Skip to contentMicrosoft vulnerabilities
Products
- Windows Server 20196,458
- Windows Server 20166,403
- Windows Server 20196,362
- Windows Server 2019 (server Core Installation)6,265
- Windows 10 Version 18095,907
- Windows Server 20225,762
- Windows Server 20165,572
- Windows Server 2016 (server Core Installation)5,368
- Windows Server 20125,295
- Windows 10 Version 21h25,141
- Windows 10 Version 16074,987
- Windows Server 20224,948
- Windows 10 Version 22h24,643
- Windows Server 20254,336
- Windows Server 2025 (server Core Installation)4,334
- Windows 11 Version 24h24,232
- Windows Server 2012 R24,119
- Windows 11 Version 23h24,056
- Windows 10 18094,018
- Windows Server 2012 R2 (server Core Installation)3,974
- Windows 10 21h23,969
- Windows 10 22h23,968
- Windows Server 20123,881
- Windows Server 2012 (server Core Installation)3,748
- Windows Server 20253,633
- Windows 11 24h23,560
- Windows Server 20083,552
- Windows 11 Version 25h23,497
- Windows 10 16073,429
- Windows 11 23h23,409
- Windows 11 Version 26h13,230
- Windows 102,977
- Windows 11 25h22,827
- Windows 11 26h12,535
- Windows 72,367
- Windows 10 Version 15072,323
- Windows 8.12,215
- Windows Rt 8.12,020
- Windows Server 2008 R2 Service Pack 11,900
- Windows Server 2008 R2 Service Pack 1 (server Core Installation)1,886
- Windows 11 Version 22h21,776
- Windows Server 2022, 23h2 Edition (server Core Installation)1,723
- Windows Server 2008 Service Pack 2 (server Core Installation)1,689
- Windows Server 2008 Service Pack 21,686
- Windows Server 2022 23h21,676
- Windows 11 Version 26h21,663
- Windows 11 22h21,652
- Internet Explorer1,635
- Windows 11 Version 21h21,560
- Windows 11 Version 22h31,276
- Windows 10 Version 20h21,259
- Windows 10 15071,230
- Windows Server 2008 Service Pack 21,169
- Windows 8.11,117
- 365 Apps For Enterprise1,105
- Windows 10 Version 1903 For X64-based Systems1,069
- Windows Server, Version 1903 (server Core Installation)1,055
- Office1,050
- Windows 10 Version 19091,045
- Windows 10 Version 1903 For Arm64-based Systems1,037
Show 140 moreShow less
Newest
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Tampering VulnerabilityCVE-2026-663136.8 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2026-663126.5 Medium
- microsoft edge, edge for android +1 moreMicrosoft Edge for Android Information Disclosure VulnerabilityCVE-2026-663107.7 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2026-663217.4 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2026-663188.1 High
- microsoft azure cosmos dbAzure Cosmos DB Remote Code Execution VulnerabilityCVE-2026-6680310.0 Critical
- microsoft edge, edge for android +1 moreMicrosoft Edge for Android (Chromium-based) Tampering VulnerabilityCVE-2026-628285.4 Medium
- microsoft libxpmDenial of service via unsigned underflow in libXpm's write pathCVE-2026-94287Fix available5.5 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2026-579907.4 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2026-579897.4 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2026-579785.4 Medium
- microsoft azure portalAzure Portal Information Disclosure VulnerabilityCVE-2026-628359.3 Critical
- microsoft promptyPrompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks RendererCVE-2026-73299Fix available10.0 Critical
- microsoft kiotaKiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)CVE-2026-73851Fix available6.1 Medium
- microsoft azure kubernetes serviceMicrosoft Azure Kubernetes Service Elevation of Privilege VulnerabilityCVE-2026-5616310.0 Critical
- microsoft azure app service for linuxAzure App Service on Azure Stack Hub Elevation of Privilege VulnerabilityCVE-2026-5863010.0 Critical
- microsoft purview data governanceData Quality Elevation of Privilege VulnerabilityCVE-2026-5710610.0 Critical
