Microsoft vulnerabilities
We track 1,120 vulnerabilities in Microsoft products across 60+ products. 1,077 are rated high or critical, and 406 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Microsoft vulnerabilities
- 8.8 High severity
Microsoft Windows SmartScreen Security Feature Bypass Exploited
Windows SmartScreen Security Feature Bypass Vulnerability
- 9.8 Critical severity
curl: Out-of-bounds Write
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host nam
- 5.3 Medium severity
Microsoft Skype for Business Privilege Escalation Exploited
Skype for Business Elevation of Privilege Vulnerability
- 5.4 Medium severity
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Exploited
Windows Mark of the Web Security Feature Bypass Vulnerability
- 5.5 Medium severity
Microsoft WordPad Information Disclosure Exploited
Microsoft WordPad Information Disclosure Vulnerability
- 7.5 High severity
HTTP/2 Rapid Reset Attack Exploited
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
- 8.8 High severity
Google Chromium libvpx Heap Buffer Overflow Exploited
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 7.5 High severity
curl: Allocation of Resources Without Limits or Throttling
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server
- 7.8 High severity
Microsoft Streaming Service Proxy Privilege Escalation Exploited
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
- 6.5 Medium severity
Microsoft Word Information Disclosure Exploited
Microsoft Word Information Disclosure Vulnerability
- 8.8 High severity
Google Chromium WebP Heap-Based Buffer Overflow Exploited
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
- 8.8 High severity
Google Chromium V8 Type Confusion Exploited
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- 7.5 High severity
Microsoft .NET Core and Visual Studio Denial-of-Service Exploited
.NET and Visual Studio Denial of Service Vulnerability
- 7.5 High severity
Microsoft Windows Search Remote Code Execution Exploited
Windows Search Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Windows Error Reporting Service Privilege Escalation Exploited
Windows Error Reporting Service Elevation of Privilege Vulnerability
- 7.5 High severity
Microsoft Outlook Security Feature Bypass Exploited
Microsoft Outlook Security Feature Bypass Vulnerability
- 8.8 High severity
Microsoft Windows Defender SmartScreen Security Feature Bypass Exploited
Windows SmartScreen Security Feature Bypass Vulnerability
- 7.8 High severity
Microsoft Windows MSHTML Platform Privilege Escalation Exploited
Windows MSHTML Platform Elevation of Privilege Vulnerability
- 8.4 High severity
Microsoft Streaming Service Untrusted Pointer Dereference Exploited
Microsoft Streaming Service Elevation of Privilege Vulnerability
- 9.8 Critical severity
Microsoft SharePoint Server Privilege Escalation Exploited
Microsoft SharePoint Server Elevation of Privilege Vulnerability
- 7.8 High severity
Microsoft Win32K Privilege Escalation Exploited
Win32k Elevation of Privilege Vulnerability
- 7.2 High severity
Microsoft SharePoint Server Code Injection Exploited
Microsoft SharePoint Server Remote Code Execution Vulnerability
- 7.5 High severity
typed-rest-client: Insufficiently Protected Credentials
typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as fol
- 7.8 High severity
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- 7.0 High severity
Microsoft Windows CNG Key Isolation Service Privilege Escalation Exploited
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
- 4.4 Medium severity
Microsoft Windows SmartScreen Security Feature Bypass Exploited
Windows SmartScreen Security Feature Bypass Vulnerability
- 9.8 Critical severity
Microsoft Office Outlook Privilege Escalation Exploited
Microsoft Outlook Elevation of Privilege Vulnerability
- 7.0 High severity
setup-kubectl: Incorrect Permission Assignment for Critical Resource
Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action be
- 7.8 High severity
TPM2.0: Out-of-bounds Write
An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of s
- 9.8 Critical severity
ThingWorx Edge C-SDK: Improper Validation of Array Index
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.
- 9.8 Critical severity
ThingWorx Edge C-SDK: Integer Overflow or Wraparound
The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code.
- 7.8 High severity
Microsoft Windows Graphic Component Privilege Escalation Exploited
Windows Graphics Component Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- 7.3 High severity
Microsoft Office Publisher Security Feature Bypass Exploited
Microsoft Publisher Security Feature Bypass Vulnerability
- 8.8 High severity
Microsoft Exchange Server Deserialization of Untrusted Data Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 8.8 High severity
Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Exploited
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
- 5.4 Medium severity
Microsoft Defender SmartScreen Security Feature Bypass Exploited
Windows SmartScreen Security Feature Bypass Vulnerability
- 9.8 Critical severity
A Firewall Rule which allows all incoming TCP connections to all programs from any source and…
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)
- 9.6 Critical severity
Google Chromium GPU Heap Buffer Overflow Exploited
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Microsoft Windows Scripting Languages Remote Code Execution Exploited
Windows Scripting Languages Remote Code Execution Vulnerability