[ Vendor · 1,865 CVEs ]
Microsoft
CVEs affecting Microsoft published in the last 30 days, plus any Microsoft CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-69979 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 21H2Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-69982 | 13 Oct 2026 | CVSS 5.9 | Microsoft Windows 10 Version 1607Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network. | |
| CVE-2026-69967 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information locally. | |
| CVE-2026-69968 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1809Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform tampering over a network. | |
| CVE-2026-69969 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 21H2Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose… | |
| CVE-2026-69970 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69971 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 11 Version 24H2Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. | |
| CVE-2026-69973 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1809Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Libarchive allows an unauthorized attacker to perform… | |
| CVE-2026-69957 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69958 | 13 Oct 2026 | CVSS 6.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack. | Fix |
| CVE-2026-69959 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally. | Fix |
| CVE-2026-69963 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69964 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69966 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69950 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69952 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69953 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69954 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-69955 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-69935 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69940 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-69942 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally. | Fix |
| CVE-2026-69943 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionImproper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to… | Fix |
| CVE-2026-69945 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 21H2Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69947 | 13 Oct 2026 | CVSS 6.8 | Microsoft Windows 10 Version 21H2Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack. | Fix |
| CVE-2026-69949 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69918 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69919 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 11 Version 24H2Out-of-bounds read in Windows Cryptographic Services allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-69922 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-69923 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 Version 24H2Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69926 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69931 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to… | Fix |
| CVE-2026-69934 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69905 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally. | Fix |
| CVE-2026-69909 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69913 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-69914 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Out-of-bounds read in Windows AppX Deployment Service allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-69915 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69916 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69882 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69883 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-69884 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69886 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-69898 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69902 | 13 Oct 2026 | CVSS 6.7 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Windows NTFS allows an authorized attacker to execute code locally. | Fix |
| CVE-2026-69840 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69850 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69856 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69867 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69877 | 13 Oct 2026 | CVSS 6.5 | Microsoft Azure CLIOrigin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-69880 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-69766 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69783 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69789 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network. | |
| CVE-2026-69795 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69798 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69802 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows Server 2012Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69830 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to… | |
| CVE-2026-69721 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information locally. | |
| CVE-2026-69733 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69736 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized… | |
| CVE-2026-69743 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69763 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69765 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows Server 2025Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69644 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows an authorized attacker to disclose information… | |
| CVE-2026-69650 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69651 | 13 Oct 2026 | CVSS 7.5 | Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of ServiceInefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-69673 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69675 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows Server 2012Out-of-bounds read in Windows Network File System allows an authorized attacker to disclose information locally. | |
| CVE-2026-69705 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69718 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate… | |
| CVE-2026-69596 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69633 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69634 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69635 | 13 Oct 2026 | CVSS 6.6 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges with a physical attack. | |
| CVE-2026-69639 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69640 | 13 Oct 2026 | CVSS 5.3 | Microsoft Windows 10 Version 1607Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network. | |
| CVE-2026-69452 | 13 Oct 2026 | CVSS 7.1 | Microsoft Windows 10 Version 1607Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-69454 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows Server 2019Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose… | |
| CVE-2026-69471 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69506 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally. | |
| CVE-2026-69521 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69577 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows Server 2019Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose… | |
| CVE-2026-69326 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69354 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-69363 | 13 Oct 2026 | CVSS 8.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-69370 | 13 Oct 2026 | CVSS 8.8 | Microsoft Visual Studio CodeImproper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute… | |
| CVE-2026-69387 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-61931 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-62687 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 21H2Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose information locally. | |
| CVE-2026-62879 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally. | |
| CVE-2026-66822 | 13 Oct 2026 | CVSS 5.9 | Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information DisclosureInsertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-68836 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-49785 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-58280 | 13 Oct 2026 | CVSS 7.5 | Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of ServiceUncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-59116 | 13 Oct 2026 | CVSS 6.8 | Microsoft Windows 10 Version 1607Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a… | |
| CVE-2026-109453 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108468 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108471 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1809Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108462 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information… |
Page 13 of 19