Microsoft
18610 CVEs across 2497 Microsoft products. Browse Microsoft vulnerabilities, severities, and proof-of-concept exploits.
Microsoft products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-69414 | High | 7.8 | 2026-08-14 | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak &quo… |
CVE-2026-50523 | High | 7.8 | 2026-08-14 | Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code local… |
CVE-2026-72970 | High | 8.3 | 2026-08-14 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-73299 | Critical | 10.0 | 2026-08-12 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty te… |
CVE-2026-73298 | | 2026-08-12 | The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving cont… | |
CVE-2026-73297 | | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did no… | |
CVE-2026-73296 | Critical | 9.4 | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mo… |
CVE-2026-70339 | Medium | 5.4 | 2026-08-11 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-65680 | Medium | 6.7 | 2026-08-11 | Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally. |
CVE-2026-48447 | High | 7.7 | 2026-08-11 | Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An… |
CVE-2026-48441 | High | 8.6 | 2026-08-11 | Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary f… |
CVE-2026-48410 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48409 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48408 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48407 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48406 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48405 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48404 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48397 | High | 8.6 | 2026-08-11 | Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current… |
CVE-2026-47940 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-72971 | Medium | 5.5 | 2026-08-11 | Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to p… |
CVE-2026-71331 | High | 8.1 | 2026-08-11 | Integer overflow or wraparound in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code ove… |
CVE-2026-70355 | High | 7.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate pr… |
CVE-2026-70354 | High | 7.8 | 2026-08-11 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. |
CVE-2026-70348 | Medium | 5.5 | 2026-08-11 | Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally. |
CVE-2026-70347 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70346 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70345 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70344 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70340 | High | 8.1 | 2026-08-11 | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70338 | High | 7.8 | 2026-08-11 | Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-70337 | High | 8.8 | 2026-08-11 | Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network. |
CVE-2026-70336 | High | 8.8 | 2026-08-11 | Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-70335 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized atta… |
CVE-2026-70330 | Medium | 6.7 | 2026-08-11 | Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-70329 | High | 8.8 | 2026-08-11 | Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
CVE-2026-70328 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70327 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70326 | High | 8.8 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70325 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70324 | High | 8.8 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70323 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70322 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70321 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-70320 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70319 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-70318 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-70317 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70316 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70315 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70314 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70313 | High | 7.8 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70312 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70311 | High | 7.8 | 2026-08-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-70310 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-70307 | High | 7.0 | 2026-08-11 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-70306 | Critical | 9.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-70304 | Medium | 6.7 | 2026-08-11 | Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-70130 | High | 8.4 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-69320 | High | 8.8 | 2026-08-11 | Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute cod… |
CVE-2026-69306 | High | 8.2 | 2026-08-11 | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-69278 | High | 7.8 | 2026-08-11 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-68821 | High | 7.3 | 2026-08-11 | Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-68820 | High | 7.0 | 2026-08-11 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-68819 | Medium | 5.9 | 2026-08-11 | Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network. |
CVE-2026-68817 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68816 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68815 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68814 | High | 7.8 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68813 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68812 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68811 | High | 7.8 | 2026-08-11 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68810 | High | 7.8 | 2026-08-11 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68809 | Medium | 5.5 | 2026-08-11 | Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-68808 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68807 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68806 | High | 7.8 | 2026-08-11 | Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68805 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68804 | High | 7.8 | 2026-08-11 | Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68803 | High | 7.8 | 2026-08-11 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68802 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68801 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68800 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68799 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68798 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68797 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68796 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68795 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68794 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68793 | High | 7.8 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68792 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges loc… |
CVE-2026-66810 | Medium | 5.5 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-66809 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-66808 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-66807 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-66806 | Medium | 5.5 | 2026-08-11 | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-66805 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-66804 | High | 7.8 | 2026-08-11 | Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-66802 | High | 8.1 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Azure Attestation service and Device Health Attestatio… |
CVE-2026-66799 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally. |