microsoft
3,712 known vulnerabilities affecting microsoft products.
Products
windows_server_2019 1452
windows_server_2016 1310
windows_server_2022 1272
windows_server_2025 1131
windows_10_1809 1131
windows_11_24h2 1111
windows_11_25h2 1081
windows_10_22h2 1066
windows_10_21h2 1061
windows_11_26h1 1009
windows 990
windows_10_1607 980
windows_server_2012 977
windows_11_23h2 761
windows_10 343
windows_server_2008 326
365_apps 277
office_2021 225
office_2024 225
office_2019 217
windows_8.1 192
microsoft_365 185
windows_rt_8.1 170
windows_7 169
Vulnerabilities by priority
| CVE | Priority | EPSS | CVSS | KEV | What |
|---|---|---|---|---|---|
| CVE-2026-9118 | Medium | 0.4% | 8.8 | Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed… | |
| CVE-2026-9126 | Medium | 0.4% | 8.8 | Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remo… | |
| CVE-2026-12878 | Medium | 0.4% | 8.8 | In affected versions of the Codefresh platform an authenticated user can utilize… | |
| CVE-2026-20822 | Medium | 0.4% | 7.8 | Use after free in Microsoft Graphics Component allows an authorized attacker to … | |
| CVE-2026-20842 | Medium | 0.4% | 7.0 | Use after free in Windows DWM allows an authorized attacker to elevate privilege… | |
| CVE-2026-20863 | Medium | 0.4% | 7.0 | Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate p… | |
| CVE-2026-20865 | Medium | 0.4% | 7.8 | Use after free in Windows Management Services allows an authorized attacker to e… | |
| CVE-2026-50697 | Medium | 0.4% | 7.8 | Exposure of sensitive information to an unauthorized actor in Windows Common Log… | |
| CVE-2023-21528 | Medium | 0.4% | 7.8 | Microsoft SQL Server Remote Code Execution Vulnerability | |
| CVE-2023-21704 | Medium | 0.4% | 7.8 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability | |
| CVE-2026-10935 | Medium | 0.4% | 8.8 | Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote at… | |
| CVE-2026-10936 | Medium | 0.4% | 8.8 | Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote at… | |
| CVE-2026-10962 | Medium | 0.4% | 8.8 | Type Confusion in Media in Google Chrome prior to 149.0.7827.53 allowed a remote… | |
| CVE-2026-54981 | Medium | 0.4% | 7.8 | Inclusion of functionality from untrusted control sphere in Visual Studio Code -… | |
| CVE-2026-56189 | Medium | 0.4% | 7.8 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut… | |
| CVE-2026-62816 | Medium | 0.4% | 8.8 | Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allow… | |
| CVE-2026-68806 | Medium | 0.4% | 7.8 | Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to… | |
| CVE-2023-38176 | Medium | 0.4% | 7.0 | Azure Arc-Enabled Servers Elevation of Privilege Vulnerability | |
| CVE-2026-10881 | Medium | 0.4% | 9.6 | Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 al… | |
| CVE-2026-10883 | Medium | 0.4% | 8.8 | Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote… | |
| CVE-2026-10895 | Medium | 0.4% | 8.8 | Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote… | |
| CVE-2026-10902 | Medium | 0.4% | 8.8 | Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote… | |
| CVE-2026-10913 | Medium | 0.4% | 8.8 | Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allow… | |
| CVE-2026-10914 | Medium | 0.4% | 8.8 | Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allow… | |
| CVE-2026-10954 | Medium | 0.4% | 8.8 | Use after free in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote… | |
| CVE-2026-10956 | Medium | 0.4% | 8.8 | Use after free in MimeHandlerView in Google Chrome prior to 149.0.7827.53 allowe… | |
| CVE-2026-45461 | Medium | 0.4% | 8.4 | Use after free in Microsoft Office allows an unauthorized attacker to execute co… | |
| CVE-2026-7341 | Medium | 0.4% | 8.8 | Use after free in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remo… | |
| CVE-2026-7342 | Medium | 0.4% | 8.8 | Use after free in WebView in Google Chrome on Android prior to 147.0.7727.138 al… | |
| CVE-2026-7348 | Medium | 0.4% | 8.8 | Use after free in Codecs in Google Chrome prior to 147.0.7727.138 allowed a remo… | |
| CVE-2026-7355 | Medium | 0.4% | 8.8 | Use after free in Media in Google Chrome prior to 147.0.7727.138 allowed a remot… | |
| CVE-2026-7358 | Medium | 0.4% | 8.8 | Use after free in Animation in Google Chrome prior to 147.0.7727.138 allowed a r… | |
| CVE-2026-87616 | Medium | 0.4% | 8.3 | Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8… | |
| CVE-2026-11118 | Medium | 0.4% | 8.8 | Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remot… | |
| CVE-2026-19303 | Medium | 0.4% | 8.1 | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacke… | |
| CVE-2024-21405 | Medium | 0.4% | 7.0 | Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability | |
| CVE-2026-45490 | Medium | 0.4% | 7.8 | Improper authorization in .NET allows an authorized attacker to elevate privileg… | |
| CVE-2026-9952 | Medium | 0.4% | 8.8 | Use after free in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a re… | |
| CVE-2026-10955 | Medium | 0.4% | 8.8 | Type Confusion in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allow… | |
| CVE-2026-13446 | Medium | 0.4% | 9.8 | IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a… | |
| CVE-2026-61925 | Medium | 0.4% | 7.8 | Incorrect authorization in Windows Installer allows an authorized attacker to el… | |
| CVE-2026-7335 | Medium | 0.4% | 8.8 | Use after free in media in Google Chrome prior to 147.0.7727.138 allowed a remot… | |
| CVE-2026-7356 | Medium | 0.4% | 8.8 | Use after free in Navigation in Google Chrome prior to 147.0.7727.138 allowed a … | |
| CVE-2026-7363 | Medium | 0.4% | 8.8 | Use after free in Canvas in Google Chrome on Linux, ChromeOS prior to 147.0.7727… | |
| CVE-2026-78952 | Medium | 0.4% | 8.3 | Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.79… | |
| CVE-2026-49791 | Medium | 0.4% | 7.1 | Improper link resolution before file access ('link following') in Windows Routin… | |
| CVE-2026-62712 | Medium | 0.4% | 7.8 | Heap-based buffer overflow in Windows Win32K allows an authorized attacker to el… | |
| CVE-2026-8850 | Medium | 0.4% | 7.5 | IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional… | |
| CVE-2026-35562 | Medium | 0.4% | 7.5 | Allocation of resources without limits in the parsing components in Amazon Athen… | |
| CVE-2026-5873 | Medium | 0.4% | 8.8 | Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allow… |