Microsoft

Records18046All Threatist records

Exploited (KEV)406In CISA KEV

CVSS critical2330CVSS 9.0–10.0

CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2026-73128 Microsoft Windows Command Injection Vulnerability CRITICAL 97KEV 2026-10-13 TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability CRITICAL 97KEV 2026-09-25 TI-2026-56567 Microsoft Windows Link Following Vulnerability CRITICAL 93KEV 2026-09-08 TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability CRITICAL 93KEV 2026-09-08 TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records

Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

3428 records in Windows 10 1607 · all components

TI-2026-26194 CVE-2026-33824 · GHSA-q6qf-3m2m-xq4f

Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

CRITICAL 100KEV

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.77054 Published 2026-04-14 Fixed in 10.0.14393.9060, 10.0.17763.8644 +9 CWE-415

TI-2017-06077 CVE-2017-8543 · GHSA-w5g9-xvwm-4qf8

Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista…

CRITICAL 100KEV

Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 G…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.74164 Published 2017-06-15 No fix listed CWE-281

TI-2026-73128 CVE-2026-96951 · GHSA-hjr5-mppg-mjq7

Windows Shell Security Feature Bypass Vulnerability

CRITICAL 97KEV

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.09813 Published 2026-10-13 Fixed in 154.0.4258.62, 20260925.100 +12 CWE-77

TI-2026-17367 CVE-2026-21513 · GHSA-rqf6-jf48-p6rm

MSHTML Framework Security Feature Bypass Vulnerability

CRITICAL 97KEV

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.15852 Published 2026-02-10 Fixed in 10.0.14393.8868, 10.0.17763.8389 +11 CWE-693

TI-2026-17364 CVE-2026-21510 · GHSA-q6v4-4w5r-j7hr

Windows Shell Security Feature Bypass Vulnerability

CRITICAL 97KEV

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.61238 Published 2026-02-10 Fixed in 10.0.14393.8868, 10.0.17763.8389 +11 CWE-693

TI-2025-24062 CVE-2025-33073 · GHSA-cfjg-2jr6-cgph

Windows SMB Client Elevation of Privilege Vulnerability

CRITICAL 97KEV

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.82829 Published 2025-06-10 Fixed in 10.0.10240.21034, 10.0.14393.8148 +12 CWE-284

TI-2025-24042 CVE-2025-33053 · GHSA-26qv-p8cr-jxp5

Internet Shortcut Files Remote Code Execution Vulnerability

CRITICAL 97KEV

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.87135 Published 2025-06-10 Fixed in 10.0.10240.21034, 10.0.14393.8148 +12 CWE-73

TI-2024-32708 CVE-2024-49039 · GHSA-jmf3-9f5j-cpjh

Windows Task Scheduler Elevation of Privilege Vulnerability

CRITICAL 97KEV

Windows Task Scheduler Elevation of Privilege Vulnerability

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.14179 Published 2024-11-12 Fixed in 10.0.26100.2314, 10.0.17763.6532 +8 CWE-287

TI-2024-29106 CVE-2024-43461 · GHSA-7q6v-68mf-6678

Windows MSHTML Platform Spoofing Vulnerability

CRITICAL 97KEV

Windows MSHTML Platform Spoofing Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.54486 Published 2024-09-10 Fixed in 10.0.10240.20766, 10.0.14393.7336 +13 CWE-451

TI-2024-19802 CVE-2024-30040 · GHSA-mmh4-cvwv-5vmm

Windows MSHTML Platform Security Feature Bypass Vulnerability

CRITICAL 97KEV

Windows MSHTML Platform Security Feature Bypass Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03939 Published 2024-05-14 Fixed in 10.0.17763.5820, 10.0.20348.2461 +8 CWE-20

TI-2023-18080 CVE-2023-36025 · GHSA-4jff-227j-6g3v

Windows SmartScreen Security Feature Bypass Vulnerability

CRITICAL 97KEV

Windows SmartScreen Security Feature Bypass Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.88196 Published 2023-11-14 Fixed in 10.0.17763.5122, 10.0.20348.2113 +12

TI-2023-15353 CVE-2023-32049 · GHSA-8q3q-pcch-j42x

Windows SmartScreen Security Feature Bypass Vulnerability

CRITICAL 97KEV

Windows SmartScreen Security Feature Bypass Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.04156 Published 2023-07-11 Fixed in 10.0.17763.4645, 10.0.20348.1850 +5

TI-2023-08061 CVE-2023-21674 · GHSA-hqxf-h392-6m7w

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

CRITICAL 97KEV

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.34206 Published 2023-01-10 Fixed in 10.0.17763.3887, 10.0.20348.1487 +8 CWE-416

TI-2022-19649 CVE-2022-41128 · GHSA-778m-x5h7-mg59

Windows Scripting Languages Remote Code Execution Vulnerability

CRITICAL 97KEV

Windows Scripting Languages Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.24623 Published 2022-11-09 Fixed in 10.0.10240.19567, 10.0.14393.5501 +11 CWE-787

TI-2022-10154 CVE-2022-26923 · GHSA-j9xf-76vv-4wcg

Active Directory Domain Services Elevation of Privilege Vulnerability

CRITICAL 97KEV

Active Directory Domain Services Elevation of Privilege Vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.835 Published 2022-05-10 Fixed in 10.0.17763.4252, 10.0.18363.2274 +8 CWE-295

TI-2021-17496 CVE-2021-40444 · GHSA-2h32-fhf6-xhh5

Microsoft MSHTML Remote Code Execution Vulnerability

CRITICAL 97KEV

Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.9784 Published 2021-09-15 Fixed in 10.0.10240.19060, 10.0.14393.4651 +10 CWE-22

TI-2021-13550 CVE-2021-34527 · GHSA-75f9-mm5v-2rgm

Windows Print Spooler Remote Code Execution Vulnerability

CRITICAL 97KEV

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.99792 Published 2021-07-02 Fixed in 10.0.10240.18969, 10.0.14393.4470 +11

TI-2021-13480 CVE-2021-34448 · GHSA-6545-45rg-p2vp

Scripting Engine Memory Corruption Vulnerability

CRITICAL 97KEV

Scripting Engine Memory Corruption Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.40062 Published 2021-07-16 Fixed in 10.0.10240.19003, 10.0.14393.4530 +8 CWE-787

TI-2021-13116 CVE-2021-33742 · GHSA-gf47-3hhj-gv96

Windows MSHTML Platform Remote Code Execution Vulnerability

CRITICAL 97KEV

Windows MSHTML Platform Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.59407 Published 2021-06-08 Fixed in 10.0.17763.1999, 10.0.18363.1621 +11 CWE-787

TI-2020-00989 CVE-2020-1020 · GHSA-jvx5-6596-c2vj

Out-of-bounds write in Microsoft Windows

CRITICAL 97KEV

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems exce…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.65037 Published 2020-04-15 Fixed CWE-787

TI-2019-00654 CVE-2019-0903 · GHSA-cmq3-fp3c-p3qr

A remote code execution vulnerability exists in the way that the Windows Graphics Device…

CRITICAL 97KEV

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.21713 Published 2019-05-16 No fix listed

TI-2018-00765 CVE-2018-0824 · GHSA-6w8g-777w-9mcc

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails…

CRITICAL 97KEV

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.73037 Published 2018-05-09 No fix listed CWE-502

TI-2017-06002 CVE-2017-8464 · GHSA-v5x6-r6hp-xgpc

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8…

CRITICAL 97KEV

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows loc…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.90026 Published 2017-06-15 No fix listed

TI-2016-06245 CVE-2016-7256 · GHSA-cx4j-72f6-rmxr

atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008…

CRITICAL 97KEV

atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.64591 Published 2016-11-10 No fix listed

TI-2023-13752 CVE-2023-29360 · GHSA-mfpj-f925-v5gx

Microsoft Streaming Service Elevation of Privilege Vulnerability

CRITICAL 96KEV

Microsoft Streaming Service Elevation of Privilege Vulnerability

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.2162 Published 2023-06-13 Fixed in 10.0.17763.4499, 10.0.20348.1787 +5 CWE-822

Open these records in search →

Critical	2330
High	10410
Medium	5035
Low	270
No CVSS	1