Microsoft vulnerabilities
We track 1,120 vulnerabilities in Microsoft products across 60+ products. 1,077 are rated high or critical, and 406 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Microsoft vulnerabilities
- 8.0 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- 7.0 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
- 7.5 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- 7.5 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- 8.0 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- 8.8 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- 8.8 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- 8.8 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- 8.8 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.
- 7.5 High severity
Microsoft Teams for Android: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
- 8.8 High severity
Visual Studio Code: User Interface (UI) Misrepresentation of Critical Information
User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- 7.8 High severity
Azure CycleCloud 8.9.2: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an authorized attacker to elevate privileges locally.
- 7.5 High severity
.NET 10.0 installed on Windows: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.
- 7.5 High severity
Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server Network Transport Driver (srvnet.sys) allows an authorized attacker to execute code over a network.
- 7.5 High severity
Azure CycleCloud 8.9.2: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an unauthorized attacker to disclose information over a network.
- 7.8 High severity
Windows 10 Version 1607: Untrusted Pointer Dereference
Inclusion of functionality from untrusted control sphere in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 11 version 26H1: Concurrent Execution using Shared Resource with Improper Synchronization
Untrusted pointer dereference in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1809: Heap-based Buffer Overflow
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1809: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 11 version 26H1: Access of Resource Using Incompatible Type
Access of resource using incompatible type ('type confusion') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
- 7.3 High severity
Microsoft SharePoint Server Subscription Edition: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- 7.3 High severity
Microsoft SharePoint Server Subscription Edition: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- 8.0 High severity
Microsoft SharePoint Server Subscription Edition: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- 7.3 High severity
Microsoft SharePoint Server Subscription Edition: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- 7.3 High severity
Microsoft SharePoint Server Subscription Edition: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- 7.3 High severity
Microsoft SharePoint Server Subscription Edition: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- 8.8 High severity
Microsoft SharePoint Server Subscription Edition: Access of Resource Using Incompatible Type
Access of resource using incompatible type ('type confusion') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- 7.3 High severity
Microsoft SharePoint Server Subscription Edition: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- 8.0 High severity
Azure Machine Learning: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.
- 9.0 Critical severity
Microsoft SharePoint Server Subscription Edition: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- 7.8 High severity
Windows 10 Version 1809: Access of Resource Using Incompatible Type
Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system
- 7.0 High severity
Windows 10 Version 1607: Release of Invalid Pointer or Reference
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenti
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Point-to-Point Protocol over Ethernet (PPPoE) allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1607: Heap-based Buffer Overflow
An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system
- 7.0 High severity
Windows 10 Version 1607: Use After Free
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenti
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Volume Shadow Copy allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1607: Double Free
An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation service improperly handles memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. To exploit