Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV

Components

Products in the NVD configurations · select one to filter the records

Records

18046 records

Priority CRITICAL 100KEV

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.15873 Published 2026-07-14 Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-502
Priority CRITICAL 100KEV

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03042 Published 2026-07-14 Fixed in 16.0.5561.1001, 16.0.10417.20175 +1 CWE-502
Priority CRITICAL 100KEV

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.29201 Published 2026-01-13 Fixed in 16.0.5535.1001, 16.0.10417.20083 +1 CWE-502
Priority CRITICAL 100KEV

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9998 Published 2025-10-14 Fixed in 6.2.9200.25728, 6.3.9600.22826 +5 CWE-502
Priority CRITICAL 100KEV

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2025-07-20 Fixed in 16.0.5513.1001, 16.0.10417.20037 +1 CWE-502
Priority CRITICAL 100KEV

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01622 Published 2025-02-19 No fix listed CWE-284
Priority CRITICAL 100KEV

An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01378 Published 2024-11-26 No fix listed CWE-269
Priority CRITICAL 100KEV

Microsoft Outlook Remote Code Execution Vulnerability

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9466 Published 2024-02-13 Fixed in https://aka.ms/OfficeSecurityReleases, 16.0.5435.1001 CWE-20
TI-2024-07390 CVE-2024-7971 · GHSA-pq5w-h3jm-m95c

Type confusion in Google Chrome

Priority CRITICAL 100KEV

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.21009 Published 2024-08-21 Fixed in 128.0.6613.84 CWE-843
Priority CRITICAL 100KEV

Microsoft Outlook Elevation of Privilege Vulnerability

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.97159 Published 2023-03-14 Fixed in https://aka.ms/OfficeSecurityReleases, 16.0.5387.1000 +1 CWE-20
TI-2023-05824 CVE-2023-6345 · GHSA-xm5p-7w7v-qqr5

Integer overflow in Google Chrome

Priority CRITICAL 100KEV

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.16468 Published 2023-11-29 Fixed in 119.0.6045.199 CWE-190
TI-2022-03781 CVE-2022-4135 · GHSA-995f-9x5r-2rcj

Out-of-bounds write in Google Chrome

Priority CRITICAL 100KEV

Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.31864 Published 2022-11-25 Fixed in 107.0.5304.121, 19.1.8 CWE-787
Priority CRITICAL 100KEV

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC).

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99389 Published 2020-08-17 Partial fix · publication
Priority CRITICAL 100KEV

A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.96721 Published 2020-07-14 No fix listed CWE-20
Priority CRITICAL 100KEV

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.9981 Published 2020-03-12 Fixed CWE-119
Load more
Open these records in search →