Vendor
Microsoft
13,163 known vulnerabilities.
Microsoft at a glance
Microsoft Patch Tuesday →102 of the exploited vulnerabilities are known to be used by ransomware (CISA).
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 1 | 1 |
| Oct 2026 | 1,486 | 71 |
| Sep 2026 | 1,002 | 59 |
| Aug 2026 | 477 | 35 |
| Jul 2026 | 664 | 41 |
| Jun 2026 | 221 | 15 |
| May 2026 | 171 | 24 |
| Apr 2026 | 183 | 15 |
| Mar 2026 | 98 | 5 |
| Feb 2026 | 64 | 4 |
| Jan 2026 | 127 | 6 |
| Dec 2025 | 65 | 3 |
| Nov 2025 | 71 | 5 |
| Oct 2025 | 180 | 10 |
| Sep 2025 | 99 | 4 |
| Aug 2025 | 119 | 7 |
| Jul 2025 | 142 | 5 |
| Jun 2025 | 69 | 2 |
| May 2025 | 80 | 5 |
| Apr 2025 | 134 | 2 |
| Mar 2025 | 65 | 1 |
| Feb 2025 | 67 | 1 |
| Jan 2025 | 165 | 4 |
| Dec 2024 | 84 | 2 |
Most common weaknesses
Products
Latest advisories
-
High max 7.0NCSC-2026-0470 1 CVE
Kwetsbaarheid verholpen in Windows Paint van Microsoft
Microsoft heeft een kwetsbaarheid verholpen in Windows Paint.
-
Critical max 9.2
Node.js: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.
first Oct 21, 2026 -
High max 9.8
Golang Go: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Speicherbeschädigungen zu verursachen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriff…
first Apr 7, 2026 -
Medium max 7.5
Golang Go: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verurs…
first May 7, 2026 -
High max 7.5
Golang Go: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, um einen Denial of Service durchzuführen, und um falsche Informationen darzustellen.
first Jun 2, 2026
13,163 results · Feed
-
Critical 10.0
Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevat…
-
High 7.4
Visual Studio Spoofing Vulnerability
Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.
-
Medium 4.4
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
-
Medium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.4
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
-
High 8.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.
-
Medium 4.3
Microsoft Edge for Android Security Feature Bypass Vulnerability
Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 5.4
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
-
High 7.8CVE-2026-114148 Public exploit
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
-
Medium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 7.5
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
-
High 7.5
Microsoft Exchange Online Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
-
Critical 10.0
AAD App Proxy Elevation of Privilege Vulnerability
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
-
High 7.7
Azure AI Foundry Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
-
Critical 9.1
Azure Pipelines Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
-
Medium 5.3
Microsoft Identity Web Elevation of Privilege Vulnerability
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.
-
Medium 5.9
Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
Medium 6.5
Microsoft Office PowerPoint Information Disclosure Vulnerability
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft Office PowerPoint Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
-
High 8.8
Microsoft Office SharePoint Remote Code Execution Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
Medium 6.5
Microsoft Office PowerPoint Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 7.5
Microsoft Office Outlook Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.