-2026-70162 - .NET Denial of ServiceA denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully… | Fix |
| CVE-2026-70163 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1809Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-70149 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose… | |
| CVE-2026-70150 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70151 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 21H2Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70153 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70155 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-70156 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70141 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | |
| CVE-2026-70142 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70143 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally. | |
| CVE-2026-70144 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70147 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70148 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1809Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. | |
| CVE-2026-70135 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Remote POS Driver allows an authorized attacker to disclose information locally. | |
| CVE-2026-70136 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70137 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally. | |
| CVE-2026-70138 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70139 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70140 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70128 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. | |
| CVE-2026-70131 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally. | |
| CVE-2026-70132 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70133 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-70134 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70118 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
Page 11 of 19