Microsoft

Records18046All Threatist records

Exploited (KEV)406In CISA KEV

CVSS critical2330CVSS 9.0–10.0

CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2026-73128 Microsoft Windows Command Injection Vulnerability CRITICAL 97KEV 2026-10-13 TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability CRITICAL 97KEV 2026-09-25 TI-2026-56567 Microsoft Windows Link Following Vulnerability CRITICAL 93KEV 2026-09-08 TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability CRITICAL 93KEV 2026-09-08 TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records

Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

40 records in Azure Devops Server · all components

TI-2019-01021 CVE-2019-1306 · GHSA-wvw6-4r49-h4g6

Improper input validation in Microsoft Team Foundation Server 2018

MEDIUM 59

A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly, aka 'Azure DevOps and Team Foundation Server Remote Code Execution Vulnerabili…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.16988 Published 2019-09-11 No fix listed CWE-20

TI-2019-00802 CVE-2019-1072 · GHSA-g5c6-v9ph-hmxh

Improper input validation in Microsoft Team Foundation Server 2012

MEDIUM 57

A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.13446 Published 2019-07-15 No fix listed CWE-20

TI-2023-16315 CVE-2023-33136 · GHSA-rw46-pqg7-qwfj

Azure DevOps Server Remote Code Execution Vulnerability

MEDIUM 43

Azure DevOps Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0168 Published 2023-09-12 Fixed in 20230820.2, 20230825.1 +3 CWE-77

TI-2019-00710 CVE-2019-0971 · GHSA-858j-7757-pwv6

Improper output encoding in Microsoft Team Foundation Server 2018

MEDIUM 40

An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specially crafted authentication request to an affected server, aka 'Azure DevOps Se…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.08464 Published 2019-05-16 No fix listed CWE-116

TI-2024-13479 CVE-2024-20667 · GHSA-qvh3-fxm2-mgw9

Azure DevOps Server Remote Code Execution Vulnerability

LOW 38

Azure DevOps Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.01359 Published 2024-02-13 Fixed in 20240126.6, 20240126.2 +1 CWE-77

TI-2023-19574 CVE-2023-38155 · GHSA-jw6j-8p3q-xrff

Azure DevOps Server Remote Code Execution Vulnerability

LOW 38

Azure DevOps Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01318 Published 2023-09-12 Fixed in 20230601.3, 20230825.4 +3 CWE-502

TI-2023-07948 CVE-2023-21553 · GHSA-hwv6-qxxw-8ffm

Azure DevOps Server Remote Code Execution Vulnerability

LOW 38

Azure DevOps Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0142 Published 2023-02-14 Fixed in 20230131.3 CWE-94

TI-2019-00628 CVE-2019-0875 · GHSA-pwff-g9gp-9fjw

An elevation of privilege vulnerability exists when Azure DevOps Server 2019 does not…

LOW 38

An elevation of privilege vulnerability exists when Azure DevOps Server 2019 does not properly enforce project permissions, aka 'Azure DevOps Server Elevation of Privilege Vulnerability'.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03023 Published 2019-04-09 No fix listed

TI-2020-00790 CVE-2020-0815 · GHSA-pg6g-7pwc-wmq6

An elevation of privilege vulnerability exists when Azure DevOps Server and Team…

LOW 37

An elevation of privilege vulnerability exists when Azure DevOps Server and Team Foundation Services improperly handle pipeline job tokens, aka 'Azure DevOps Server and Team Foundation Services Elevation of Privilege Vul…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.01837 Published 2020-03-12 No fix listed

TI-2020-00733 CVE-2020-0758 · GHSA-f545-q9v5-fj94

An elevation of privilege vulnerability exists when Azure DevOps Server and Team…

LOW 37

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.02015 Published 2020-03-12 No fix listed

TI-2024-23330 CVE-2024-35267 · GHSA-qcph-65j4-4x3j

Azure DevOps Server Spoofing Vulnerability

LOW 36

Azure DevOps Server Spoofing Vulnerability

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.01582 Published 2024-07-09 Fixed in 20240702.1 CWE-79

