Microsoft
Page 31 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3919 | High | 8.8 | 2026-03-11 | Use after free in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2026-3918 | High | 8.8 | 2026-03-11 | Use after free in WebMCP in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-3917 | High | 8.8 | 2026-03-11 | Use after free in Agents in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-3916 | Critical | 9.6 | 2026-03-11 | Out of bounds read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML p… |
CVE-2026-3915 | High | 8.8 | 2026-03-11 | Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2026-3914 | High | 8.8 | 2026-03-11 | Integer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-3913 | High | 8.8 | 2026-03-11 | Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-27272 | High | 7.8 | 2026-03-10 | Illustrator versions 29.8.4, 30.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context… |
CVE-2026-27271 | High | 7.8 | 2026-03-10 | Illustrator versions 29.8.4, 30.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-27270 | Medium | 5.5 | 2026-03-10 | Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverag… |
CVE-2026-27268 | Medium | 5.5 | 2026-03-10 | Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverag… |
CVE-2026-27267 | High | 7.8 | 2026-03-10 | Illustrator versions 29.8.4, 30.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2026-21362 | High | 7.8 | 2026-03-10 | Illustrator versions 29.8.4, 30.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context… |
CVE-2026-21333 | High | 8.6 | 2026-03-10 | Illustrator versions 29.8.4, 30.1 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in th… |
CVE-2026-27278 | High | 7.8 | 2026-03-10 | Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2026-27221 | Medium | 5.5 | 2026-03-10 | Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by an Improper Certificate Validation vulnerability that could result… |
CVE-2026-27220 | High | 7.8 | 2026-03-10 | Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2026-2713 | High | 7.4 | 2026-03-10 | IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rapport could allow a local attacker to execute arbitrary code on the system, caused by DLL uncontroll… |
CVE-2026-26123 | Medium | 5.5 | 2026-03-10 | Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally. |
CVE-2026-27279 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-27277 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-27276 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-27275 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-27274 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-27273 | High | 7.8 | 2026-03-10 | Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-27269 | High | 7.8 | 2026-03-10 | Premiere Pro versions 25.5 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the e… |
CVE-2026-3315 | High | 7.8 | 2026-03-10 | Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Vis… |
CVE-2026-26148 | High | 8.1 | 2026-03-10 | External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-26144 | High | 7.5 | 2026-03-10 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose info… |
CVE-2026-26141 | High | 7.8 | 2026-03-10 | Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally. |
CVE-2026-26134 | High | 7.8 | 2026-03-10 | Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally. |
CVE-2026-26132 | High | 7.8 | 2026-03-10 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-26131 | High | 7.8 | 2026-03-10 | Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2026-26130 | High | 7.5 | 2026-03-10 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-26128 | High | 7.8 | 2026-03-10 | Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-26127 | High | 7.5 | 2026-03-10 | Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-26121 | High | 7.5 | 2026-03-10 | Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-26118 | High | 8.8 | 2026-03-10 | Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-26117 | High | 7.8 | 2026-03-10 | Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2026-26116 | High | 8.8 | 2026-03-10 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2026-26115 | High | 8.8 | 2026-03-10 | Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-26114 | High | 8.8 | 2026-03-10 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-26113 | High | 8.4 | 2026-03-10 | Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-26112 | High | 7.8 | 2026-03-10 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-26111 | High | 8.0 | 2026-03-10 | Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2026-26110 | High | 8.4 | 2026-03-10 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-26109 | High | 8.4 | 2026-03-10 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-26108 | High | 7.8 | 2026-03-10 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-26107 | High | 7.8 | 2026-03-10 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-26106 | High | 8.8 | 2026-03-10 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-26105 | High | 8.1 | 2026-03-10 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-25190 | High | 7.8 | 2026-03-10 | Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally. |
