Microsoft
Page 36 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13663 | Medium | 6.7 | 2025-12-11 | Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation directory if the tar… |
CVE-2025-64669 | High | 7.8 | 2025-12-11 | Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally. |
CVE-2025-59803 | Medium | 5.3 | 2025-12-11 | Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. An attacker can embed triggers (e.g., JavaScript) in a PDF document that exe… |
CVE-2025-59802 | High | 7.5 | 2025-12-11 | Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state property of an OCG is… |
CVE-2025-55314 | High | 7.8 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the a… |
CVE-2025-55313 | High | 7.8 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. They allow potential arbitrary code execution when pr… |
CVE-2025-55312 | High | 7.8 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the application… |
CVE-2025-55311 | Medium | 6.5 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can use JavaScript to alter annotation… |
CVE-2025-55310 | High | 7.3 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. An attacker able to alter or replace the static HTML… |
CVE-2025-55309 | Medium | 6.7 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScript that attaches an… |
CVE-2025-55308 | Medium | 6.7 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. A crafted PDF containing JavaScript that calls closeDoc() while… |
CVE-2025-55307 | Low | 3.3 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to… |
CVE-2025-46266 | Medium | 4.3 | 2025-12-11 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious a… |
CVE-2025-44016 | High | 8.8 | 2025-12-11 | A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious a… |
CVE-2025-12687 | Medium | 6.5 | 2025-12-11 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious a… |
CVE-2025-64899 | High | 7.8 | 2025-12-09 | Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an out-of-bounds read vulnerability wh… |
CVE-2025-64787 | Low | 3.3 | 2025-12-09 | Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptograp… |
CVE-2025-64786 | Low | 3.3 | 2025-12-09 | Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptograp… |
CVE-2025-64785 | High | 7.8 | 2025-12-09 | Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Untrusted Search Path vulnerability… |
CVE-2025-64894 | Medium | 5.5 | 2025-12-09 | DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacke… |
CVE-2025-64893 | High | 7.1 | 2025-12-09 | DNG SDK versions 1.7.0 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure or application denial of service. An… |
CVE-2025-64784 | High | 7.1 | 2025-12-09 | DNG SDK versions 1.7.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure or application denial of servi… |
CVE-2025-64783 | High | 7.8 | 2025-12-09 | DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context… |
CVE-2025-64680 | High | 7.8 | 2025-12-09 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-64679 | High | 7.8 | 2025-12-09 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-64678 | High | 8.8 | 2025-12-09 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-64673 | High | 7.8 | 2025-12-09 | Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-64672 | High | 8.8 | 2025-12-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2025-64671 | High | 8.4 | 2025-12-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally. |
CVE-2025-64670 | Medium | 6.5 | 2025-12-09 | Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information over a network. |
CVE-2025-64667 | Medium | 5.3 | 2025-12-09 | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-64666 | High | 7.5 | 2025-12-09 | Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-64661 | High | 7.8 | 2025-12-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privilege… |
CVE-2025-64658 | High | 7.5 | 2025-12-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privilege… |
CVE-2025-62573 | High | 7.0 | 2025-12-09 | Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. |
CVE-2025-62572 | High | 7.8 | 2025-12-09 | Out-of-bounds read in Application Information Services allows an authorized attacker to elevate privileges locally. |
CVE-2025-62571 | High | 7.8 | 2025-12-09 | Improper input validation in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-62570 | High | 7.1 | 2025-12-09 | Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally. |
CVE-2025-62569 | High | 7.0 | 2025-12-09 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62567 | Medium | 5.3 | 2025-12-09 | Integer underflow (wrap or wraparound) in Windows Hyper-V allows an authorized attacker to deny service over a network. |
CVE-2025-62565 | High | 7.3 | 2025-12-09 | Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. |
CVE-2025-62564 | High | 7.8 | 2025-12-09 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62563 | High | 7.8 | 2025-12-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62562 | High | 7.8 | 2025-12-09 | Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally. |
