Microsoft vulnerabilities
We track 1,120 vulnerabilities in Microsoft products across 60+ products. 1,077 are rated high or critical, and 406 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Microsoft vulnerabilities
- 8.8 High severity
Windows 10 Version 1507: Access of Resource Using Incompatible Type
Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network.
- 8.8 High severity
Windows 10 Version 1507: Access of Resource Using Incompatible Type
Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network.
- 8.8 High severity
Windows 10 Version 1507: Access of Resource Using Incompatible Type
Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network.
- 7.0 High severity
Windows 10 Version 1507: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1507: Exposure of Sensitive Information to an Unauthorized Actor
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1507: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1809: Improper Handling of Insufficient Permissions or Privileges
Improper handling of insufficient permissions or privileges in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
- 7.5 High severity
Windows 11 Version 24H2: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an unauthorized attacker to execute code over a network.
- 7.0 High severity
Windows 10 Version 1507: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1507: Heap-based Buffer Overflow
Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1507: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- 8.8 High severity
Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- 8.8 High severity
Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Privilege Management
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- 8.8 High severity
Microsoft SQL Server 2022 (CU 20): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- 7.5 High severity
Microsoft Exchange Server 2016 Cumulative…: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
- 8.0 High severity
Microsoft Exchange Server 2016 Cumulative…: Improper Authentication
On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following furt
- 9.8 Critical severity
Microsoft SharePoint Deserialization of Untrusted Data Exploited
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a co
- 7.0 High severity
Microsoft Teams for Mac, New Edition: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally.
- 6.5 Medium severity
Microsoft SharePoint Improper Authentication Exploited
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- 8.8 High severity
Microsoft SharePoint Code Injection Exploited
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- 7.4 High severity
Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an unauthorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1507: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Workspace Broker allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1507: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
- 7.1 High severity
Windows 10 Version 1507: Sensitive Data Storage in Improperly Locked Memory
Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over an adjacent network.
- 7.5 High severity
Windows 10 Version 1607: Missing Authentication for Critical Functionality
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an unauthorized attacker to bypass a security feature over a network.
- 7.5 High severity
Azure Monitor: Improper Control of Generation of Code
Improper control of generation of code ('code injection') in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network.
- 8.0 High severity
Windows 10 Version 1507: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges over a network.
- 8.0 High severity
Microsoft Configuration Manager: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to execute code over an adjacent network.
- 7.0 High severity
ASP.NET Core 6.0: Weak Authentication
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support pr
- 8.8 High severity
Microsoft Edge (Chromium-based): Access of Resource Using Incompatible Type
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- 7.5 High severity
Dynamics 365 FastTrack Implementation: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.
- 7.1 High severity
Microsoft Visual Studio 2022 version 17.10: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network.
- 8.2 High severity
Nuance Digital Engagement Platform: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Nuance Digital Engagement Platform allows an unauthorized attacker to perform spoofing over a network.
- 8.8 High severity
Microsoft SharePoint Enterprise Server 2016: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- 8.8 High severity
Microsoft Windows SMB Client Improper Access Control Exploited
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
- 7.5 High severity
Windows Server 2012 R2: Uncontrolled Resource Consumption
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
- 8.8 High severity
Microsoft Windows External Control of File Name or Path Exploited
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
- 7.5 High severity
Windows 10 Version 1507: Uncontrolled Resource Consumption
Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
- 7.3 High severity
Windows 10 Version 1507: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows Recovery Driver allows an authorized attacker to elevate privileges locally.
- 4.6 Medium severity
IGEL OS Use of a Key Past its Expiration Date Exploited
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.