[ Vendor · 1,865 CVEs ]
Microsoft
CVEs affecting Microsoft published in the last 30 days, plus any Microsoft CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-96933 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96934 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-96935 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information… | Fix |
| CVE-2026-96937 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96925 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally. | |
| CVE-2026-96926 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | |
| CVE-2026-96927 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | |
| CVE-2026-96928 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96929 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96930 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-96918 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96919 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96920 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96921 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose… | |
| CVE-2026-96923 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Workstation Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96924 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-96912 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96913 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96914 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96915 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96916 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96917 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96866 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-96867 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally. | |
| CVE-2026-96868 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96909 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 11 version 23H2Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-96910 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | |
| CVE-2026-96911 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate… | |
| CVE-2026-96861 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-96862 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96863 | 13 Oct 2026 | CVSS 6.8 | Microsoft Windows 11 version 23H2Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack. | |
| CVE-2026-96864 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-96865 | 13 Oct 2026 | CVSS 5.6 | Microsoft Windows 10 Version 1607Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose… | |
| CVE-2026-96854 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Access of resource using incompatible type ('type confusion') in Windows Device Association Service allows an authorized attacker to disclose… | |
| CVE-2026-96855 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. | |
| CVE-2026-96856 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96857 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally. | |
| CVE-2026-96858 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 21H2Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally. | |
| CVE-2026-96859 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose information locally. | |
| CVE-2026-96860 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally. | |
| CVE-2026-96848 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-96849 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 11 version 26H1Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-96850 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-96851 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-96852 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96853 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1607Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | |
| CVE-2026-96325 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-96843 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96844 | 13 Oct 2026 | CVSS 8.0 | Microsoft Windows 10 Version 1607Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network. | Fix |
| CVE-2026-96846 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in WebDAV allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-96847 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96323 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Use after free in Windows Update allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96324 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96320 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-96321 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 21H2Out-of-bounds read in Remote Desktop Display Driver allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-96322 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96314 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Audio Service allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-96315 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally. | Fix |
| CVE-2026-96316 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally. | Fix |
| CVE-2026-96317 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96318 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96319 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96308 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96309 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 21H2Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96310 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96311 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally. | Fix |
| CVE-2026-96312 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96313 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96302 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96303 | 13 Oct 2026 | CVSS 6.5 | Microsoft PowerShell 7.4Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a… | |
| CVE-2026-96304 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96305 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96306 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96307 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96250 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96251 | 13 Oct 2026 | CVSS 8.8 | Microsoft PowerShell 7.4Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-96252 | 13 Oct 2026 | CVSS 9.1 | Microsoft Windows 10 Version 1607Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing… | |
| CVE-2026-96253 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96254 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96300 | 13 Oct 2026 | CVSS 5.9 | Microsoft Windows 10 Version 1607Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-96301 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96245 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-96246 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-96247 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-96248 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-96249 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 Version 24H2Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96233 | 13 Oct 2026 | CVSS 7.5 | Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of ServiceOut-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-96234 | 13 Oct 2026 | CVSS 5.3 | Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information DisclosureOrigin validation error in .NET allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-96235 | 13 Oct 2026 | CVSS 8.8 | Microsoft Security Advisory CVE-2026-96235 - .NET and Visual Studio Remote Code ExecutionOut-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-96236 | 13 Oct 2026 | CVSS 7.5 | Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of ServiceAllocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-96237 | 13 Oct 2026 | CVSS 7.5 | Microsoft .NET 10.0 runtimeInclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-96238 | 13 Oct 2026 | CVSS 6.5 | Microsoft .NET 10.0 runtimeOrigin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network. | |
| CVE-2026-96243 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96244 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96222 | 13 Oct 2026 | CVSS 7.4 | Microsoft Security Advisory CVE-2026-96222 - .NET SpoofingImproper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | Fix |
| CVE-2026-96223 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 Version 24H2Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96224 | 13 Oct 2026 | CVSS 8.8 | Microsoft Security Advisory CVE-2026-96224 - .NET and Visual Studio Remote Code ExecutionOut-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-96225 | 13 Oct 2026 | CVSS 7.8 | Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of PrivilegeImproper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96229 | 13 Oct 2026 | CVSS 6.5 | Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information DisclosurePermissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-96230 | 13 Oct 2026 | CVSS 8.8 | Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code ExecutionImproper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code… | Fix |
Page 3 of 19