Microsoft

Records18046All Threatist records

Exploited (KEV)406In CISA KEV

CVSS critical2330CVSS 9.0–10.0

CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2026-73128 Microsoft Windows Command Injection Vulnerability CRITICAL 97KEV 2026-10-13 TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability CRITICAL 97KEV 2026-09-25 TI-2026-56567 Microsoft Windows Link Following Vulnerability CRITICAL 93KEV 2026-09-08 TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability CRITICAL 93KEV 2026-09-08 TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records

Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

16 records in Lync Server · all components

TI-2013-01140 CVE-2013-1302 · GHSA-q433-fx96-3j76

Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do…

MEDIUM 60

Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.2191 Published 2013-05-15 No fix listed CWE-119

TI-2014-01426 CVE-2014-1823 · GHSA-hj87-75g2-729c

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync…

MEDIUM 52

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing a valid meeting ID,…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.5109 Published 2014-06-11 No fix listed CWE-79

TI-2014-03321 CVE-2014-4071 · GHSA-9gc3-vv9j-rfwm

The Server in Microsoft Lync Server 2013 allows remote attackers to cause a denial of…

MEDIUM 41

The Server in Microsoft Lync Server 2013 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon hang) via a crafted request, aka "Lync Denial of Service Vulnerability."

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.18986 Published 2014-09-10 No fix listed

TI-2014-03319 CVE-2014-4068 · GHSA-777p-5mff-5cpm

The Response Group Service in Microsoft Lync Server 2010 and 2013 and the Core Components…

MEDIUM 41

The Response Group Service in Microsoft Lync Server 2010 and 2013 and the Core Components in Lync Server 2013 do not properly handle exceptions, which allows remote attackers to cause a denial of service (daemon hang) vi…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.19692 Published 2014-09-10 No fix listed CWE-20

TI-2022-14751 CVE-2022-33633 · GHSA-m4g8-6pfp-59jr

Skype for Business and Lync Remote Code Execution Vulnerability

LOW 38

Skype for Business and Lync Remote Code Execution Vulnerability

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02334 Published 2022-07-12 Fixed in 8308.1198, 9319.634 +1

TI-2021-08239 CVE-2021-26422 · GHSA-322h-m7q9-7x4q

Skype for Business and Lync Remote Code Execution Vulnerability

LOW 36

Skype for Business and Lync Remote Code Execution Vulnerability

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02219 Published 2021-05-11 Fixed in 8308.1144, 2046.369 +1

TI-2022-10143 CVE-2022-26911 · GHSA-25r5-69f6-hgcg

Skype for Business Information Disclosure Vulnerability

LOW 35

Skype for Business Information Disclosure Vulnerability

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03631 Published 2022-04-15 Fixed in 8308.1194, 9319.628

TI-2021-06394 CVE-2021-24099 · GHSA-gr3f-8f43-4w8g

Skype for Business and Lync Denial of Service Vulnerability

LOW 35

Skype for Business and Lync Denial of Service Vulnerability

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03201 Published 2021-02-25 Fixed in publication

TI-2021-06369 CVE-2021-24073 · GHSA-6w2g-frp4-gwrv

Skype for Business and Lync Spoofing Vulnerability

LOW 35

Skype for Business and Lync Spoofing Vulnerability

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.01797 Published 2021-02-25 Fixed in publication

TI-2019-00763 CVE-2019-1029 · GHSA-6m2x-7chh-x75q

Skype for Business and Lync Server Denial of Service Vulnerability

LOW 35

A denial of service vulnerability exists in Skype for Business.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.05281 Published 2019-06-12 Fixed in publication

TI-2021-08238 CVE-2021-26421 · GHSA-w6mv-8x3w-r7w5

Skype for Business and Lync Spoofing Vulnerability

LOW 34

Skype for Business and Lync Spoofing Vulnerability

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.01411 Published 2021-05-11 Fixed in 2046.369, 8308.1144

TI-2015-02229 CVE-2015-2532 · GHSA-pfpf-ww7f-5r79

Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 allows remote…

LOW 33

Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability."

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.10889 Published 2015-09-09 No fix listed CWE-79

TI-2015-02228 CVE-2015-2531 · GHSA-wr7w-c745-69g3

Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server…

LOW 33

Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.10889 Published 2015-09-09 No fix listed CWE-79

TI-2014-03320 CVE-2014-4070 · GHSA-f56f-gjmp-ccg6

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync…

LOW 33

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync XSS Information Disclosure V…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.10916 Published 2014-09-10 No fix listed CWE-79

TI-2019-00563 CVE-2019-0798 · GHSA-43cx-jhp3-2qcr

Cross-site scripting in Microsoft Skype for Business Server 2015

LOW 31

A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business and Lync Spoofing Vulnerability'.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02084 Published 2019-04-09 No fix listed CWE-79

TI-2015-02232 CVE-2015-2536 · GHSA-mgv9-6p6c-9c3v

Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for…

LOW 31

Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server a…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.08863 Published 2015-09-09 No fix listed CWE-79

Open these records in search →

Critical	2330
High	10410
Medium	5035
Low	270
No CVSS	1