[ Vendor · 1,865 CVEs ]
Microsoft
CVEs affecting Microsoft published in the last 30 days, plus any Microsoft CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108463 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 11 Version 24H2Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network. | |
| CVE-2026-108464 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108465 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108466 | 13 Oct 2026 | CVSS 5.3 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-108467 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network. | |
| CVE-2026-108399 | 13 Oct 2026 | CVSS 7.2 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108400 | 13 Oct 2026 | CVSS 8.8 | Microsoft HEVC Video ExtensionsInteger overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108457 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 21H2Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108458 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108460 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108461 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108136 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108396 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges… | |
| CVE-2026-108398 | 13 Oct 2026 | CVSS 8.8 | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-108130 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 Version 24H2Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108131 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | |
| CVE-2026-108132 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108133 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows Server 2022Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108134 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108135 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108127 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-108128 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-108129 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-105729 | 13 Oct 2026 | CVSS 7.1 | Microsoft Windows Sysinternals Process MonitorUntrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105731 | 13 Oct 2026 | CVSS 5.5 | Microsoft Office for AndroidUse of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally. | |
| CVE-2026-105732 | 13 Oct 2026 | CVSS 7.3 | Microsoft Sysinternals SuiteStack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105733 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 21H2Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally. | |
| CVE-2026-105720 | 13 Oct 2026 | CVSS 4.3 | Microsoft SharePoint Server Subscription EditionIncorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-105722 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105723 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-105725 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows Security AppUse after free in Windows Security App allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105726 | 13 Oct 2026 | CVSS 5.5 | Microsoft Defender for Endpoint for WindowsOut-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally. | |
| CVE-2026-105727 | 13 Oct 2026 | CVSS 8.8 | Microsoft Dynamics NAV 2018Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate… | |
| CVE-2026-105728 | 13 Oct 2026 | CVSS 7.5 | Microsoft Dynamics NAV 2018Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-105713 | 13 Oct 2026 | CVSS 5.7 | Microsoft SharePoint Server Subscription EditionServer-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network. | Fix |
| CVE-2026-105714 | 13 Oct 2026 | CVSS 7.5 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105715 | 13 Oct 2026 | CVSS 7.5 | Microsoft 365 Apps for EnterpriseInteger overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105716 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105717 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105718 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-105719 | 13 Oct 2026 | CVSS 6.5 | Microsoft SharePoint Server Subscription EditionImproper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | Fix |
| CVE-2026-105591 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105592 | 13 Oct 2026 | CVSS 7.5 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105593 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105595 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105596 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105597 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105598 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105599 | 13 Oct 2026 | CVSS 7.5 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105008 | 13 Oct 2026 | CVSS 9.0 | Microsoft Windows 10 Version 1607No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. | |
| CVE-2026-105009 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows Server 2012Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105010 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-105013 | 13 Oct 2026 | CVSS 7.4 | Microsoft SharePoint Server Subscription EditionDeserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Fix |
| CVE-2026-105016 | 13 Oct 2026 | CVSS 9.8 | Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code ExecutionHeap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-105003 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105004 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105005 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 11 version 26H1Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105006 | 13 Oct 2026 | CVSS 6.4 | Microsoft Windows 10 Version 1607Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack. | |
| CVE-2026-105007 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a… | |
| CVE-2026-103569 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-103572 | 13 Oct 2026 | CVSS 8.8 | Microsoft Visual Studio 2022 version 17.14Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an… | |
| CVE-2026-103575 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-103576 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform… | |
| CVE-2026-103577 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 11 version 23H2Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network. | |
| CVE-2026-103578 | 13 Oct 2026 | CVSS 6.8 | Microsoft Windows 11 version 26H1Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. | |
| CVE-2026-103555 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-103558 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-103560 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows Server 2012Improper authorization in DNS Server allows an authorized attacker to perform tampering locally. | |
| CVE-2026-103565 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-103567 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. | |
| CVE-2026-103568 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized… | |
| CVE-2026-102865 | 13 Oct 2026 | CVSS 6.5 | Microsoft SharePoint Server Subscription EditionIncorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | Fix |
| CVE-2026-102866 | 13 Oct 2026 | CVSS 8.1 | Microsoft SharePoint Server Subscription EditionImproper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-102867 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-102869 | 13 Oct 2026 | CVSS 8.8 | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a… | |
| CVE-2026-102870 | 13 Oct 2026 | CVSS 8.8 | Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code ExecutionImproper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-103553 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-103554 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-102857 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102858 | 13 Oct 2026 | CVSS 8.8 | Microsoft Office 365 for MacHeap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102859 | 13 Oct 2026 | CVSS 4.6 | Microsoft SharePoint Server Subscription EditionImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to… | Fix |
| CVE-2026-102860 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionImproper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-102861 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionMissing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-102862 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionIncorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-102863 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a… | Fix |
| CVE-2026-102864 | 13 Oct 2026 | CVSS 4.6 | Microsoft SharePoint Server Subscription EditionImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to… | Fix |
| CVE-2026-102849 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102850 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102851 | 13 Oct 2026 | CVSS 6.1 | Microsoft Visual Studio CodeIncorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-102856 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102225 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-102226 | 13 Oct 2026 | CVSS 8.8 | Microsoft Dynamics NAV 2018Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate… | |
| CVE-2026-102227 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. | |
| CVE-2026-102229 | 13 Oct 2026 | CVSS 6.8 | Microsoft Visual Studio CodeImproper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose… | |
| CVE-2026-102231 | 13 Oct 2026 | CVSS 7.7 | Microsoft Visual Studio CodeImproper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | |
| CVE-2026-102232 | 13 Oct 2026 | CVSS 7.0 | Microsoft Visual Studio CodeIncorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | |
| CVE-2026-102233 | 13 Oct 2026 | CVSS 7.8 | Microsoft Visual Studio CodeMissing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | |
| CVE-2026-102215 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102216 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges… | Fix |
| CVE-2026-102217 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network. | Fix |
Page 14 of 19