Vendor
Microsoft
13,163 known vulnerabilities.
Products
875 results · Clear filters · Feed
-
High 7.8CVE-2026-114148 Public exploit
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-97798 Public exploit
Windows Error Reporting Service Elevation of Privilege Vulnerability
Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
-
High 8.8CVE-2026-96230 Public exploit
ASP.NET Core Remote Code Execution Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
-
High 7.8CVE-2026-85884 Public exploit
Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
-
High 7.0CVE-2026-83834 Public exploit
Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
-
High 7.0CVE-2026-83844 Public exploit
Windows Paint Remote Code Execution Vulnerability
Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code locally.
-
High 8.8CVE-2026-96940 Public exploit
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Windows Update Stack Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
KEV Sep 8, 2026 -
High 7.8CVE-2026-69328 Public exploit
Windows Storage Elevation of Privilege Vulnerability
Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.
-
Medium 5.5CVE-2026-83991 Public exploit
Windows Cloud Files Mini Filter Driver Tampering Vulnerability
Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.
-
High 8.6CVE-2026-80097 Public exploit
Microsoft Authenticator Elevation of Privilege Vulnerability
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
-
High 7.1CVE-2026-69451 Public exploit
Windows Management Instrumentation Elevation of Privilege Vulnerability
Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privileges over a network.
-
Critical 10.0
Microsoft Entra ID Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
-
High 8.8CVE-2026-24301 Public exploit
Microsoft Copilot Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
-
High 7.8CVE-2026-69414 Public exploit
Microsoft Defender Elevation of Privilege Vulnerability
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
-
Critical 9.4CVE-2026-73296 Public exploit
Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP s…
-
High 8.0CVE-2026-62911 Public exploit
Microsoft Exchange Server Elevation of Privilege Vulnerability
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.8CVE-2026-66804 Public exploit
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
KEV Aug 11, 2026 -
High 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
KEV Sep 25, 2026 -
Critical 9.8CVE-2026-62878 Public exploit
Windows DNS Server Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.
-
High 7.8CVE-2026-62735 Public exploit
Windows HTTP.sys Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-62737 Public exploit
Windows Kernel Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-54984 Public exploit
Windows Imaging Component Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.
-
High 8.8CVE-2026-49179 Public exploit
Windows Active Directory Domain Services Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.
-
High 8.1CVE-2026-63520 Public exploit
Microsoft SharePoint Server Remote Code Execution Vulnerability
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
-
High 8.8CVE-2026-47301 Public exploit
Configuration Manager Elevation of Privilege Vulnerability
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
-
Medium 6.3CVE-2026-57973 Public exploit
Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally.
-
Critical 9.8CVE-2026-56190 Public exploit
Remote Desktop Protocol Remote Code Execution Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.
-
Critical 9.8CVE-2026-55944 Public exploit
Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.
-
Critical 9.1
Microsoft SharePoint Server Security Feature Bypass Vulnerability
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
KEV Aug 18, 2026 -
High 8.8CVE-2026-54121 Public exploit
Active Directory Certificate Services Elevation of Privilege Vulnerability
Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
-
High 7.8CVE-2026-50679 Public exploit
Windows Search Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
Medium 4.7CVE-2026-50657 Public exploit
Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.
-
High 7.8CVE-2026-50402 Public exploit
NTFS Elevation of Privilege Vulnerability
Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
High 8.8CVE-2026-50369 Public exploit
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.
-
Low 3.3CVE-2026-50416 Public exploit
Win32k Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.
-
High 7.8CVE-2026-50343 Public exploit
Microsoft Install Service Elevation of Privilege Vulnerability
Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally.
-
Medium 6.5CVE-2026-34348 Public exploit
Windows Event Logging Service Information Disclosure Vulnerability
Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.
-
High 7.8CVE-2026-58635 Public exploit
Windows Narrator Braille Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.