Microsoft
Page 33 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21516 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthorized attacker to execute code over a ne… |
CVE-2026-21514 | High | 7.8 | 2026-02-10 | Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-21513 | High | 8.8 | 2026-02-10 | Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-21512 | Medium | 6.5 | 2026-02-10 | Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network. |
CVE-2026-21511 | High | 7.5 | 2026-02-10 | Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-21510 | High | 8.8 | 2026-02-10 | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-21508 | High | 7.0 | 2026-02-10 | Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally. |
CVE-2026-21358 | Medium | 5.5 | 2026-02-10 | InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in application denial-of-servic… |
CVE-2026-21357 | High | 7.8 | 2026-02-10 | InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-21351 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21350 | Medium | 5.5 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker… |
CVE-2026-21332 | Medium | 5.5 | 2026-02-10 | InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21330 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arb… |
CVE-2026-21329 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21328 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21327 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21326 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21325 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-21324 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-21323 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21322 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-21321 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-21320 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21319 | Medium | 5.5 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this… |
CVE-2026-21318 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21261 | Medium | 5.5 | 2026-02-10 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-21260 | High | 7.5 | 2026-02-10 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-21259 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-21258 | Medium | 5.5 | 2026-02-10 | Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-21257 | High | 8.0 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevat… |
CVE-2026-21256 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to exec… |
CVE-2026-21255 | High | 8.8 | 2026-02-10 | Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally. |
CVE-2026-21253 | High | 7.0 | 2026-02-10 | Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-21251 | High | 7.8 | 2026-02-10 | Use after free in Windows Cluster Client Failover allows an authorized attacker to elevate privileges locally. |
CVE-2026-21250 | High | 7.8 | 2026-02-10 | Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. |
CVE-2026-21249 | Low | 3.3 | 2026-02-10 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing locally. |
CVE-2026-21248 | High | 7.3 | 2026-02-10 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-21247 | High | 7.3 | 2026-02-10 | Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-21246 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-21245 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-21244 | High | 7.3 | 2026-02-10 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-21243 | High | 7.5 | 2026-02-10 | Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2026-21242 | High | 7.0 | 2026-02-10 | Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
CVE-2026-21241 | High | 7.0 | 2026-02-10 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-21240 | High | 7.8 | 2026-02-10 | Time-of-check time-of-use (toctou) race condition in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. |
CVE-2026-21239 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-21238 | High | 7.8 | 2026-02-10 | Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-21237 | High | 7.0 | 2026-02-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to ele… |
CVE-2026-21236 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-21235 | High | 7.3 | 2026-02-10 | Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-21234 | High | 7.0 | 2026-02-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized… |
CVE-2026-21232 | High | 7.8 | 2026-02-10 | Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. |
CVE-2026-21231 | High | 7.8 | 2026-02-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileg… |
CVE-2026-21229 | High | 8.0 | 2026-02-10 | Improper input validation in Power BI allows an authorized attacker to execute code over a network. |
CVE-2026-21228 | High | 8.1 | 2026-02-10 | Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network. |
CVE-2026-21222 | Medium | 5.5 | 2026-02-10 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-21218 | High | 7.5 | 2026-02-10 | Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-20846 | High | 7.5 | 2026-02-10 | Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network. |
