Vendor
Microsoft
14,257 known vulnerabilities.
Products
880 results · Clear filters · Feed
-
High 7.8CVE-2026-26179 Public exploit
Windows Kernel Elevation of Privilege Vulnerability
Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
Critical 9.8CVE-2026-32194 Public exploit
Microsoft Bing Images Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.
-
High 8.8CVE-2026-26118 Public exploit
Azure MCP Server Tools Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.
-
High 7.8CVE-2026-26128 Public exploit
Windows SMB Server Elevation of Privilege Vulnerability
Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
-
High 8.8CVE-2026-26114 Public exploit
Microsoft SharePoint Server Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 8.8CVE-2026-25177 Public exploit
Active Directory Domain Services Elevation of Privilege Vulnerability
Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
-
High 8.0CVE-2026-25172 Public exploit
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
-
High 7.8CVE-2026-24294 Public exploit
Windows SMB Server Elevation of Privilege Vulnerability
Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-24291 Public exploit
Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability
Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally.
-
Medium 5.5CVE-2026-2636 Public exploit
Denial of Service in Microsoft OS
This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileg…
-
Critical 10.0CVE-2026-26030 Public exploit
Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users sh…
-
High 8.8
Windows Admin Center Elevation of Privilege Vulnerability
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
-
High 7.8CVE-2026-20841 Public exploit
Windows Notepad App Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.
-
High 7.3CVE-2026-21244 Public exploit
Windows Hyper-V Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
-
High 7.8CVE-2026-21250 Public exploit
Windows HTTP.sys Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
-
High 7.0CVE-2026-21508 Public exploit
Windows Storage Elevation of Privilege Vulnerability
Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Word Security Feature Bypass Vulnerability
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
KEV Feb 10, 2026 -
High 8.8
Windows Shell Security Feature Bypass Vulnerability
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
KEV Feb 10, 2026 -
Critical 9.8CVE-2026-21531 Public exploit
Azure SDK for Python Remote Code Execution Vulnerability
Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
KEV Feb 10, 2026 -
High 7.3CVE-2026-21248 Public exploit
Windows Hyper-V Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
-
High 7.8
Microsoft Office Security Feature Bypass Vulnerability
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
KEV Jan 26, 2026 -
Critical 9.8CVE-2026-24306 Public exploit
Azure Front Door Elevation of Privilege Vulnerability
Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.
-
High 7.5CVE-2026-20929 Public exploit
Windows HTTP.sys Elevation of Privilege Vulnerability
Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.
-
Medium 5.5CVE-2026-20833 Public exploit
Windows Kerberos Information Disclosure Vulnerability
Use of a broken or risky cryptographic algorithm in Windows Kerberos allows an authorized attacker to disclose information locally.
-
High 7.8CVE-2026-20820 Public exploit
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-20817 Public exploit
Windows Error Reporting Service Elevation of Privilege Vulnerability
Improper handling of insufficient permissions or privileges in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Desktop Window Manager Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
KEV Jan 13, 2026 -
High 7.8
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
KEV Dec 9, 2025 -
High 7.8CVE-2025-54100 Public exploit
PowerShell Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.
-
High 7.8CVE-2025-62470 Public exploit
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2025-62454 Public exploit
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 8.8CVE-2025-62222 Public exploit
Agentic AI and Visual Studio Code Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
KEV Nov 12, 2025 -
High 7.0CVE-2025-60719 Public exploit
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
-
High 7.8
Host Process for Windows Tasks Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
KEV Apr 13, 2026 -
High 7.8CVE-2025-60709 Public exploit
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
-
Medium 4.8CVE-2025-59501 Public exploit
Microsoft Configuration Manager Spoofing Vulnerability
Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent network.
-
Critical 9.8
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
KEV Oct 24, 2025 -
High 8.8CVE-2025-59213 Public exploit
Configuration Manager Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges over an adjacent network.