[ Vendor · 1,865 CVEs ]
Microsoft
CVEs affecting Microsoft published in the last 30 days, plus any Microsoft CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2025-24990 | 14 Oct 2025 | CVSS 7.8 | Microsoft Windows Untrusted Pointer DereferenceMicrosoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an… | Exploited |
| CVE-2025-53770 | 20 Jul 2025 | CVSS 9.8 | Microsoft SharePoint Deserialization of Untrusted DataDeserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network… | Exploited |
| CVE-2025-49706 | 8 Jul 2025 | CVSS 6.5 | Microsoft SharePoint Improper AuthenticationImproper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | Exploited |
| CVE-2025-49704 | 8 Jul 2025 | CVSS 8.8 | Microsoft SharePoint Code InjectionImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Exploited |
| CVE-2025-33073 | 10 Jun 2025 | CVSS 8.8 | Microsoft Windows SMB Client Improper Access ControlImproper access control in Windows SMB allows an authorized attacker to elevate privileges over a network. | Exploited |
| CVE-2025-33053 | 10 Jun 2025 | CVSS 8.8 | Microsoft Windows External Control of File Name or PathExternal control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. | Exploited |
| CVE-2025-47827 | 5 Jun 2025 | CVSS 4.6 | IGEL OS Use of a Key Past its Expiration DateIn IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a… | Exploited |
| CVE-2025-32709 | 13 May 2025 | CVSS 7.8 | Microsoft Windows Ancillary Function Driver for WinSock Use-After-FreeNull pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | Exploited |
| CVE-2025-32706 | 13 May 2025 | CVSS 7.8 | Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer OverflowImproper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | Exploited |
| CVE-2025-30397 | 13 May 2025 | CVSS 7.5 | Microsoft Windows Scripting Engine Type ConfusionAccess of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a… | Exploited |
| CVE-2025-30400 | 13 May 2025 | CVSS 7.8 | Microsoft Windows DWM Core Library Use-After-FreeUse after free in Windows DWM allows an authorized attacker to elevate privileges locally. | Exploited |
| CVE-2025-32701 | 13 May 2025 | CVSS 7.8 | Microsoft Windows Common Log File System (CLFS) Driver Use-After-FreeUse after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | Exploited |
| CVE-2025-29824 | 8 Apr 2025 | CVSS 7.8 | Microsoft Windows Common Log File System (CLFS) Driver Use-After-FreeUse after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | Exploited |
| CVE-2025-26633 | 11 Mar 2025 | CVSS 7.0 | Microsoft Windows Management Console (MMC) Improper NeutralizationImproper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. | Exploited |
| CVE-2025-24991 | 11 Mar 2025 | CVSS 5.5 | Microsoft Windows NTFS Out-Of-Bounds ReadOut-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | Exploited |
| CVE-2025-24993 | 11 Mar 2025 | CVSS 7.8 | Microsoft Windows NTFS Heap-Based Buffer OverflowHeap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. | Exploited |
| CVE-2025-24984 | 11 Mar 2025 | CVSS 4.6 | Microsoft Windows NTFS Information DisclosureInsertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack. | ExploitedFix |
| CVE-2025-24985 | 11 Mar 2025 | CVSS 7.8 | Microsoft Windows Fast FAT File System Driver Integer OverflowInteger overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally. | ExploitedFix |
| CVE-2025-24983 | 11 Mar 2025 | CVSS 7.0 | Microsoft Windows Win32k Use-After-FreeUse after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | ExploitedFix |
| CVE-2025-24054 | 11 Mar 2025 | CVSS 5.4 | Microsoft Windows NTLM Hash Disclosure SpoofingExternal control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | Exploited |
| CVE-2025-24989 | 19 Feb 2025 | CVSS 9.8 | Microsoft Power Pages Improper Access ControlAn improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing… | ExploitedFix |
