Microsoft

Records18046All Threatist records

Exploited (KEV)406In CISA KEV

CVSS critical2330CVSS 9.0–10.0

CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2026-73128 Microsoft Windows Command Injection Vulnerability CRITICAL 97KEV 2026-10-13 TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability CRITICAL 97KEV 2026-09-25 TI-2026-56567 Microsoft Windows Link Following Vulnerability CRITICAL 93KEV 2026-09-08 TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability CRITICAL 93KEV 2026-09-08 TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records

Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

156 records in Visual Studio 2022 · all components

TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3

The HTTP/2 protocol allows a denial of service (server resource consumption) because…

CRITICAL 90KEV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99999 Published 2023-10-10 Partial fix · 1.28.0, 0.17.0 +9 CWE-400

TI-2023-19596 CVE-2023-38180 · GHSA-vmch-3w2x-vhgq

.NET and Visual Studio Denial of Service Vulnerability

CRITICAL 90KEV

.NET and Visual Studio Denial of Service Vulnerability

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.14127 Published 2023-08-08 Fixed in 6.0.21, 7.0.10 +4 CWE-400

TI-2025-34970 CVE-2025-55315 · GHSA-5rrx-jjjq-q2r5

ASP.NET Security Feature Bypass Vulnerability

HIGH 79

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.67162 Published 2025-10-14 Partial fix · 2.3.6, 8.0.21 +5 CWE-444

TI-2023-19588 CVE-2023-38171 · GHSA-xh5m-8qqp-c5x7

Microsoft QUIC Denial of Service Vulnerability

HIGH 76

Microsoft QUIC Denial of Service Vulnerability

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.71046 Published 2023-10-10 Fixed in 17.2.21, 17.4.13 +8 CWE-476

TI-2024-19132 CVE-2024-28938 · GHSA-c37g-ppfr-pj55

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

HIGH 73

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0233 Published 2024-04-09 Fixed in 16.0.4120.1, 15.0.4360.2 +9 CWE-125

TI-2022-16266 CVE-2022-35825 · GHSA-q9gm-4xgw-gmjq

Visual Studio Remote Code Execution Vulnerability

HIGH 73

Visual Studio Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02225 Published 2022-08-09 Fixed in 15.9.50, 16.9.24 +6

TI-2024-14164 CVE-2024-21404 · GHSA-q5x8-3vm4-xrh9

.NET Denial of Service Vulnerability

HIGH 72

.NET Denial of Service Vulnerability

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02707 Published 2024-02-13 Fixed in 6.0.27, 7.0.16 +4 CWE-476

TI-2024-14152 CVE-2024-21392 · GHSA-5fxj-whcv-crrc

.NET and Visual Studio Denial of Service Vulnerability

HIGH 72

.NET and Visual Studio Denial of Service Vulnerability

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0309 Published 2024-03-12 Fixed in 17.9.3, 7.3.12 +6 CWE-400

TI-2023-18092 CVE-2023-36038

ASP.NET Core Denial of Service Vulnerability

HIGH 69

ASP.NET Core Denial of Service Vulnerability

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02777 Published 2023-11-14 Fixed in 8.0.0, 17.2.22 +3 CWE-400

TI-2023-18392 CVE-2023-36558 · GHSA-3fx3-85r4-8j3w

ASP.NET Core Security Feature Bypass Vulnerability

MEDIUM 63

ASP.NET Core Security Feature Bypass Vulnerability

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.01077 Published 2023-11-14 Fixed in 6.0.25, 7.0.14 +5

TI-2023-15338 CVE-2023-32032 · GHSA-q85v-668x-6fjr

.NET and Visual Studio Elevation of Privilege Vulnerability

MEDIUM 62

.NET and Visual Studio Elevation of Privilege Vulnerability

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.006 Published 2023-06-13 Fixed in 7.0.7, 17.2.16 +4 CWE-20

TI-2023-18100 CVE-2023-36049 · GHSA-c3hf-8vgx-72rh

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

MEDIUM 58

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0679 Published 2023-11-14 Fixed in 17.2.22, 17.4.14 +11 CWE-20

