[ Vendor · 1,865 CVEs ]
Microsoft
CVEs affecting Microsoft published in the last 30 days, plus any Microsoft CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-70119 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows Server 2022Out-of-bounds read in Windows DNS allows an authorized attacker to execute code over a network. | |
| CVE-2026-70121 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70122 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 21H2Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70123 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70126 | 13 Oct 2026 | CVSS 7.1 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network. | |
| CVE-2026-70127 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Use after free in DNS Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70112 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally. | |
| CVE-2026-70113 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70114 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70115 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70116 | 13 Oct 2026 | CVSS 4.2 | Microsoft Windows 11 Version 24H2Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to bypass a security feature with a physical… | |
| CVE-2026-70117 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70104 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70106 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70108 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70109 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally. | |
| CVE-2026-70110 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally. | |
| CVE-2026-70111 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-70093 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70095 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-70096 | 13 Oct 2026 | CVSS 9.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70097 | 13 Oct 2026 | CVSS 5.6 | Microsoft Windows 11 Version 24H2Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Virtualization-Based Security (VBS) Enclave… | Fix |
| CVE-2026-70102 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70103 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70085 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows Server 2012Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | |
| CVE-2026-70086 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70087 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Incorrect authorization in DNS Server allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-70089 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70090 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally. | |
| CVE-2026-70092 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70075 | 13 Oct 2026 | CVSS 4.4 | Microsoft Windows 10 Version 1809Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a… | |
| CVE-2026-70076 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70077 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1607Use after free in Windows Kernel allows an authorized attacker to disclose information locally. | |
| CVE-2026-70079 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-70082 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows Server 2012Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-70083 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally. | |
| CVE-2026-70084 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally. | |
| CVE-2026-70068 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-70069 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network. | |
| CVE-2026-70071 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally. | |
| CVE-2026-70072 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Allocation of resources without limits or throttling in Windows Netlogon allows an authorized attacker to deny service over a network. | |
| CVE-2026-70074 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information locally. | |
| CVE-2026-70060 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70062 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1809Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70063 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally. | |
| CVE-2026-70064 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70066 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70067 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70054 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70055 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to… | |
| CVE-2026-70056 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70057 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-70058 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70059 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70044 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to disclose information locally. | Fix |
| CVE-2026-70045 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70048 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70049 | 13 Oct 2026 | CVSS 8.0 | Microsoft Configuration ManagerImproper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker… | |
| CVE-2026-70051 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70052 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally. | |
| CVE-2026-70027 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 21H2Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70031 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-70033 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-70035 | 13 Oct 2026 | CVSS 8.8 | Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code ExecutionDeserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-70038 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-70041 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-70017 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Access of resource using incompatible type ('type confusion') in Windows Secure Kernel Mode allows an authorized attacker to disclose information… | Fix |
| CVE-2026-70021 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70023 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70024 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-70025 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Use after free in Windows Netlogon allows an authorized attacker to deny service over a network. | Fix |
| CVE-2026-70026 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-70010 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70011 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 21H2Out-of-bounds read in Windows IP Over USB Service allows an authorized attacker to disclose information locally. | |
| CVE-2026-70012 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-70013 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-70014 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network. | Fix |
| CVE-2026-70015 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69999 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 11 version 23H2Out-of-bounds read in Windows Update allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-70004 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-70005 | 13 Oct 2026 | CVSS 5.9 | Microsoft Windows Server 2019Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network. | |
| CVE-2026-70006 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70007 | 13 Oct 2026 | CVSS 8.8 | Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code ExecutionOut-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-70008 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 21H2Integer overflow or wraparound in Windows IP Over USB Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69992 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-69994 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-69995 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-69996 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-69997 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-69998 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-69984 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69985 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69986 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69987 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69988 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69991 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-69974 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1809Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally. | |
| CVE-2026-69976 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69977 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69978 | 13 Oct 2026 | CVSS 5.6 | Microsoft Windows 10 Version 1809Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally. |
Page 12 of 19