| CVE-2025-21418 | 11 Feb 2025 | CVSS 7.8 | Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer OverflowWindows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2025-21391 | 11 Feb 2025 | CVSS 7.1 | Microsoft Windows Storage Link FollowingWindows Storage Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2025-21333 | 14 Jan 2025 | CVSS 7.8 | Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer OverflowWindows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2025-21334 | 14 Jan 2025 | CVSS 7.8 | Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-FreeWindows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2025-21335 | 14 Jan 2025 | CVSS 7.8 | Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-FreeWindows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-49138 | 12 Dec 2024 | CVSS 7.8 | Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer OverflowWindows Common Log File System Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-49035 | 26 Nov 2024 | CVSS 9.8 | Microsoft Partner Center Improper Access ControlAn improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network. | Exploited |
| CVE-2024-49039 | 12 Nov 2024 | CVSS 8.8 | Microsoft Windows Task Scheduler Privilege EscalationWindows Task Scheduler Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-43451 | 12 Nov 2024 | CVSS 6.5 | Microsoft Windows NTLMv2 Hash Disclosure SpoofingNTLM Hash Disclosure Spoofing Vulnerability | ExploitedFix |
| CVE-2024-43572 | 8 Oct 2024 | CVSS 7.8 | Microsoft Windows Management Console Remote Code ExecutionMicrosoft Management Console Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2024-43573 | 8 Oct 2024 | CVSS 8.1 | Microsoft Windows MSHTML Platform SpoofingWindows MSHTML Platform Spoofing Vulnerability | ExploitedFix |
| CVE-2024-43468 | 8 Oct 2024 | CVSS 9.8 | Microsoft Configuration Manager SQL InjectionMicrosoft Configuration Manager Remote Code Execution Vulnerability | Exploited |
| CVE-2024-43461 | 10 Sep 2024 | CVSS 8.8 | Microsoft Windows MSHTML Platform SpoofingWindows MSHTML Platform Spoofing Vulnerability | ExploitedFix |
| CVE-2024-38226 | 10 Sep 2024 | CVSS 7.3 | Microsoft Publisher Protection Mechanism FailureMicrosoft Publisher Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-38217 | 10 Sep 2024 | CVSS 5.4 | Microsoft Windows Mark of the Web (MOTW) Protection Mechanism FailureWindows Mark of the Web Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-38014 | 10 Sep 2024 | CVSS 7.8 | Microsoft Windows Installer Improper Privilege ManagementWindows Installer Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-38213 | 13 Aug 2024 | CVSS 6.5 | Microsoft Windows SmartScreen Security Feature BypassWindows Mark of the Web Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-38193 | 13 Aug 2024 | CVSS 7.8 | Microsoft Windows Ancillary Function Driver for WinSock Privilege EscalationWindows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-38189 | 13 Aug 2024 | CVSS 8.8 | Microsoft Project Remote Code ExecutionMicrosoft Project Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2024-38178 | 13 Aug 2024 | CVSS 7.5 | Microsoft Windows Scripting Engine Memory CorruptionScripting Engine Memory Corruption Vulnerability | ExploitedFix |
| CVE-2024-38106 | 13 Aug 2024 | CVSS 7.0 | Microsoft Windows Kernel Privilege EscalationWindows Kernel Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-38107 | 13 Aug 2024 | CVSS 7.8 | Microsoft Windows Power Dependency Coordinator Privilege EscalationWindows Power Dependency Coordinator Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-38112 | 9 Jul 2024 | CVSS 7.5 | Microsoft Windows MSHTML Platform SpoofingWindows MSHTML Platform Spoofing Vulnerability | ExploitedFix |
| CVE-2024-38094 | 9 Jul 2024 | CVSS 7.2 | Microsoft SharePoint DeserializationMicrosoft SharePoint Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2024-38080 | 9 Jul 2024 | CVSS 7.8 | Microsoft Windows Hyper-V Privilege EscalationWindows Hyper-V Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-35250 | 11 Jun 2024 | CVSS 7.8 | Microsoft Windows Kernel-Mode Driver Untrusted Pointer DereferenceWindows Kernel-Mode Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-30088 | 11 Jun 2024 | CVSS 7.0 | Microsoft Windows Kernel TOCTOU Race ConditionWindows Kernel Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-30051 | 14 May 2024 | CVSS 7.8 | Microsoft DWM Core Library Privilege EscalationWindows DWM Core Library Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-30040 | 14 May 2024 | CVSS 8.8 | Microsoft Windows MSHTML Platform Security Feature BypassWindows MSHTML Platform Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-29988 | 9 Apr 2024 | CVSS 8.8 | Microsoft SmartScreen Prompt Security Feature BypassSmartScreen Prompt Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-29059 | 23 Mar 2024 | CVSS 7.5 | Microsoft .NET Framework Information Disclosure.NET Framework Information Disclosure Vulnerability | Exploited |