CVE-2025-62561 | High | 7.8 | 2025-12-09 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62560 | High | 7.8 | 2025-12-09 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62559 | High | 7.8 | 2025-12-09 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-62558 | High | 7.8 | 2025-12-09 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-62557 | High | 8.4 | 2025-12-09 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-62556 | High | 7.8 | 2025-12-09 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62555 | High | 7.0 | 2025-12-09 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-62554 | High | 8.4 | 2025-12-09 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-62553 | High | 7.8 | 2025-12-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62552 | High | 7.8 | 2025-12-09 | Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally. |
CVE-2025-62550 | High | 8.8 | 2025-12-09 | Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network. |
CVE-2025-62549 | High | 8.8 | 2025-12-09 | Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-62474 | High | 7.8 | 2025-12-09 | Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-62473 | Medium | 6.5 | 2025-12-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-62472 | High | 7.8 | 2025-12-09 | Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-62470 | High | 7.8 | 2025-12-09 | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62469 | High | 7.0 | 2025-12-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to… |
CVE-2025-62468 | Medium | 5.5 | 2025-12-09 | Out-of-bounds read in Windows Defender Firewall Service allows an authorized attacker to disclose information locally. |
CVE-2025-62467 | High | 7.8 | 2025-12-09 | Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62466 | High | 7.8 | 2025-12-09 | Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-62465 | Medium | 6.5 | 2025-12-09 | Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally. |
CVE-2025-62464 | High | 7.8 | 2025-12-09 | Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62463 | Medium | 6.5 | 2025-12-09 | Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally. |
CVE-2025-62462 | High | 7.8 | 2025-12-09 | Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62461 | High | 7.8 | 2025-12-09 | Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62458 | High | 7.8 | 2025-12-09 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2025-62457 | High | 7.8 | 2025-12-09 | Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62456 | High | 8.8 | 2025-12-09 | Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network. |
CVE-2025-62455 | High | 7.8 | 2025-12-09 | Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally. |
CVE-2025-62454 | High | 7.8 | 2025-12-09 | Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62221 | High | 7.8 | 2025-12-09 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-59517 | High | 7.8 | 2025-12-09 | Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-59516 | High | 7.8 | 2025-12-09 | Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-55233 | High | 7.8 | 2025-12-09 | Out-of-bounds read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-54100 | High | 7.8 | 2025-12-09 | Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code local… |
CVE-2025-62223 | Medium | 4.3 | 2025-12-05 | User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-13992 | Medium | 4.7 | 2025-12-03 | Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site isolation via a cra… |
CVE-2025-20386 | High | 8.0 | 2025-12-03 | In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in inco… |
CVE-2025-13751 | Medium | 5.5 | 2025-12-03 | Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the… |
CVE-2025-66476 | High | 7.8 | 2025-12-02 | Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute maliciou… |
CVE-2025-64298 | High | 8.4 | 2025-12-02 | NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clie… |
CVE-2025-13721 | High | 7.5 | 2025-12-02 | Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security… |
CVE-2025-13720 | High | 8.8 | 2025-12-02 | Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corru… |
CVE-2025-13640 | Low | 3.5 | 2025-12-02 | Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physical access to the… |
CVE-2025-13639 | High | 8.1 | 2025-12-02 | Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pag… |
CVE-2025-13638 | High | 8.8 | 2025-12-02 | Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2025-13637 | Medium | 4.3 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2025-13636 | Medium | 4.3 | 2025-12-02 | Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-13635 | Medium | 4.4 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2025-13634 | Medium | 4.4 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the web via a crafted H… |
CVE-2025-13633 | High | 8.8 | 2025-12-02 | Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2025-13632 | Medium | 5.4 | 2025-12-02 | Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a user to install a malicious extension to p… |
CVE-2025-13631 | High | 8.8 | 2025-12-02 | Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform privilege escalation via a c… |
CVE-2025-13630 | High | 8.8 | 2025-12-02 | Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-3500 | Critical | 9.0 | 2025-12-01 | Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981… |
CVE-2025-66221 | Medium | 5.3 | 2025-11-29 | Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names… |