CVE-2026-25189 | High | 7.8 | 2026-03-10 | Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2026-25188 | High | 8.8 | 2026-03-10 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to elevate privileges over an adjacent network. |
CVE-2026-25187 | High | 7.8 | 2026-03-10 | Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally. |
CVE-2026-25186 | Medium | 5.5 | 2026-03-10 | Exposure of sensitive information to an unauthorized actor in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to disclose inf… |
CVE-2026-25185 | Medium | 5.3 | 2026-03-10 | Exposure of sensitive information to an unauthorized actor in Windows Shell Link Processing allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-25181 | High | 7.5 | 2026-03-10 | Out-of-bounds read in Windows GDI+ allows an unauthorized attacker to disclose information over a network. |
CVE-2026-25180 | Medium | 5.5 | 2026-03-10 | Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally. |
CVE-2026-25179 | High | 7.0 | 2026-03-10 | Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-25178 | High | 7.0 | 2026-03-10 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-25177 | High | 8.8 | 2026-03-10 | Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a netw… |
CVE-2026-25176 | High | 7.8 | 2026-03-10 | Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-25175 | High | 7.8 | 2026-03-10 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
CVE-2026-25174 | High | 7.8 | 2026-03-10 | Out-of-bounds read in Windows Extensible File Allocation allows an authorized attacker to elevate privileges locally. |
CVE-2026-25173 | High | 8.0 | 2026-03-10 | Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2026-25172 | High | 8.0 | 2026-03-10 | Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2026-25171 | High | 7.0 | 2026-03-10 | Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
CVE-2026-25170 | High | 7.0 | 2026-03-10 | Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2026-25169 | Medium | 6.2 | 2026-03-10 | Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally. |
CVE-2026-25168 | Medium | 6.2 | 2026-03-10 | Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally. |
CVE-2026-25167 | High | 7.4 | 2026-03-10 | Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-25166 | High | 7.8 | 2026-03-10 | Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally. |
CVE-2026-25165 | High | 7.8 | 2026-03-10 | Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally. |
CVE-2026-24297 | Medium | 6.5 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kerberos allows an unauthorized attacker to bypass a sec… |
CVE-2026-24296 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker… |
CVE-2026-24295 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker… |
CVE-2026-24294 | High | 7.8 | 2026-03-10 | Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-24293 | High | 7.8 | 2026-03-10 | Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-24292 | High | 7.8 | 2026-03-10 | Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. |
CVE-2026-24291 | High | 7.8 | 2026-03-10 | Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privilege… |
CVE-2026-24290 | High | 7.8 | 2026-03-10 | Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-24289 | High | 7.8 | 2026-03-10 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-24288 | Medium | 6.8 | 2026-03-10 | Heap-based buffer overflow in Windows Mobile Broadband allows an unauthorized attacker to execute code with a physical attack. |
CVE-2026-24287 | High | 7.8 | 2026-03-10 | External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-24285 | High | 7.0 | 2026-03-10 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-24283 | High | 8.8 | 2026-03-10 | Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-24282 | Medium | 5.5 | 2026-03-10 | Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally. |
CVE-2026-23674 | High | 7.5 | 2026-03-10 | Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-23673 | High | 7.8 | 2026-03-10 | Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-23672 | High | 7.8 | 2026-03-10 | Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability |
CVE-2026-23671 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized att… |
CVE-2026-23669 | High | 8.8 | 2026-03-10 | Use after free in RPC Runtime allows an authorized attacker to execute code over a network. |
CVE-2026-23668 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2026-23667 | High | 7.0 | 2026-03-10 | Use after free in Broadcast DVR allows an authorized attacker to elevate privileges locally. |
CVE-2026-23665 | High | 7.8 | 2026-03-10 | Heap-based buffer overflow in Azure Linux Virtual Machines allows an authorized attacker to elevate privileges locally. |
CVE-2026-23664 | High | 7.5 | 2026-03-10 | Improper restriction of communication channel to intended endpoints in Azure IoT Explorer allows an unauthorized attacker to disclose information over a networ… |
CVE-2026-23662 | High | 7.5 | 2026-03-10 | Missing authentication for critical function in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network. |
CVE-2026-23661 | High | 7.5 | 2026-03-10 | Cleartext transmission of sensitive information in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network. |
CVE-2026-23660 | High | 7.8 | 2026-03-10 | Improper access control in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally. |