TI-2024-29136 CVE-2024-43498 · GHSA-v7vf-f5q6-m899

.NET and Visual Studio Remote Code Execution Vulnerability

MEDIUM 55

.NET and Visual Studio Remote Code Execution Vulnerability

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03591 Published 2024-11-12 Partial fix · 7.5.0, 17.8.16 +4 CWE-843

TI-2024-00056 CVE-2024-0057 · GHSA-68w7-72jg-6qpp

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

MEDIUM 54

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02778 Published 2024-01-09 Fixed in 8.0.1, 7.0.15 +25 CWE-20

TI-2026-72884 CVE-2026-88092 · GHSA-rv87-ccxw-8ggf

Request smuggling in ASP.NET Core lets attackers tamper with traffic

MEDIUM 50

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00934 Published 2026-10-13 Fixed in 10.0.13, 11.0.0-rc.2 +4 CWE-444

TI-2022-11690 CVE-2022-29145 · GHSA-fcg8-mg9g-6hc4

.NET and Visual Studio Denial of Service Vulnerability

MEDIUM 47

.NET and Visual Studio Denial of Service Vulnerability

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05538 Published 2022-05-10 Fixed in 6.0.5, 3.1.25 +5 CWE-400

TI-2022-11665 CVE-2022-29117 · GHSA-3rq8-h3gj-r5c6

.NET and Visual Studio Denial of Service Vulnerability

MEDIUM 47

.NET and Visual Studio Denial of Service Vulnerability

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05735 Published 2022-05-10 Fixed in 6.0.5, 3.1.25 +6 CWE-400

TI-2022-07392 CVE-2022-23267 · GHSA-485p-mrj5-8w2v

.NET and Visual Studio Denial of Service Vulnerability

MEDIUM 47

.NET and Visual Studio Denial of Service Vulnerability

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05703 Published 2022-05-10 Fixed in 3.1.25, 5.0.17 +9 CWE-400

TI-2025-30351 CVE-2025-47959 · GHSA-ch2f-3gv8-q5g5

Visual Studio Remote Code Execution Vulnerability

MEDIUM 46

Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network.

CVSS 3.1HIGH 7.1 Network Low privileges User interaction EPSS 0.10935 Published 2025-06-13 Fixed in 17.10.16, 17.12.9 +2 CWE-77

TI-2022-17731 CVE-2022-38013 · GHSA-r8m2-4x37-6592

.NET Core and Visual Studio Denial of Service Vulnerability

MEDIUM 46

.NET Core and Visual Studio Denial of Service Vulnerability

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04307 Published 2022-09-13 Fixed in 17.3.5, 17.3.4 +6 CWE-400

TI-2024-19131 CVE-2024-28937 · GHSA-2jr3-vfc4-xrm2

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

MEDIUM 45

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0233 Published 2024-04-09 Fixed in 15.0.2110.4, 16.0.1115.1 +9 CWE-122

TI-2024-19130 CVE-2024-28936 · GHSA-6p2g-wx5c-v95j

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

MEDIUM 45

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02415 Published 2024-04-09 Fixed in 16.0.4120.1, 15.0.4360.2 +9 CWE-190

TI-2024-19129 CVE-2024-28935 · GHSA-6234-wr38-h5fr

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

MEDIUM 45

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02356 Published 2024-04-09 Fixed in 15.0.4360.2, 16.0.4120.1 +9 CWE-122

TI-2024-19128 CVE-2024-28934 · GHSA-8266-hvc3-3w4r

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

MEDIUM 45

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02415 Published 2024-04-09 Fixed in 16.0.4120.1, 15.0.4360.2 +9 CWE-121

TI-2024-19127 CVE-2024-28933 · GHSA-jvcr-j6x4-hh24

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

MEDIUM 45

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02415 Published 2024-04-09 Fixed in 16.11.35, 17.9.6 +9 CWE-191

Open these records in search →

Critical	2330
High	10410
Medium	5035
Low	270
No CVSS	1