- microsoft azure dnsAzure DNS Elevation of Privilege VulnerabilityCVE-2026-5827510.0 Critical
- microsoft azure key vaultAzure Key Vault Elevation of Privilege VulnerabilityCVE-2026-6282510.0 Critical
- microsoft exchange online, microsoft exchange online +1 moreMicrosoft Exchange Online Tampering VulnerabilityCVE-2026-5619110.0 Critical
- microsoft 365 copilotMicrosoft M365 Copilot Remote Code Execution VulnerabilityCVE-2026-505179.9 Critical
- microsoft graphMicrosoft Graph Information Disclosure VulnerabilityCVE-2026-491596.5 Medium
- microsoft azure api management (apim), azure api management +1 moreAzure API Management (APIM) Remote Code Execution VulnerabilityCVE-2026-354258.0 High
- microsoft azure red hat openshift (aro), azure red hat openshift +1 moreAzure Red Hat OpenShift (ARO) Elevation of Privilege VulnerabilityCVE-2026-561609.1 Critical
- microsoft accountMicrosoft Account Remote Code Execution VulnerabilityCVE-2026-561659.8 Critical
- microsoft surface management servicesMicrosoft Surface Remote Code Execution VulnerabilityCVE-2026-541209.9 Critical
- microsoft azure ai searchAzure AI Search Elevation of Privilege VulnerabilityCVE-2026-561678.5 High
- elated-themes vinoWordPress Vino theme <= 1.9 - Local File Inclusion vulnerabilityCVE-2026-654817.5 High
- microsoft remote desktop web client, windows admin center +1 moreWindows Remote Desktop Protocol (RDP) Information Disclosure VulnerabilityCVE-2026-561717.1 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Tampering VulnerabilityCVE-2026-579805.4 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing VulnerabilityCVE-2026-628264.6 Medium
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 +7 more +9 moreWindows Backup Service Elevation of Privilege VulnerabilityCVE-2026-585987.0 High
- microsoft windows admin centerWindows Admin Center Spoofing VulnerabilityCVE-2026-586436.1 Medium
- microsoft terminal, windows terminal app +1 moreWindows Terminal Remote Code Execution VulnerabilityCVE-2026-591177.5 High
- microsoft ufoMicrosoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of serviceCVE-2026-554406.5 Medium
- microsoft ufoMicrosoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_infoCVE-2026-545684.3 Medium
- microsoft simplechatSimpleChat plugin validation endpoints missing authentication and authorizationCVE-2026-572068.6 High
- microsoft simplechatSimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpointsCVE-2026-572054.3 Medium
- microsoft promptyPrompty: Arbitrary File Read via ${file:path} Reference ExpansionCVE-2026-53598Fix available7.5 High
- microsoft promptyPrompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loaderCVE-2026-53597Fix available8.7 High
- microsoft o365-moodlemoodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpointCVE-2026-547339.3 Critical
- microsoft kiotaKiota: Generation-time SSRF + remote/local file inclusion via unrestricted $refCVE-2026-59867Fix available7.1 High
- microsoft kiotaKiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceNameCVE-2026-59866Fix available9.3 Critical
- microsoft kiotaKiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensionsCVE-2026-59864Fix available9.3 Critical
- microsoft kiotaKiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`CVE-2026-59865Fix available9.3 Critical
- microsoft kiotaKiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRFCVE-2026-59863Fix available7.0 High
- microsoft kiotaKiota: Code Generation Literal Injection in the PHP GeneratorCVE-2026-59859Fix available8.7 High
- microsoft kiotaKiota: Code Generation Literal Injection in the Python GeneratorCVE-2026-59862Fix available7.5 High
- microsoft kiotaKiota: Code Generation Literal Injection in Kiota Ruby GeneratorCVE-2026-59861Fix available7.5 High
- microsoft kiotaKiota: XML Doc-Comment Newline Breakout Code InjectionCVE-2026-59860Fix available8.7 High
- Show moreLoading…