Microsoft
Page 39 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59275 | High | 7.8 | 2025-10-14 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
CVE-2025-59261 | High | 7.0 | 2025-10-14 | Time-of-check time-of-use (toctou) race condition in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2025-59260 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Microsoft Failover Cluster Virtual Driver allows an authorized attacker to disclose information l… |
CVE-2025-59259 | Medium | 6.5 | 2025-10-14 | Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
CVE-2025-59258 | Medium | 6.2 | 2025-10-14 | Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally. |
CVE-2025-59257 | Medium | 6.5 | 2025-10-14 | Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
CVE-2025-59255 | High | 7.8 | 2025-10-14 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-59254 | High | 7.8 | 2025-10-14 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-59253 | Medium | 5.5 | 2025-10-14 | Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally. |
CVE-2025-59250 | High | 8.1 | 2025-10-14 | Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-59249 | High | 8.8 | 2025-10-14 | Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-59248 | High | 7.5 | 2025-10-14 | Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-59244 | Medium | 6.5 | 2025-10-14 | External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-59243 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-59242 | High | 7.8 | 2025-10-14 | Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-59241 | High | 7.8 | 2025-10-14 | Improper link resolution before file access ('link following') in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate pri… |
CVE-2025-59238 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
CVE-2025-59237 | High | 8.8 | 2025-10-14 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-59236 | High | 8.4 | 2025-10-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-59235 | High | 7.1 | 2025-10-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-59234 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-59233 | High | 7.8 | 2025-10-14 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-59232 | High | 7.1 | 2025-10-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-59231 | High | 7.8 | 2025-10-14 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-59230 | High | 7.8 | 2025-10-14 | Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-59229 | Medium | 5.5 | 2025-10-14 | Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally. |
CVE-2025-59228 | High | 8.8 | 2025-10-14 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-59227 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-59226 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally. |
CVE-2025-59225 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-59224 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-59223 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-59222 | High | 7.8 | 2025-10-14 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-59221 | High | 7.0 | 2025-10-14 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-59214 | Medium | 6.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-59213 | High | 8.8 | 2025-10-14 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elev… |
CVE-2025-59211 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally. |
CVE-2025-59210 | High | 7.4 | 2025-10-14 | Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability |
CVE-2025-59209 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally. |
CVE-2025-59208 | High | 7.1 | 2025-10-14 | Out-of-bounds read in Windows MapUrlToZone allows an unauthorized attacker to disclose information over a network. |
CVE-2025-59207 | High | 7.8 | 2025-10-14 | Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-59206 | High | 7.4 | 2025-10-14 | Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability |
CVE-2025-59205 | High | 7.0 | 2025-10-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2025-59204 | Medium | 5.5 | 2025-10-14 | Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclose information locally. |
CVE-2025-59203 | Medium | 5.5 | 2025-10-14 | Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally. |
CVE-2025-59202 | High | 7.0 | 2025-10-14 | Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. |
CVE-2025-59201 | High | 7.8 | 2025-10-14 | Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally. |
CVE-2025-59200 | High | 7.7 | 2025-10-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Data Sharing Service Client allows an unauthorized attacker to p… |
CVE-2025-59199 | High | 7.8 | 2025-10-14 | Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. |
CVE-2025-59198 | Medium | 5.0 | 2025-10-14 | Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally. |
CVE-2025-59197 | Medium | 5.5 | 2025-10-14 | Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacker to disclose information locally. |
CVE-2025-59196 | High | 7.0 | 2025-10-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate pr… |
CVE-2025-59195 | High | 7.0 | 2025-10-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to de… |
CVE-2025-59194 | High | 7.0 | 2025-10-14 | Use of uninitialized resource in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-59193 | High | 7.0 | 2025-10-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to ele… |
CVE-2025-59192 | High | 7.8 | 2025-10-14 | Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-59191 | High | 7.8 | 2025-10-14 | Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. |
CVE-2025-59190 | Medium | 5.5 | 2025-10-14 | Improper input validation in Microsoft Windows Search Component allows an unauthorized attacker to deny service locally. |
CVE-2025-59189 | High | 7.4 | 2025-10-14 | Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-59188 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Failover Cluster allows an authorized attacker to disclose information locally. |
CVE-2025-59187 | High | 7.8 | 2025-10-14 | Improper input validation in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-59186 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-59185 | Medium | 6.5 | 2025-10-14 | External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-59184 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows High Availability Services allows an authorized attacker to disclose information locally. |
CVE-2025-58739 | Medium | 6.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-58738 | High | 7.0 | 2025-10-14 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
CVE-2025-58737 | High | 7.0 | 2025-10-14 | Use after free in Windows Remote Desktop allows an unauthorized attacker to execute code locally. |
CVE-2025-58736 | High | 7.0 | 2025-10-14 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
CVE-2025-58735 | High | 7.0 | 2025-10-14 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
CVE-2025-58734 | High | 7.0 | 2025-10-14 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
CVE-2025-58733 | High | 7.0 | 2025-10-14 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
CVE-2025-58732 | High | 7.0 | 2025-10-14 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
CVE-2025-58731 | High | 7.0 | 2025-10-14 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
CVE-2025-58730 | High | 7.0 | 2025-10-14 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
CVE-2025-58729 | Medium | 6.5 | 2025-10-14 | Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
CVE-2025-58728 | High | 7.8 | 2025-10-14 | Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-58727 | High | 7.0 | 2025-10-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized… |
CVE-2025-58726 | High | 7.5 | 2025-10-14 | Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-58725 | High | 7.0 | 2025-10-14 | Heap-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locally. |
CVE-2025-58724 | High | 7.8 | 2025-10-14 | Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2025-58722 | High | 7.8 | 2025-10-14 | Heap-based buffer overflow in Windows DWM allows an authorized attacker to elevate privileges locally. |
CVE-2025-58720 | High | 7.8 | 2025-10-14 | Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally. |
CVE-2025-58719 | Medium | 4.7 | 2025-10-14 | Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. |
CVE-2025-58718 | High | 8.8 | 2025-10-14 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2025-58717 | Medium | 6.5 | 2025-10-14 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-58716 | High | 8.8 | 2025-10-14 | Improper input validation in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. |
CVE-2025-58715 | High | 8.8 | 2025-10-14 | Integer overflow or wraparound in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. |
CVE-2025-58714 | High | 7.8 | 2025-10-14 | Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-55701 | High | 7.8 | 2025-10-14 | Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally. |
CVE-2025-55700 | Medium | 6.5 | 2025-10-14 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-55699 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-55698 | High | 7.7 | 2025-10-14 | Null pointer dereference in Windows DirectX allows an authorized attacker to deny service over a network. |
CVE-2025-55697 | High | 7.8 | 2025-10-14 | Heap-based buffer overflow in Azure Local allows an authorized attacker to elevate privileges locally. |
CVE-2025-55696 | High | 7.8 | 2025-10-14 | Time-of-check time-of-use (toctou) race condition in NtQueryInformation Token function (ntifs.h) allows an authorized attacker to elevate privileges locally. |
CVE-2025-55695 | Medium | 5.5 | 2025-10-14 | Out-of-bounds read in Windows WLAN Auto Config Service allows an authorized attacker to disclose information locally. |
CVE-2025-55694 | High | 7.8 | 2025-10-14 | Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
CVE-2025-55693 | High | 7.4 | 2025-10-14 | Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-55692 | High | 7.8 | 2025-10-14 | Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
CVE-2025-55691 | High | 7.0 | 2025-10-14 | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
CVE-2025-55690 | High | 7.0 | 2025-10-14 | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |