Vendor
Microsoft
14,257 known vulnerabilities.
Products
14,257 results · Feed
-
High 8.8
Remote Desktop Client Remote Code Execution Vulnerability
Heap-based buffer overflow in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
-
High 8.8
Windows Media Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
-
High 8.8
Remote Desktop Client Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code over a network.
-
Medium 6.5
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
-
Medium 6.7
Microsoft Defender Elevation of Privilege Vulnerability
External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
-
High 8.7
Microsoft Dataverse Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.
-
Critical 10.0
Azure DevOps Elevation of Privilege Vulnerability
Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.1
Microsoft Power Apps Information Disclosure Vulnerability
Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network
-
Critical 9.9
Azure Automation Elevation of Privilege Vulnerability
Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.
-
Critical 9.9CVE-2025-29972 Public exploit
Azure Storage Resource Provider Spoofing Vulnerability
Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing over a network.
-
High 8.1
Microsoft msagsfeedback.azurewebsites.net Information Disclosure Vulnerability
Improper access control in Azure allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft Edge (Chromium-based) Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
-
High 8.5
Azure Virtual Desktop Elevation of Privilege Vulnerability
Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network.
-
Critical 9.8
Azure AI Bot Elevation of Privilege Vulnerability
Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.
-
High 7.5
Azure Functions Remote Code Execution Vulnerability
Improper verification of cryptographic signature in Microsoft Azure Functions allows an authorized attacker to execute code over a network.
-
Critical 9.9
Azure ML Compute Elevation of Privilege Vulnerability
Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.
-
High 8.7
Azure Bot Framework SDK Elevation of Privilege Vulnerability
Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.
-
High 8.1
Microsoft Dynamics Information Disclosure Vulnerability
Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network.
-
Medium 5.7
Microsoft Power Automate Desktop Information Disclosure Vulnerability
Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network.
-
High 7.5
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
Medium 6.8
Visual Studio Code Elevation of Privilege Vulnerability
Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
-
High 7.3
Visual Studio Tools for Applications and SQL Server Management Studio Elevation of Privilege Vulnerability
Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft DWM Core Library Elevation of Privilege Vulnerability
Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
-
High 7.5
ASP.NET Core and Visual Studio Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.8
Microsoft DWM Core Library Elevation of Privilege Vulnerability
Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Mobile Broadband Driver Elevation of Privilege Vulnerability
Improper input validation in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
-
Medium 6.2
Windows Admin Center in Azure Portal Information Disclosure Vulnerability
External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.
-
High 7.5
Microsoft Word Security Feature Bypass Vulnerability
Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.8
DirectX Graphics Kernel Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.
-
High 7.5CVE-2025-29810 Public exploit
Active Directory Domain Services Elevation of Privilege Vulnerability
Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Outlook for Android Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows Cryptographic Services Information Disclosure Vulnerability
Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
-
High 7.3
Visual Studio Elevation of Privilege Vulnerability
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
-
High 7.1
Windows Kerberos Security Feature Bypass Vulnerability
Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypass a security feature locally.
-
High 7.8
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
Incorrect default permissions in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
Improper privilege management in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.
-
High 7.3
Visual Studio Elevation of Privilege Vulnerability
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
Windows Resilient File System (ReFS) Information Disclosure Vulnerability
Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network.
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.