TI-2024-23329 CVE-2024-35266 · GHSA-9wrg-j73q-q95r

Azure DevOps Server Spoofing Vulnerability

LOW 36

Azure DevOps Server Spoofing Vulnerability

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.01582 Published 2024-07-09 Fixed in 20240702.1 CWE-79

TI-2019-00611 CVE-2019-0857 · GHSA-6hjh-rrqc-j242

Improper output encoding in Microsoft Azure DevOps Server

LOW 35

A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Spoofing Vulnerability'.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.03858 Published 2019-04-09 No fix listed CWE-116

TI-2023-18395 CVE-2023-36561 · GHSA-6r24-858h-vm25

Azure DevOps Server Elevation of Privilege Vulnerability

LOW 34

Azure DevOps Server Elevation of Privilege Vulnerability

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00902 Published 2023-10-10 Fixed in 20230926.1, 20230927.1 +1 CWE-284

TI-2021-08640 CVE-2021-27067 · GHSA-5xwm-q3wx-jvmr

Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability

LOW 34

Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02826 Published 2021-04-13 Fixed in publication

TI-2023-07959 CVE-2023-21565 · GHSA-hwmh-fp5g-pqmr

Azure DevOps Server Spoofing Vulnerability

LOW 33

Azure DevOps Server Spoofing Vulnerability

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00933 Published 2023-06-13 Fixed in 20230602.4, 20230601.3 +1 CWE-79

TI-2023-07958 CVE-2023-21564 · GHSA-fvm6-3mw8-9cq2

Azure DevOps Server Cross-Site Scripting Vulnerability

LOW 33

Azure DevOps Server Cross-Site Scripting Vulnerability

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00887 Published 2023-02-14 Fixed in 20230131.1 CWE-79

TI-2021-09574 CVE-2021-28459 · GHSA-xhcw-5f8j-45f2

Azure DevOps Server Spoofing Vulnerability

LOW 32

Azure DevOps Server Spoofing Vulnerability

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02317 Published 2021-04-13 Fixed in publication CWE-79

TI-2019-00732 CVE-2019-0996 · GHSA-rm8m-fp2p-77cc

Azure DevOps Server Spoofing Vulnerability

LOW 32

A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.0157 Published 2019-06-12 Fixed in publication CWE-352

TI-2019-00625 CVE-2019-0871 · GHSA-4wrw-g53q-g424

Cross-site scripting in Microsoft Team Foundation Server

LOW 32

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02419 Published 2019-04-09 No fix listed CWE-79

TI-2019-00624 CVE-2019-0870 · GHSA-p34c-hp83-p85p

Cross-site scripting in Microsoft Team Foundation Server

LOW 32

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02419 Published 2019-04-09 No fix listed CWE-79

TI-2019-00622 CVE-2019-0868 · GHSA-hfvg-pfv5-xv72

Cross-site scripting in Microsoft Team Foundation Server

LOW 32

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02419 Published 2019-04-09 No fix listed CWE-79

TI-2019-00621 CVE-2019-0867 · GHSA-2cf6-m3mv-f2w7

Cross-site scripting in Microsoft Team Foundation Server 2018

LOW 32

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02387 Published 2019-04-09 No fix listed CWE-79

TI-2019-00620 CVE-2019-0866 · GHSA-wxr5-r4hr-h5r7

Cross-site scripting in Microsoft Team Foundation Server

LOW 32

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02626 Published 2019-04-09 No fix listed CWE-79

TI-2026-17366 CVE-2026-21512 · GHSA-532f-36vx-gpxx

Azure DevOps Server Cross-Site Scripting Vulnerability

LOW 31

Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01011 Published 2026-02-10 Fixed in 20260204.3 CWE-918

Open these records in search →

Critical	2330
High	10410
Medium	5035
Low	270
No CVSS	1