| CVE-2024-26169 | 12 Mar 2024 | CVSS 7.8 | Microsoft Windows Error Reporting Service Improper Privilege ManagementWindows Error Reporting Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-21413 | 13 Feb 2024 | CVSS 9.8 | Microsoft Outlook Improper Input ValidationMicrosoft Outlook Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2024-21410 | 13 Feb 2024 | CVSS 9.8 | Microsoft Exchange Server Privilege EscalationMicrosoft Exchange Server Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-21412 | 13 Feb 2024 | CVSS 8.1 | Microsoft Windows Internet Shortcut Files Security Feature BypassInternet Shortcut Files Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-21351 | 13 Feb 2024 | CVSS 7.6 | Microsoft Windows SmartScreen Security Feature BypassWindows SmartScreen Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-21338 | 13 Feb 2024 | CVSS 7.8 | Microsoft Windows Kernel Exposed IOCTL with Insufficient Access ControlWindows Kernel Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-36424 | 14 Nov 2023 | CVSS 7.8 | Microsoft Windows Out-of-Bounds ReadWindows Common Log File System Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-36036 | 14 Nov 2023 | CVSS 7.8 | Microsoft Windows Cloud Files Mini Filter Driver Privilege EscalationWindows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-36033 | 14 Nov 2023 | CVSS 7.8 | Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege EscalationWindows DWM Core Library Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-36025 | 14 Nov 2023 | CVSS 8.8 | Microsoft Windows SmartScreen Security Feature BypassWindows SmartScreen Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2023-41763 | 10 Oct 2023 | CVSS 5.3 | Microsoft Skype for Business Privilege EscalationSkype for Business Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-36584 | 10 Oct 2023 | CVSS 5.4 | Microsoft Windows Mark of the Web (MOTW) Security Feature BypassWindows Mark of the Web Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2023-36563 | 10 Oct 2023 | CVSS 5.5 | Microsoft WordPad Information DisclosureMicrosoft WordPad Information Disclosure Vulnerability | ExploitedFix |
| CVE-2023-36802 | 12 Sep 2023 | CVSS 7.8 | Microsoft Streaming Service Proxy Privilege EscalationMicrosoft Streaming Service Proxy Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-36761 | 12 Sep 2023 | CVSS 6.5 | Microsoft Word Information DisclosureMicrosoft Word Information Disclosure Vulnerability | ExploitedFix |
| CVE-2023-38180 | 8 Aug 2023 | CVSS 7.5 | Microsoft .NET Core and Visual Studio Denial-of-Service.NET and Visual Studio Denial of Service Vulnerability | ExploitedFix |
| CVE-2023-36884 | 11 Jul 2023 | CVSS 7.5 | Microsoft Windows Search Remote Code ExecutionWindows Search Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2023-36874 | 11 Jul 2023 | CVSS 7.8 | Microsoft Windows Error Reporting Service Privilege EscalationWindows Error Reporting Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-35311 | 11 Jul 2023 | CVSS 8.8 | Microsoft Outlook Security Feature BypassMicrosoft Outlook Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2023-32046 | 11 Jul 2023 | CVSS 7.8 | Microsoft Windows MSHTML Platform Privilege EscalationWindows MSHTML Platform Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-32049 | 11 Jul 2023 | CVSS 8.8 | Microsoft Windows Defender SmartScreen Security Feature BypassWindows SmartScreen Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2023-29360 | 14 Jun 2023 | CVSS 8.4 | Microsoft Streaming Service Untrusted Pointer DereferenceMicrosoft Streaming Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-29357 | 14 Jun 2023 | CVSS 9.8 | Microsoft SharePoint Server Privilege EscalationMicrosoft SharePoint Server Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-24955 | 9 May 