Microsoft
Page 37 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64657 | Critical | 9.8 | 2025-11-26 | Stack-based buffer overflow in Azure Application Gateway allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-64656 | Critical | 9.4 | 2025-11-26 | Out-of-bounds read in Application Gateway allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-64695 | High | 7.8 | 2025-11-21 | Uncontrolled search path element issue exists in the installer of LogStare Collector (for Windows). If exploited, arbitrary code may be executed with the privi… |
CVE-2025-64299 | Low | 2.7 | 2025-11-21 | LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes. |
CVE-2025-62687 | Medium | 6.5 | 2025-11-21 | Cross-site request forgery vulnerability exists in LogStare Collector. If a user views a crafted page while logged, unintended operations may be performed. |
CVE-2025-62189 | Medium | 4.3 | 2025-11-21 | LogStare Collector contains an incorrect authorization vulnerability in UserRegistration. If exploited, a non-administrative user may create a new user account… |
CVE-2025-61949 | Medium | 5.4 | 2025-11-21 | LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitrary script may be ex… |
CVE-2025-58097 | High | 7.8 | 2025-11-21 | The installation directory of LogStare Collector is configured with incorrect access permissions. A non-administrative user may manipulate files within the ins… |
CVE-2025-64660 | High | 8.0 | 2025-11-20 | Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network. |
CVE-2025-64655 | High | 8.8 | 2025-11-20 | Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-62459 | High | 8.3 | 2025-11-20 | Microsoft Defender Portal Spoofing Vulnerability |
CVE-2025-62207 | High | 8.6 | 2025-11-20 | Azure Monitor Elevation of Privilege Vulnerability |
CVE-2025-59245 | Critical | 9.8 | 2025-11-20 | Microsoft SharePoint Online Elevation of Privilege Vulnerability |
CVE-2025-49752 | Critical | 10.0 | 2025-11-20 | Azure Bastion Elevation of Privilege Vulnerability |
CVE-2025-11001 | High | 7.8 | 2025-11-19 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2025-13316 | High | 8.1 | 2025-11-19 | Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypt… |
CVE-2025-13315 | Critical | 9.8 | 2025-11-19 | Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication control… |
CVE-2025-13230 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13229 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13228 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13227 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13226 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13224 | High | 8.8 | 2025-11-17 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2025-13223 | High | 8.8 | 2025-11-17 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2025-9479 | Medium | 4.3 | 2025-11-14 | Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2025-13107 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-13097 | Medium | 5.4 | 2025-11-14 | Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafte… |
CVE-2024-7021 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML… |
CVE-2024-7017 | High | 7.5 | 2025-11-14 | Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a craft… |
CVE-2024-13178 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (C… |
CVE-2025-12763 | Medium | 6.8 | 2025-11-13 | pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup… |
CVE-2025-13042 | High | 8.8 | 2025-11-12 | Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2025-64531 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-61835 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exe… |
CVE-2025-61834 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-61833 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read p… |
CVE-2025-62453 | Medium | 5.0 | 2025-11-11 | Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally. |
CVE-2025-62452 | High | 8.0 | 2025-11-11 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-62449 | Medium | 6.8 | 2025-11-11 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to by… |
CVE-2025-62222 | High | 8.8 | 2025-11-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacke… |
CVE-2025-62220 | High | 8.8 | 2025-11-11 | Heap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network. |
CVE-2025-62219 | High | 7.0 | 2025-11-11 | Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62218 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized atta… |
CVE-2025-62217 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2025-62216 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-62215 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileg… |
CVE-2025-62214 | Medium | 6.7 | 2025-11-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally. |
CVE-2025-62213 | High | 7.0 | 2025-11-11 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-62211 | High | 8.7 | 2025-11-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to pe… |
CVE-2025-62210 | High | 8.7 | 2025-11-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to pe… |
CVE-2025-62209 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. |
CVE-2025-62208 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. |
CVE-2025-62206 | Medium | 6.5 | 2025-11-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over… |
CVE-2025-62205 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-62204 | High | 8.0 | 2025-11-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-62203 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62202 | High | 7.1 | 2025-11-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-62201 | High | 7.8 | 2025-11-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62200 | High | 7.8 | 2025-11-11 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62199 | High | 7.8 | 2025-11-11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-61831 | High | 7.8 | 2025-11-11 | Illustrator versions 28.7.10, 29.8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-61820 | High | 7.8 | 2025-11-11 | Illustrator versions 28.7.10, 29.8.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-61819 | High | 7.8 | 2025-11-11 | Photoshop Desktop versions 26.8.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the c… |
CVE-2025-60728 | Medium | 4.3 | 2025-11-11 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2025-60727 | High | 7.8 | 2025-11-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-60726 | High | 7.1 | 2025-11-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-60724 | Critical | 9.8 | 2025-11-11 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
CVE-2025-60723 | Medium | 6.3 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service ov… |
CVE-2025-60722 | Medium | 6.5 | 2025-11-11 | Improper limitation of a pathname to a restricted directory ('path traversal') in OneDrive for Android allows an authorized attacker to elevate privileges over… |
CVE-2025-60721 | High | 7.8 | 2025-11-11 | Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. |
CVE-2025-60720 | High | 7.8 | 2025-11-11 | Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally. |
CVE-2025-60719 | High | 7.0 | 2025-11-11 | Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-60718 | High | 7.8 | 2025-11-11 | Untrusted search path in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. |
CVE-2025-60717 | High | 7.0 | 2025-11-11 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-60716 | High | 7.0 | 2025-11-11 | Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. |
CVE-2025-60715 | High | 8.0 | 2025-11-11 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-60714 | High | 7.8 | 2025-11-11 | Heap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally. |
CVE-2025-60713 | High | 7.8 | 2025-11-11 | Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
CVE-2025-60710 | High | 7.8 | 2025-11-11 | Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally. |
CVE-2025-60709 | High | 7.8 | 2025-11-11 | Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-60708 | Medium | 6.5 | 2025-11-11 | Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally. |
CVE-2025-60707 | High | 7.8 | 2025-11-11 | Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally. |
CVE-2025-60706 | Medium | 5.5 | 2025-11-11 | Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally. |
CVE-2025-60705 | High | 7.8 | 2025-11-11 | Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-60704 | High | 7.5 | 2025-11-11 | Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-60703 | High | 7.8 | 2025-11-11 | Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. |
CVE-2025-59515 | High | 7.0 | 2025-11-11 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-59514 | High | 7.8 | 2025-11-11 | Improper privilege management in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-59513 | Medium | 5.5 | 2025-11-11 | Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally. |
CVE-2025-59512 | High | 7.8 | 2025-11-11 | Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally. |
CVE-2025-59511 | High | 7.8 | 2025-11-11 | External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-59510 | Medium | 5.5 | 2025-11-11 | Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny servic… |
CVE-2025-59509 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally. |
CVE-2025-59508 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileg… |
CVE-2025-59507 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileg… |
CVE-2025-59506 | High | 7.0 | 2025-11-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privile… |
CVE-2025-59505 | High | 7.8 | 2025-11-11 | Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally. |
CVE-2025-59504 | High | 7.3 | 2025-11-11 | Heap-based buffer overflow in Azure Monitor Agent allows an unauthorized attacker to execute code locally. |
CVE-2025-59499 | High | 8.8 | 2025-11-11 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-59240 | Medium | 5.5 | 2025-11-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |