Vendor
Microsoft
14,257 known vulnerabilities.
Products
14,257 results · Feed
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
Medium 6.5
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
-
High 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2025-62470 Public exploit
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Microsoft Brokering File System Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Client-Side Caching Elevation of Privilege Vulnerability
Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network.
-
High 7.8CVE-2025-62454 Public exploit
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
-
Medium 4.3
Microsoft Edge (Chromium-based) for Mac Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
-
Critical 9.8
Azure Application Gateway Elevation of Privilege Vulnerability
Stack-based buffer overflow in Azure Application Gateway allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.4
Azure Application Gateway Elevation of Privilege Vulnerability
Out-of-bounds read in Application Gateway allows an unauthorized attacker to elevate privileges over a network.
-
High 8.3
Microsoft Defender Portal Spoofing Vulnerability
Microsoft Defender Portal Spoofing Vulnerability
-
High 8.0
GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
-
High 8.6
Azure Monitor Elevation of Privilege Vulnerability
Azure Monitor Elevation of Privilege Vulnerability
-
Critical 10.0
Azure Bastion Elevation of Privilege Vulnerability
Azure Bastion Elevation of Privilege Vulnerability
-
Critical 9.8
Microsoft SharePoint Online Elevation of Privilege Vulnerability
Microsoft SharePoint Online Elevation of Privilege Vulnerability
-
High 8.8
Dynamics OmniChannel SDK Storage Containers Elevation of Privilege Vulnerability
Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network.
-
High 8.1
Nuance PowerScribe 360 Information Disclosure Vulnerability
Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network.
-
Medium 5.0
GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.
-
High 7.8
Windows Administrator Protection Elevation of Privilege Vulnerability
Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally.
-
Medium 6.8
Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally.
-
High 8.8CVE-2025-62222 Public exploit
Agentic AI and Visual Studio Code Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
KEV Nov 12, 2025 -
Medium 6.7
Visual Studio Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally.
-
High 8.7
Dynamics 365 Field Service (online) Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
Medium 5.5
Windows License Manager Information Disclosure Vulnerability
Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows License Manager Information Disclosure Vulnerability
Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.
-
High 8.0
Microsoft SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 7.8
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.1
Microsoft Excel Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
Critical 9.8
GDI+ Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.