Microsoft vulnerabilities
We track 1,120 vulnerabilities in Microsoft products across 60+ products. 1,077 are rated high or critical, and 406 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Microsoft vulnerabilities
- 8.8 High severity
Microsoft .NET Framework 3.5 AND…: Access of Resource Using Incompatible Type
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
- 8.8 High severity
Microsoft SharePoint Server Subscription Edition: Improper Control of Generation of Code
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- 8.8 High severity
Microsoft Dynamics NAV 2018: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
- 7.8 High severity
Windows 10 Version 1607: Access of Resource Using Incompatible Type
Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows Subsystem for Linux (WSL2): Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
- 7.3 High severity
Azure CycleCloud 8.9.1: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
- 8.7 High severity
Azure API Center: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.
- 8.7 High severity
simplechat: Improper Neutralization of Input During Web Page Generation
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload stores an attacker-controlled group document filename that group_workspaces.html late
- 8.8 High severity
simplechat: Improper Neutralization of Special Elements used in an OS Command
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user
- 8.8 High severity
kiota: Improper Control of Generation of Code
Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and plac
- 9.1 Critical severity
msquic: Improper Certificate Validation
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the inte
- 9.1 Critical severity
UFO: Improper Neutralization of Special Elements used in an OS Command
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to `adb shell input k
- 7.5 High severity
UFO: Improper Neutralization of Argument Delimiters in a Command
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of ufo/client/mcp/local_servers/cli_mcp_server.py validates only the first token of the b
- 8.8 High severity
UFO: Improper Neutralization of Special Elements used in an OS Command
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-controlled text and package
- 9.6 Critical severity
Azure Cosmos DB: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- 8.8 High severity
Microsoft 365 Copilot: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- 8.6 High severity
Microsoft 365 Copilot's Business Chat: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
- 9.8 Critical severity
Azure Logic Apps: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- 9.8 Critical severity
Azure ARC: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- 10.0 Critical severity
Azure Container Registry: Authorization Bypass Through User-Controlled Key
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- 7.8 High severity
Microsoft Edge (Chromium-based): Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Microsoft Windows Heap-Based Buffer Overflow Exploited
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
- 7.4 High severity
Microsoft Authentication Library: Authentication Bypass by Capture-replay
Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network.
- 7.0 High severity
Windows 11 Version 24H2: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.
- 8.0 High severity
Microsoft Azure CLI: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Microsoft Azure CLI allows an authorized attacker to execute code over a network.
- 7.8 High severity
Microsoft Windows Link Following Exploited
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
- 8.2 High severity
Visual Studio Code: Inconsistent Interpretation of HTTP Requests
Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- 7.2 High severity
Azure HDInsight: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privileges over a network.
- 7.4 High severity
Visual Studio Code: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
- 7.5 High severity
Windows 10 Version 1607: Allocation of Resources Without Limits or Throttling
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- 7.5 High severity
OpenAPI.NET: Uncontrolled Resource Consumption
The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader f
- 7.5 High severity
Windows 10 Version 1607: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to disclose information over a network.
- 7.8 High severity
Windows 10 Version 1607: Improper Handling of Insufficient Permissions or Privileges
Improper handling of insufficient permissions or privileges in Windows Enterprise App Management allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1607: Integer Underflow (Wrap or Wraparound)
Time-of-check time-of-use (toctou) race condition in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.
- 8.1 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.
- 7.5 High severity
Windows 11 version 23H2: Missing Release of Memory after Effective Lifetime
Missing release of memory after effective lifetime in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.
- 7.8 High severity
Windows 10 Version 21H2: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.
- 8.1 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.