Vendor
Microsoft
14,257 known vulnerabilities.
Products
14,257 results · Feed
-
High 8.8
Windows Admin Center Elevation of Privilege Vulnerability
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
-
Low 3.1
Microsoft Edge (Chromium-based) Defense in Depth Vulnerability
Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number…
-
High 7.8CVE-2026-20841 Public exploit
Windows Notepad App Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.
-
High 7.5
GDI+ Denial of Service Vulnerability
Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.
-
High 8.1
Azure Local Remote Code Execution Vulnerability
Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows HTTP.sys Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Subsystem for Linux Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows HTTP.sys Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
-
High 7.3CVE-2026-21244 Public exploit
Windows Hyper-V Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
-
Low 3.3CVE-2026-21249 EPSS 11%
Windows NTLM Spoofing Vulnerability
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing locally.
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-21250 Public exploit
Windows HTTP.sys Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
-
High 7.8
Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
Use after free in Windows Cluster Client Failover allows an authorized attacker to elevate privileges locally.
-
High 7.0
Mailslot File System Elevation of Privilege Vulnerability
Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally.
-
High 8.8
GitHub Copilot and Visual Studio Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code over a network.
-
High 8.8
Windows Hyper-V Security Feature Bypass Vulnerability
Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally.
-
Medium 5.5
Microsoft Excel Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
-
High 8.0
GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevate privileges over a network.
-
High 7.0CVE-2026-21508 Public exploit
Windows Storage Elevation of Privilege Vulnerability
Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally.
-
High 8.8
GitHub Copilot for Jetbrains Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthorized attacker to execute code over a network.
-
High 7.5
Microsoft Outlook Spoofing Vulnerability
Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
-
Medium 6.2CVE-2026-21525 Exploited
Windows Remote Access Connection Manager Denial of Service Vulnerability
Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.
KEV Feb 10, 2026 -
High 7.8
Microsoft Word Security Feature Bypass Vulnerability
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
KEV Feb 10, 2026 -
Medium 5.7
Azure HDInsight Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over a network.
-
High 8.8
Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.
-
High 8.8
Windows Shell Security Feature Bypass Vulnerability
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
KEV Feb 10, 2026 -
Critical 9.8CVE-2026-21531 Public exploit
Azure SDK for Python Remote Code Execution Vulnerability
Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.
-
Medium 6.5
Azure IoT Explorer Information Disclosure Vulnerability
Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft Exchange Server Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
-
Medium 6.7
Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
KEV Feb 10, 2026 -
High 8.8
MSHTML Framework Security Feature Bypass Vulnerability
Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.
KEV Feb 10, 2026 -
High 8.0
Power BI Remote Code Execution Vulnerability
Improper input validation in Power BI allows an authorized attacker to execute code over a network.
-
High 8.0
GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.