[ Vendor · 1,865 CVEs ]
Microsoft
CVEs affecting Microsoft published in the last 30 days, plus any Microsoft CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-96231 | 13 Oct 2026 | CVSS 7.8 | Microsoft Security Advisory CVE-2026-96231 - .NET and Visual Studio Elevation of PrivilegeImproper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96232 | 13 Oct 2026 | CVSS 7.5 | Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information DisclosureOut-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-96215 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to… | |
| CVE-2026-96216 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96217 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96218 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally. | |
| CVE-2026-96219 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1809Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-96220 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96183 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 11 Version 24H2Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose… | Fix |
| CVE-2026-96186 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-96188 | 13 Oct 2026 | CVSS 7.3 | Microsoft PowerToysExternal control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96202 | 13 Oct 2026 | CVSS 8.8 | Microsoft Raw Image ExtensionHeap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-96204 | 13 Oct 2026 | CVSS 6.5 | Microsoft Arc Enabled Servers - Azure Connected Machine AgentServer-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-96206 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows Subsystem for Linux (WSL2)Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally. | |
| CVE-2026-96209 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96044 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionNo cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-96071 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-96096 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-96108 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96113 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-96118 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-94506 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-95904 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-95943 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88204 | 13 Oct 2026 | CVSS 7.3 | Microsoft SharePoint Server Subscription EditionImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to… | Fix |
| CVE-2026-88206 | 13 Oct 2026 | CVSS 7.5 | Microsoft SharePoint Server Subscription EditionServer-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-88207 | 13 Oct 2026 | CVSS 7.5 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88208 | 13 Oct 2026 | CVSS 4.6 | Microsoft SharePoint Server Subscription EditionImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to… | Fix |
| CVE-2026-88209 | 13 Oct 2026 | CVSS 4.6 | Microsoft SharePoint Server Subscription EditionImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to… | Fix |
| CVE-2026-88210 | 13 Oct 2026 | CVSS 7.8 | Microsoft 365 Apps for EnterpriseReliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | |
| CVE-2026-88219 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88226 | 13 Oct 2026 | CVSS 4.6 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose information with a physical attack. | Fix |
| CVE-2026-88195 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseBuffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88196 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88197 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88198 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionMissing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-88200 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionPrivilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-88201 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseBuffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88202 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88203 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseUntrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88189 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88190 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88191 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate… | Fix |
| CVE-2026-88192 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88193 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88194 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88182 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88183 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88184 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88185 | 13 Oct 2026 | CVSS 8.1 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88186 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88188 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88174 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized… | |
| CVE-2026-88175 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88177 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88178 | 13 Oct 2026 | CVSS 9.8 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88179 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88180 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88181 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88165 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute code over a network. | |
| CVE-2026-88166 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionInteger overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Fix |
| CVE-2026-88167 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseBuffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88168 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88169 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88171 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88172 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88173 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88158 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose information locally. | |
| CVE-2026-88159 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88160 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an… | |
| CVE-2026-88161 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88162 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Improper authorization in Windows Encrypting File System (EFS) allows an authorized attacker to perform tampering locally. | |
| CVE-2026-88163 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionInteger overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Fix |
| CVE-2026-88151 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88152 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88153 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88154 | 13 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-88155 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionHeap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Fix |
| CVE-2026-88156 | 13 Oct 2026 | CVSS 9.8 | Microsoft 365 Apps for EnterpriseStack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88157 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88144 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88145 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88146 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS)… | |
| CVE-2026-88147 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88149 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88150 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseUse of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88136 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network. | |
| CVE-2026-88137 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network. | |
| CVE-2026-88139 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88140 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally. | |
| CVE-2026-88141 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88142 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88143 | 13 Oct 2026 | CVSS 6.7 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88129 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows Server 2012Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network. | |
| CVE-2026-88130 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows Server 2012Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network. | |
| CVE-2026-88132 | 13 Oct 2026 | CVSS 5.9 | Microsoft azure-keyvault-administrationOrigin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-88133 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88134 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88135 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper access control in WebDAV allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88123 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows Server 2012Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network. |
Page 4 of 19