microsoft
3,712 known vulnerabilities affecting microsoft products.
Products
windows_server_2019 1452
windows_server_2016 1310
windows_server_2022 1272
windows_server_2025 1131
windows_10_1809 1131
windows_11_24h2 1111
windows_11_25h2 1081
windows_10_22h2 1066
windows_10_21h2 1061
windows_11_26h1 1009
windows 990
windows_10_1607 980
windows_server_2012 977
windows_11_23h2 761
windows_10 343
windows_server_2008 326
365_apps 277
office_2021 225
office_2024 225
office_2019 217
windows_8.1 192
microsoft_365 185
windows_rt_8.1 170
windows_7 169
Vulnerabilities by priority
| CVE | Priority | EPSS | CVSS | KEV | What |
|---|---|---|---|---|---|
| CVE-2026-32221 | Medium | 0.3% | 8.4 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorize… | |
| CVE-2026-5863 | Medium | 0.3% | 8.8 | Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allow… | |
| CVE-2026-10960 | Medium | 0.3% | 8.3 | Uninitialized Use in Codecs in Google Chrome prior to 149.0.7827.53 allowed a re… | |
| CVE-2026-11279 | Medium | 0.3% | 8.8 | Out of bounds read in DevTools in Google Chrome prior to 149.0.7827.53 allowed a… | |
| CVE-2026-41092 | Medium | 0.3% | 7.8 | Improper access control in Microsoft Kinect allows an authorized attacker to ele… | |
| CVE-2026-42829 | Medium | 0.3% | 7.8 | Improper access control in Windows Administrator Protection allows an authorized… | |
| CVE-2026-42902 | Medium | 0.3% | 7.8 | Improper authorization in Microsoft PowerToys allows an authorized attacker to e… | |
| CVE-2026-56174 | Medium | 0.3% | 7.8 | Untrusted search path in Windows Narrator Braille allows an authorized attacker … | |
| CVE-2026-62812 | Medium | 0.3% | 7.8 | Improper link resolution before file access ('link following') in Windows DHCP S… | |
| CVE-2026-9883 | Medium | 0.3% | 8.8 | Use after free in Base in Google Chrome prior to 148.0.7778.216 allowed a remote… | |
| CVE-2026-9896 | Medium | 0.3% | 8.8 | Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a rem… | |
| CVE-2026-9897 | Medium | 0.3% | 8.8 | Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote … | |
| CVE-2026-9969 | Medium | 0.3% | 8.8 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 14… | |
| CVE-2026-21283 | Medium | 0.3% | 7.8 | Bridge versions 15.1.2, 16.0 and earlier are affected by a Heap-based Buffer Ove… | |
| CVE-2026-57989 | Medium | 0.3% | 7.4 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorize… | |
| CVE-2026-5883 | Medium | 0.3% | 8.8 | Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote… | |
| CVE-2026-5884 | Medium | 0.3% | 8.8 | Insufficient validation of untrusted input in Media in Google Chrome prior to 14… | |
| CVE-2026-77103 | Medium | 0.3% | 7.5 | CommServe contained an authentication bypass issue affecting access authorizatio… | |
| CVE-2026-83995 | Medium | 0.3% | 7.8 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elev… | |
| CVE-2026-11116 | Medium | 0.3% | 8.8 | Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a r… | |
| CVE-2026-19305 | Medium | 0.3% | 8.6 | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain se… | |
| CVE-2026-62909 | Medium | 0.3% | 7.8 | Uncaught exception in .NET allows an authorized attacker to elevate privileges l… | |
| CVE-2026-81357 | Medium | 0.3% | 8.2 | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized … | |
| CVE-2026-10884 | Medium | 0.3% | 8.3 | Use after free in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a r… | |
| CVE-2026-10889 | Medium | 0.3% | 8.3 | Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a re… | |
| CVE-2026-10905 | Medium | 0.3% | 8.3 | Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remo… | |
| CVE-2026-10908 | Medium | 0.3% | 8.3 | Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.53 … | |
| CVE-2026-10909 | Medium | 0.3% | 8.3 | Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote … | |
| CVE-2026-10918 | Medium | 0.3% | 8.3 | Use after free in Viz in Google Chrome prior to 149.0.7827.53 allowed a remote a… | |
| CVE-2026-10919 | Medium | 0.3% | 8.3 | Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote… | |
| CVE-2026-10921 | Medium | 0.3% | 8.3 | Integer overflow in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remot… | |
| CVE-2026-10924 | Medium | 0.3% | 8.3 | Integer overflow in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a… | |
| CVE-2026-10927 | Medium | 0.3% | 8.3 | Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a rem… | |
| CVE-2026-42910 | Medium | 0.3% | 7.8 | Out-of-bounds write in Windows Hotpatch Monitoring Service allows an authorized … | |
| CVE-2026-42983 | Medium | 0.3% | 7.8 | Use after free in Windows DWM Core Library allows an authorized attacker to elev… | |
| CVE-2026-45592 | Medium | 0.3% | 7.8 | Integer overflow or wraparound in Windows Internet (wininet.dll) allows an autho… | |
| CVE-2026-45593 | Medium | 0.3% | 7.8 | Use after free in Windows SDK allows an authorized attacker to elevate privilege… | |
| CVE-2026-45600 | Medium | 0.3% | 7.8 | Access of resource using incompatible type ('type confusion') in Windows Kernel-… | |
| CVE-2026-45605 | Medium | 0.3% | 7.8 | Use after free in Windows Bluetooth Service allows an authorized attacker to ele… | |
| CVE-2026-45637 | Medium | 0.3% | 7.8 | Use after free in Windows DWM Core Library allows an authorized attacker to elev… | |
| CVE-2026-45638 | Medium | 0.3% | 7.8 | Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allo… | |
| CVE-2026-10969 | Medium | 0.3% | 7.5 | Insufficient validation of untrusted input in Extensions in Google Chrome prior … | |
| CVE-2026-10970 | Medium | 0.3% | 8.3 | Insufficient validation of untrusted input in InterestGroups in Google Chrome pr… | |
| CVE-2026-69911 | Medium | 0.3% | 7.0 | Use after free in Microsoft Windows Search Component allows an authorized attack… | |
| CVE-2026-11049 | Medium | 0.3% | 8.8 | Use after free in Password Manager in Google Chrome prior to 149.0.7827.53 allow… | |
| CVE-2026-11050 | Medium | 0.3% | 8.8 | Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote at… | |
| CVE-2026-11055 | Medium | 0.3% | 8.8 | Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allow… | |
| CVE-2026-11059 | Medium | 0.3% | 8.8 | Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote… | |
| CVE-2026-11060 | Medium | 0.3% | 8.8 | Use after free in Media in Google Chrome on Windows prior to 149.0.7827.53 allow… | |
| CVE-2026-11077 | Medium | 0.3% | 8.8 | Bad cast in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attack… |