Vendor
Microsoft
14,257 known vulnerabilities.
Products
8,209 results · Clear filters · Feed
-
High 7.1
Remote Desktop Spoofing Vulnerability
Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network.
-
High 7.0
Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Management Services Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
-
High 8.6
Azure SRE Agent Information Disclosure Vulnerability
Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network.
-
High 7.8
openssl on Windows built with openssldir set from the build machine (Uncontrolled Search Path Element)
vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version…
-
High 8.6
Azure Data Factory Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attacker to disclose information over a network.
-
High 8.6
Azure DevOps: msazure Elevation of Privilege Vulnerability
Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
-
High 8.6
Microsoft Purview Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.
-
High 8.6
Microsoft Purview Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.
-
High 7.1
M365 Copilot Information Disclosure Vulnerability
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
-
High 7.5
Microsoft Excel Information Disclosure Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
-
High 7.8
Hybrid Worker Extension (Arc‑enabled Windows VMs) Elevation of Privilege Vulnerability
Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 8.8CVE-2026-26118 Public exploit
Azure MCP Server Tools Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability
Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.
-
High 8.4
Microsoft Excel Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 8.4
Microsoft Office Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 7.5
Azure IoT Explorer Information Disclosure Vulnerability
Missing authentication for critical function in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
-
High 7.8
Linux Azure Diagnostic extension (LAD) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Azure Linux Virtual Machines allows an authorized attacker to elevate privileges locally.
-
High 8.8
GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability
Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over a network.
-
High 7.5
Azure IoT Explorer Information Disclosure Vulnerability
Cleartext transmission of sensitive information in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
-
High 8.1
Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability
External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally.
-
High 7.5
MapUrlToZone Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.8
Microsoft Office Elevation of Privilege Vulnerability
Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.
-
High 7.5
.NET Denial of Service Vulnerability
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-26128 Public exploit
Windows SMB Server Elevation of Privilege Vulnerability
Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
-
High 8.8
SQL Server Elevation of Privilege Vulnerability
Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Azure IOT Explorer Spoofing Vulnerability
Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network.
-
High 8.8
System Center Operations Manager (SCOM) Elevation of Privilege Vulnerability
Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.
-
High 8.8CVE-2026-26114 Public exploit
Microsoft SharePoint Server Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 8.4
Microsoft Office Remote Code Execution Vulnerability
Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 8.0
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
-
High 7.8
Windows GDI Remote Code Execution Vulnerability
Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally.