Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2026-73128 Microsoft Windows Command Injection Vulnerability Priority CRITICAL 97KEV 2026-10-13TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability Priority CRITICAL 97KEV 2026-09-25TI-2026-56567 Microsoft Windows Link Following Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability Priority CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records
Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

2367 records in Windows 7 · all components

TI-2019-00485 CVE-2019-0708 · GHSA-fq64-gmq7-jjvg

Use after free in Microsoft Windows

Priority CRITICAL 100KEV

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, a…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2019-05-16 No fix listed CWE-416
TI-2017-06077 CVE-2017-8543 · GHSA-w5g9-xvwm-4qf8

Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista…

Priority CRITICAL 100KEV

Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 G…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.74164 Published 2017-06-15 No fix listed CWE-281
TI-2015-01465 CVE-2015-1635 · GHSA-p8wc-6g47-vh8j

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1…

Priority CRITICAL 100KEV

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remo…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2015-04-14 No fix listed CWE-94
TI-2021-17496 CVE-2021-40444 · GHSA-2h32-fhf6-xhh5

Microsoft MSHTML Remote Code Execution Vulnerability

Priority CRITICAL 97KEV

Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.9784 Published 2021-09-15 Fixed in 10.0.10240.19060, 10.0.14393.4651 +10 CWE-22
TI-2021-13480 CVE-2021-34448 · GHSA-6545-45rg-p2vp

Scripting Engine Memory Corruption Vulnerability

Priority CRITICAL 97KEV

Scripting Engine Memory Corruption Vulnerability

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.40062 Published 2021-07-16 Fixed in 10.0.10240.19003, 10.0.14393.4530 +8 CWE-787
TI-2020-00989 CVE-2020-1020 · GHSA-jvx5-6596-c2vj

Out-of-bounds write in Microsoft Windows

Priority CRITICAL 97KEV

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems exce…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.65037 Published 2020-04-15 Fixed CWE-787
TI-2018-00765 CVE-2018-0824 · GHSA-6w8g-777w-9mcc

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails…

Priority CRITICAL 97KEV

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.73037 Published 2018-05-09 No fix listed CWE-502
TI-2017-06002 CVE-2017-8464 · GHSA-v5x6-r6hp-xgpc

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8…

Priority CRITICAL 97KEV

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows loc…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.90026 Published 2017-06-15 No fix listed
TI-2016-06245 CVE-2016-7256 · GHSA-cx4j-72f6-rmxr

atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008…

Priority CRITICAL 97KEV

atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.64591 Published 2016-11-10 No fix listed
TI-2015-02132 CVE-2015-2426 · GHSA-7w6v-23gr-722w

Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft…

Priority CRITICAL 97KEV

Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Wind…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.86576 Published 2015-07-20 No fix listed CWE-124
TI-2015-02077 CVE-2015-2360 · GHSA-259r-5hvg-4f6x

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2…

Priority CRITICAL 97KEV

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Wi…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.1484 Published 2015-06-10 No fix listed CWE-416
TI-2014-05208 CVE-2014-6332 · GHSA-w64p-pvrc-c5w3

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows…

Priority CRITICAL 97KEV

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.94918 Published 2014-11-11 No fix listed CWE-119
TI-2014-05200 CVE-2014-6324 · GHSA-j28h-3q4c-49h2

The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows…

Priority CRITICAL 97KEV

The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows re…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.87335 Published 2014-11-18 No fix listed
TI-2014-03387 CVE-2014-4148 · GHSA-4wxx-xmrx-3xq9

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista…

Priority CRITICAL 97KEV

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Go…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.5985 Published 2014-10-15 No fix listed CWE-94
TI-2013-03421 CVE-2013-3918 · GHSA-7627-vgq8-rcjv

The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows…

Priority CRITICAL 97KEV

The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.73693 Published 2013-11-12 No fix listed CWE-787
TI-2011-03009 CVE-2011-3402 · GHSA-qv6f-65c9-qp9p

Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the…

Priority CRITICAL 97KEV

Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.78138 Published 2011-11-04 No fix listed
TI-2018-06276 CVE-2018-8639 · GHSA-93mm-g479-2cx4

An elevation of privilege vulnerability exists in Windows when the Win32k component fails…

Priority CRITICAL 96KEV

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 20…

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.22349 Published 2018-12-12 No fix listed CWE-404
TI-2015-02238 CVE-2015-2546 · GHSA-5c8h-c2cj-96mm

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2…

Priority CRITICAL 95KEV

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local user…

CVSS 3.1HIGH 8.2 Local Low privileges User interaction EPSS 0.10107 Published 2015-09-09 No fix listed CWE-119
TI-2014-01417 CVE-2014-1812 · GHSA-cm2m-vv5g-hpc2

The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2…

Priority CRITICAL 95KEV

The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of pass…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.65117 Published 2014-05-14 No fix listed CWE-522
TI-2013-03406 CVE-2013-3900 · GHSA-8cj2-jg77-qj2p

WinVerifyTrust Signature Validation Vulnerability

Priority CRITICAL 95KEV

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in a…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.44647 Published 2013-12-11 No fix listed CWE-347
Load more
Open these records in search →