Microsoft vulnerabilities
Every vulnerability this feed holds for Microsoft, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
266 vulnerabilities tracked. 9 confirmed exploited in the wild. 12 with public exploit code.
- 9.8 Microsoft Remote Desktop Services Remote Code Execution Vulnerability
- — Microsoft Windows Command Injection Vulnerability
- — Microsoft SharePoint Code Injection Vulnerability
- — Microsoft Windows Heap-Based Buffer Overflow Vulnerability
- — Microsoft Windows Link Following Vulnerability
- — Microsoft SQL Server Remote Code Execution Vulnerability
- — Microsoft SharePoint Weak Authentication Vulnerability
- — Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
- — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
- 10.0 Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
- 10.0 Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
- 10.0 Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
- 10.0 Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.
- 10.0 Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
- 10.0 Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
- 10.0 Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
- 9.9 Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
- 9.9 Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
- 9.9 Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.
- 9.8 Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
- 9.8 Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
- 9.8 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
- 9.8 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
- 9.8 Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.
- 9.8 Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
- 9.8 Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.
- 9.8 Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
- 9.8 Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
- 9.8 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an…
- 9.8 Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.
- 9.8 Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
- 9.8 Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.
- 9.6 Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
- 9.3 Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
- 9.0 No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
- 9.0 Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute…
- 8.8 Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
- 8.8 Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a…
- 8.8 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
- 8.8 Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.
- 8.8 Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized…
- 8.8 Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
- 8.8 Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges…
- 8.8 Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- 8.8 Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.
- 8.8 Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network.
- 8.8 Heap-based buffer overflow in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
- 8.8 Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- 8.8 Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature…
- 8.8 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
- 8.8 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
- 8.8 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
- 8.8 Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a…
- 8.8 Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges over a network.
- 8.8 Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authorized attacker to execute code over a network.
- 8.8 Improper neutralization of special elements used in a command ('command injection') in Windows Admin Center allows an authorized attacker…
- 8.8 Relative path traversal in Windows Admin Center allows an authorized attacker to execute code over a network.
- 8.8 Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- 8.8 Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- 8.8 Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio…
Showing the 60 that warrant attention first, of 266. Search the full feed for Microsoft.
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Microsoft is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Red Hat n/a MediaTek, Inc. Linux Apache Software Foundation Gitea WAVLINK Huawei Apple Eclipse Foundation WSO2 Dell PostgreSQL Control Web Panel nodejs Hewlett Packard Enterprise (HPE) Netpbm MONGODB Cisco zephyrproject aws Petpooja Unknown Oray