2023 | CVSS 7.2 | Microsoft SharePoint Server Code InjectionMicrosoft SharePoint Server Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2023-29336 | 9 May 2023 | CVSS 7.8 | Microsoft Win32K Privilege EscalationWin32k Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-28252 | 11 Apr 2023 | CVSS 7.8 | Microsoft Windows Common Log File System (CLFS) Driver Privilege EscalationWindows Common Log File System Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-28229 | 11 Apr 2023 | CVSS 7.0 | Microsoft Windows CNG Key Isolation Service Privilege EscalationWindows CNG Key Isolation Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-24880 | 14 Mar 2023 | CVSS 4.4 | Microsoft Windows SmartScreen Security Feature BypassWindows SmartScreen Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2023-23397 | 14 Mar 2023 | CVSS 9.8 | Microsoft Office Outlook Privilege EscalationMicrosoft Outlook Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-21823 | 14 Feb 2023 | CVSS 7.8 | Microsoft Windows Graphic Component Privilege EscalationWindows Graphics Component Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2023-23376 | 14 Feb 2023 | CVSS 7.8 | Microsoft Windows Common Log File System (CLFS) Driver Privilege EscalationWindows Common Log File System Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-21715 | 14 Feb 2023 | CVSS 7.3 | Microsoft Office Publisher Security Feature BypassMicrosoft Publisher Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2023-21529 | 14 Feb 2023 | CVSS 8.8 | Microsoft Exchange Server Deserialization of Untrusted DataMicrosoft Exchange Server Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2023-21674 | 10 Jan 2023 | CVSS 8.8 | Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege EscalationWindows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-44698 | 13 Dec 2022 | CVSS 5.4 | Microsoft Defender SmartScreen Security Feature BypassWindows SmartScreen Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2022-41125 | 9 Nov 2022 | CVSS 7.8 | Microsoft Windows CNG Key Isolation Service Privilege EscalationWindows CNG Key Isolation Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-41128 | 9 Nov 2022 | CVSS 8.8 | Microsoft Windows Scripting Languages Remote Code ExecutionWindows Scripting Languages Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2022-41091 | 9 Nov 2022 | CVSS 5.4 | Microsoft Windows Mark of the Web (MOTW) Security Feature BypassWindows Mark of the Web Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2022-41073 | 9 Nov 2022 | CVSS 7.8 | Microsoft Windows Print Spooler Privilege EscalationWindows Print Spooler Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-41080 | 9 Nov 2022 | CVSS 8.8 | Microsoft Exchange Server Privilege EscalationMicrosoft Exchange Server Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-41049 | 9 Nov 2022 | CVSS 5.4 | Microsoft Windows Mark of the Web (MOTW) Security Feature BypassWindows Mark of the Web Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2022-41033 | 11 Oct 2022 | CVSS 7.8 | Microsoft Windows COM+ Event System Service Privilege EscalationWindows COM+ Event System Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-38028 | 11 Oct 2022 | CVSS 7.8 | Microsoft Windows Print Spooler Privilege EscalationWindows Print Spooler Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-41040 | 3 Oct 2022 | CVSS 8.8 | Microsoft Exchange Server Server-Side Request ForgeryMicrosoft Exchange Server Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-41082 | 3 Oct 2022 | CVSS 8.0 | Microsoft Exchange Server Remote Code ExecutionMicrosoft Exchange Server Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2022-37969 | 13 Sep 2022 | CVSS 7.8 | Microsoft Windows Common Log File System (CLFS) Driver Privilege EscalationWindows Common Log File System Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-34713 | 9 Aug 2022 | CVSS 7.8 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code ExecutionMicrosoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2022-22047 | 12 Jul 2022 | CVSS 7.8 | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege EscalationWindows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability | ExploitedFix |
Page 16 of 19