CVE-2026-20841 | High | 7.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code loca… |
CVE-2026-25592 | Critical | 9.9 | 2026-02-06 | Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to 1.71.0, an Arbitrary File Write vulnerability has… |
CVE-2026-1769 | Medium | 5.3 | 2026-02-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xerox CentreWare on Windows allows Stored XSS.This… |
CVE-2026-24302 | High | 8.6 | 2026-02-05 | Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-24300 | Critical | 9.8 | 2026-02-05 | Azure Front Door Elevation of Privilege Vulnerability |
CVE-2026-21532 | High | 8.2 | 2026-02-05 | Azure Function Information Disclosure Vulnerability |
CVE-2026-0391 | Medium | 6.5 | 2026-02-05 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-1862 | High | 8.8 | 2026-02-03 | Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2026-1861 | High | 8.8 | 2026-02-03 | Heap buffer overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2025-63372 | Medium | 4.3 | 2026-02-03 | Articentgroup Zip Rar Extractor Tool 1.345.93.0 is vulnerable to Directory Traversal. The vulnerability resides in the ZIP file processing component, specifica… |
CVE-2026-25228 | Medium | 5.0 | 2026-02-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationDa… |
CVE-2026-24413 | Medium | 5.5 | 2026-01-29 | Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropr… |
CVE-2026-23571 | Medium | 6.8 | 2026-01-29 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction. Improper… |
CVE-2026-23570 | Medium | 6.5 | 2026-01-29 | A missing validation of a user-controlled value in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version… |
CVE-2026-23569 | Medium | 6.5 | 2026-01-29 | An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Win… |
CVE-2026-23568 | Medium | 5.4 | 2026-01-29 | An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Win… |
CVE-2026-23567 | Medium | 6.5 | 2026-01-29 | An integer underflow in the UDP command handler of the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version… |
CVE-2026-23566 | Medium | 6.5 | 2026-01-29 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker… |
CVE-2026-23565 | Medium | 6.5 | 2026-01-29 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker… |
CVE-2026-23564 | Medium | 6.5 | 2026-01-29 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker… |
CVE-2026-23563 | Medium | 5.7 | 2026-01-29 | Improper Link Resolution Before File Access (invoked by 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction) in TeamViewer DEX - 1E Client before version 26.1… |
CVE-2026-24888 | Medium | 6.5 | 2026-01-28 | Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function… |
CVE-2026-23889 | Medium | 6.5 | 2026-01-26 | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outsi… |
CVE-2026-21509 | High | 7.8 | 2026-01-26 | Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-24304 | Critical | 9.9 | 2026-01-23 | Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network. |
CVE-2026-24307 | Critical | 9.3 | 2026-01-22 | Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2026-24306 | Critical | 9.8 | 2026-01-22 | Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-24305 | Critical | 9.3 | 2026-01-22 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2026-21524 | High | 7.4 | 2026-01-22 | Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network. |
CVE-2026-21521 | High | 7.4 | 2026-01-22 | Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2026-21520 | High | 7.5 | 2026-01-22 | Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network at… |
CVE-2026-21264 | Critical | 9.3 | 2026-01-22 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing o… |
CVE-2026-21227 | High | 8.2 | 2026-01-22 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a… |
CVE-2025-58744 | High | 7.5 | 2026-01-20 | Use of Default Credentials, Hard-coded Credentials vulnerability in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows decryption of do… |
CVE-2025-58743 | High | 7.5 | 2026-01-20 | Use of a Broken or Risky Cryptographic Algorithm (DES) vulnerability in the Password class in C2SConnections.dll in Milner ImageDirector Capture on Windows a… |
CVE-2025-58742 | Medium | 5.9 | 2026-01-20 | Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in Mi… |
CVE-2025-58740 | Medium | 5.5 | 2026-01-20 | The use of a hard-coded encryption key in calls to the Password function in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows a local att… |
CVE-2025-33231 | Medium | 6.7 | 2026-01-20 | NVIDIA Nsight Systems for Windows contains a vulnerability in the application’s DLL loading mechanism where an attacker could cause an uncontrolled search path… |
CVE-2025-33229 | High | 7.3 | 2026-01-20 | NVIDIA Nsight Visual Studio for Windows contains a vulnerability in Nsight Monitor where an attacker can execute arbitrary code with the same privileges as the… |
CVE-2026-0908 | High | 8.8 | 2026-01-20 | Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2026-0907 | Critical | 9.8 | 2026-01-20 | Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2026-0906 | Critical | 9.8 | 2026-01-20 | Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |