Microsoft
Page 24 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40398 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. |
CVE-2026-40397 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-40382 | High | 7.8 | 2026-05-12 | Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-40381 | High | 7.8 | 2026-05-12 | Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2026-40380 | Medium | 6.2 | 2026-05-12 | Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack. |
CVE-2026-40379 | Critical | 9.3 | 2026-05-12 | Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-40377 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-40374 | Medium | 6.5 | 2026-05-12 | Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network. |
CVE-2026-40370 | High | 8.8 | 2026-05-12 | External control of file name or path in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-40369 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-40368 | High | 8.0 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-40367 | High | 8.4 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-40366 | High | 8.4 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-40365 | High | 8.8 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-40364 | High | 8.4 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-40363 | High | 8.4 | 2026-05-12 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-40362 | High | 7.8 | 2026-05-12 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-40361 | High | 8.4 | 2026-05-12 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-40360 | High | 7.8 | 2026-05-12 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-40359 | High | 7.8 | 2026-05-12 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-40358 | High | 8.4 | 2026-05-12 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-40357 | High | 8.8 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-35440 | Medium | 5.5 | 2026-05-12 | Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-35439 | High | 8.8 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-35438 | High | 8.3 | 2026-05-12 | Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network. |
CVE-2026-35436 | High | 8.8 | 2026-05-12 | Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. |
CVE-2026-35433 | High | 7.3 | 2026-05-12 | Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-35429 | Medium | 4.3 | 2026-05-12 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-35424 | High | 7.5 | 2026-05-12 | Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a netwo… |
CVE-2026-35423 | Medium | 5.4 | 2026-05-12 | Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-35422 | Medium | 6.5 | 2026-05-12 | Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network. |
CVE-2026-35421 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally. |
CVE-2026-35420 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-35419 | Medium | 5.5 | 2026-05-12 | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
CVE-2026-35418 | High | 7.8 | 2026-05-12 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-35417 | High | 7.8 | 2026-05-12 | Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2026-35416 | High | 7.0 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile… |
CVE-2026-35415 | High | 7.8 | 2026-05-12 | Integer overflow or wraparound in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
CVE-2026-34687 | High | 7.8 | 2026-05-12 | Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-34663 | Medium | 5.5 | 2026-05-12 | Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacke… |
CVE-2026-34662 | Medium | 5.5 | 2026-05-12 | Illustrator versions 29.8.6, 30.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. A… |
CVE-2026-34661 | High | 7.8 | 2026-05-12 | Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context… |
CVE-2026-34638 | High | 7.8 | 2026-05-12 | Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-34637 | High | 7.8 | 2026-05-12 | Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-34636 | High | 7.8 | 2026-05-12 | Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-34351 | High | 7.8 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileg… |
CVE-2026-34350 | Medium | 6.5 | 2026-05-12 | Null pointer dereference in Windows Storport Miniport Driver allows an unauthorized attacker to deny service over a network. |
CVE-2026-34347 | High | 7.0 | 2026-05-12 | Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2026-34345 | High | 7.0 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile… |
CVE-2026-34344 | High | 7.8 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile… |
CVE-2026-34343 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2026-34342 | High | 7.0 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker t… |
CVE-2026-34341 | High | 7.0 | 2026-05-12 | Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally. |
CVE-2026-34340 | High | 7.0 | 2026-05-12 | Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-34339 | Medium | 5.5 | 2026-05-12 | Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service locally. |
CVE-2026-34338 | High | 7.8 | 2026-05-12 | Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-34337 | High | 7.8 | 2026-05-12 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-34336 | High | 7.8 | 2026-05-12 | Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2026-34334 | High | 7.8 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileg… |
CVE-2026-34333 | High | 7.8 | 2026-05-12 | Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2026-34332 | High | 8.0 | 2026-05-12 | Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network. |
CVE-2026-34331 | High | 7.0 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
CVE-2026-34330 | High | 7.8 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
CVE-2026-34329 | High | 8.8 | 2026-05-12 | Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2026-33841 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-33840 | High | 7.8 | 2026-05-12 | Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
CVE-2026-33839 | High | 7.0 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
CVE-2026-33838 | High | 7.8 | 2026-05-12 | Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally. |
CVE-2026-33837 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
CVE-2026-33835 | High | 7.8 | 2026-05-12 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-33834 | High | 7.8 | 2026-05-12 | Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-33833 | High | 8.2 | 2026-05-12 | Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to… |
CVE-2026-33821 | High | 7.7 | 2026-05-12 | Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network. |
CVE-2026-33117 | Critical | 9.1 | 2026-05-12 | The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison wa… |
CVE-2026-33112 | High | 8.8 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-33110 | High | 8.8 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-32209 | Medium | 4.4 | 2026-05-12 | Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally. |
CVE-2026-32204 | High | 7.8 | 2026-05-12 | External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. |
CVE-2026-32185 | Medium | 5.5 | 2026-05-12 | Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally. |
CVE-2026-32177 | High | 7.3 | 2026-05-12 | Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-32175 | Medium | 4.3 | 2026-05-12 | A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could wri… |
CVE-2026-32170 | Medium | 6.7 | 2026-05-12 | Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. |
CVE-2026-32161 | High | 7.5 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attac… |
CVE-2026-21530 | Medium | 6.7 | 2026-05-12 | Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. |
CVE-2026-7432 | High | 7.8 | 2026-05-12 | A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM |
CVE-2026-7431 | Medium | 4.4 | 2026-05-12 | An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sen… |
CVE-2026-42826 | Critical | 10.0 | 2026-05-07 | Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network. |
CVE-2026-41105 | High | 8.1 | 2026-05-07 | Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network. |
CVE-2026-35435 | High | 8.6 | 2026-05-07 | Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-35428 | Critical | 9.6 | 2026-05-07 | Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing ov… |
CVE-2026-34327 | High | 8.2 | 2026-05-07 | Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-33844 | Critical | 9.0 | 2026-05-07 | Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. |
CVE-2026-33823 | Critical | 9.6 | 2026-05-07 | Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network. |
CVE-2026-33111 | High | 7.5 | 2026-05-07 | Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclos… |
CVE-2026-33109 | Critical | 9.9 | 2026-05-07 | Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. |
CVE-2026-32207 | High | 8.8 | 2026-05-07 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoof… |
CVE-2026-26164 | High | 7.5 | 2026-05-07 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information ove… |
CVE-2026-26129 | High | 7.5 | 2026-05-07 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information ove… |
CVE-2026-8022 | Low | 3.1 | 2026-05-06 | Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2026-8021 | Medium | 4.2 | 2026-05-06 | Script injection in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbit… |