Priority CRITICAL 100KEV
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.15873 · Published 2026-07-14 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-502
Priority CRITICAL 100KEV
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03042 · Published 2026-07-14 · Fixed in 16.0.5561.1001, 16.0.10417.20175 +1 CWE-502
Priority CRITICAL 100KEV
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.77054 · Published 2026-04-14 · Fixed in 10.0.14393.9060, 10.0.17763.8644 +9 CWE-415
Priority CRITICAL 100KEV
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.29201 · Published 2026-01-13 · Fixed in 16.0.5535.1001, 16.0.10417.20083 +1 CWE-502
Priority CRITICAL 100KEV
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.9998 · Published 2025-10-14 · Fixed in 6.2.9200.25728, 6.3.9600.22826 +5 CWE-502
Priority CRITICAL 100KEV
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99999 · Published 2025-07-20 · Fixed in 16.0.5513.1001, 16.0.10417.20037 +1 CWE-502
Priority CRITICAL 100KEV
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01622 · Published 2025-02-19 · No fix listed CWE-284
Priority CRITICAL 100KEV
An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01378 · Published 2024-11-26 · No fix listed CWE-269
Priority CRITICAL 100KEV
Microsoft Configuration Manager Remote Code Execution Vulnerability
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.81043 · Published 2024-10-08 · Fixed in 5.00.9106 CWE-89
Priority CRITICAL 100KEV
Microsoft Outlook Remote Code Execution Vulnerability
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.9466 · Published 2024-02-13 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.0.5435.1001 CWE-20
Priority CRITICAL 100KEV
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.12661 · Published 2024-02-13 · Fixed in 15.01.2507.037, 15.2.1544.004 CWE-287
Priority CRITICAL 100KEV
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.21009 · Published 2024-08-21 · Fixed in 128.0.6613.84 CWE-843
Priority CRITICAL 100KEV
Microsoft SharePoint Server Elevation of Privilege Vulnerability
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99984 · Published 2023-06-13 · Fixed in 16.0.10399.20005 CWE-303
Priority CRITICAL 100KEV
Microsoft Outlook Elevation of Privilege Vulnerability
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.97159 · Published 2023-03-14 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.0.5387.1000 +1 CWE-20
Priority CRITICAL 100KEV
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.16468 · Published 2023-11-29 · Fixed in 119.0.6045.199 CWE-190
Priority CRITICAL 100KEV
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.77326 · Published 2022-11-09 · Fixed in 15.00.1497.044, 15.01.2375.037 +3
Priority CRITICAL 100KEV
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.31864 · Published 2022-11-25 · Fixed in 107.0.5304.121, 19.1.8 CWE-787
Priority CRITICAL 100KEV
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99933 · Published 2021-09-15 · Fixed in DSC Agent versions: 2.71.1.25, 2.70.0.30 +8
Priority CRITICAL 100KEV
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.9999 · Published 2021-07-14 · Fixed in 15.00.1497.015, 15.01.2176.012 +3
Priority CRITICAL 100KEV
Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99999 · Published 2021-07-14 · Fixed in 15.00.1497.015, 15.01.2176.012 +3 CWE-918
Priority CRITICAL 100KEV
HTTP Protocol Stack Remote Code Execution Vulnerability
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99867 · Published 2021-05-11 · Fixed in 10.0.19041.982, 10.0.19042.982 CWE-416
Priority CRITICAL 100KEV
Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99996 · Published 2021-03-02 · Fixed in 15.00.1395.012, 15.00.1473.006 +22 CWE-918
Priority CRITICAL 100KEV
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC).
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.99389 · Published 2020-08-17 · Partial fix · publication
Priority CRITICAL 100KEV
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.96721 · Published 2020-07-14 · No fix listed CWE-20
Priority CRITICAL 100KEV
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.9981 · Published 2020-03-12 · Fixed CWE-119
Load more