Microsoft
Page 40 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55689 | High | 7.0 | 2025-10-14 | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
CVE-2025-55688 | High | 7.0 | 2025-10-14 | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
CVE-2025-55687 | High | 7.4 | 2025-10-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Resilient File System (ReFS) allows an unauthorized atta… |
CVE-2025-55686 | High | 7.0 | 2025-10-14 | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
CVE-2025-55685 | High | 7.0 | 2025-10-14 | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
CVE-2025-55684 | High | 7.0 | 2025-10-14 | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
CVE-2025-55683 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-55682 | Medium | 6.1 | 2025-10-14 | Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-55681 | High | 7.0 | 2025-10-14 | Out-of-bounds read in Windows DWM allows an authorized attacker to elevate privileges locally. |
CVE-2025-55680 | High | 7.8 | 2025-10-14 | Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-55679 | Medium | 5.1 | 2025-10-14 | Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally. |
CVE-2025-55678 | High | 7.0 | 2025-10-14 | Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. |
CVE-2025-55677 | High | 7.8 | 2025-10-14 | Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally. |
CVE-2025-55676 | Medium | 5.5 | 2025-10-14 | Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally. |
CVE-2025-55340 | High | 7.0 | 2025-10-14 | Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a security feature locally. |
CVE-2025-55339 | High | 7.8 | 2025-10-14 | Out-of-bounds read in Windows NDIS allows an authorized attacker to elevate privileges locally. |
CVE-2025-55338 | Medium | 6.1 | 2025-10-14 | Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-55337 | Medium | 6.1 | 2025-10-14 | Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-55336 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information loca… |
CVE-2025-55335 | High | 7.4 | 2025-10-14 | Use after free in Windows NTFS allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-55334 | Medium | 6.2 | 2025-10-14 | Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-55333 | Medium | 6.1 | 2025-10-14 | Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-55332 | Medium | 6.1 | 2025-10-14 | Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-55331 | High | 7.0 | 2025-10-14 | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
CVE-2025-55330 | Medium | 6.1 | 2025-10-14 | Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-55328 | High | 7.8 | 2025-10-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privile… |
CVE-2025-55326 | High | 7.5 | 2025-10-14 | Use after free in Connected Devices Platform Service (Cdpsvc) allows an unauthorized attacker to execute code over a network. |
CVE-2025-55325 | Medium | 5.5 | 2025-10-14 | Buffer over-read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-55320 | Medium | 6.8 | 2025-10-14 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevat… |
CVE-2025-55315 | Critical | 9.9 | 2025-10-14 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature ove… |
CVE-2025-55248 | Medium | 4.8 | 2025-10-14 | Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network. |
CVE-2025-55247 | High | 7.3 | 2025-10-14 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2025-55240 | High | 7.3 | 2025-10-14 | Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-53782 | High | 8.4 | 2025-10-14 | Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-53768 | High | 7.8 | 2025-10-14 | Use after free in Xbox allows an authorized attacker to elevate privileges locally. |
CVE-2025-53717 | High | 7.0 | 2025-10-14 | Reliance on untrusted inputs in a security decision in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges… |
CVE-2025-53150 | High | 7.8 | 2025-10-14 | Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. |
CVE-2025-53139 | High | 7.7 | 2025-10-14 | Cleartext transmission of sensitive information in Windows Hello allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-50175 | High | 7.8 | 2025-10-14 | Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. |
CVE-2025-50174 | High | 7.0 | 2025-10-14 | Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally. |
CVE-2025-50152 | High | 7.8 | 2025-10-14 | Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-49708 | Critical | 9.9 | 2025-10-14 | Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network. |
CVE-2025-48813 | Medium | 6.3 | 2025-10-14 | Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally. |
CVE-2025-48004 | High | 7.4 | 2025-10-14 | Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-47989 | High | 7.0 | 2025-10-14 | Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2025-47979 | Medium | 5.5 | 2025-10-14 | Insertion of sensitive information into log file in Windows Failover Cluster allows an authorized attacker to disclose information locally. |
CVE-2025-25004 | High | 7.3 | 2025-10-14 | Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. |
CVE-2025-24990 | High | 7.8 | 2025-10-14 | Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcem… |
CVE-2025-24052 | High | 7.8 | 2025-10-14 | Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcem… |
CVE-2025-27906 | Medium | 5.3 | 2025-10-14 | IBM Content Navigator 3.0.11, 3.0.15, 3.1.0, and 3.2.0 could expose the directory listing of the application upon using an application URL. Application files a… |
CVE-2025-11719 | Critical | 9.8 | 2025-10-14 | Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption… |
CVE-2025-33096 | Medium | 6.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially… |
CVE-2025-2140 | Medium | 5.7 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender… |
CVE-2025-2139 | Low | 3.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users du… |
CVE-2025-2138 | Low | 3.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users… |
CVE-2025-59286 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a n… |
CVE-2025-59272 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosur… |
CVE-2025-59271 | High | 8.7 | 2025-10-09 | Redis Enterprise Elevation of Privilege Vulnerability |
CVE-2025-59252 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a n… |
CVE-2025-59247 | High | 8.8 | 2025-10-09 | Azure PlayFab Elevation of Privilege Vulnerability |
CVE-2025-59246 | Critical | 9.8 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-59218 | Critical | 9.6 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-55321 | Critical | 9.3 | 2025-10-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perform spoofing over… |
CVE-2025-36225 | Medium | 4.3 | 2025-10-09 | IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of retu… |
CVE-2025-36171 | Medium | 4.9 | 2025-10-09 | IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resour… |
CVE-2023-37401 | Medium | 5.3 | 2025-10-09 | IBM Aspera Faspex 5.0.0 through 5.0.13.1 uses a cross-domain policy file that includes domains that should not be trusted. |
CVE-2025-61787 | High | 8.1 | 2025-10-08 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when… |
CVE-2025-59489 | High | 7.4 | 2025-10-03 | Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended l… |
CVE-2025-23355 | Medium | 6.7 | 2025-10-01 | NVIDIA Nsight Graphics for Windows contains a vulnerability in an ngfx component, where an attacker could cause a DLL highjacking attack. A successful exploit… |
CVE-2025-34235 | High | 7.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) c… |
CVE-2025-34196 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application prior to 25.1.1413 (Windows client deployments) contain… |
CVE-2025-41244 | High | 7.8 | 2025-09-29 | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having a… |
CVE-2025-59251 | High | 7.6 | 2025-09-24 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2025-55322 | High | 7.3 | 2025-09-24 | Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network. |
CVE-2025-10892 | High | 8.8 | 2025-09-24 | Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2025-10891 | High | 8.8 | 2025-09-24 | Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2025-10890 | Critical | 9.1 | 2025-09-24 | Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
CVE-2025-10585 | Critical | 9.8 | 2025-09-24 | Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2025-10502 | High | 8.8 | 2025-09-24 | Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via malicious network t… |
CVE-2025-10501 | High | 8.8 | 2025-09-24 | Use after free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2025-10500 | High | 8.8 | 2025-09-24 | Use after free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2025-23346 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit contains a vulnerability in cuobjdump, where an unprivileged user can cause a NULL pointer dereference. A successful exploit of this vulne… |
CVE-2025-23340 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF f… |
CVE-2025-23339 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in cuobjdump where an attacker may cause a stack-based buffer overflow by getting the user to ru… |
CVE-2025-23338 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where a user may cause an out-of-bounds write by running nvdisasm on a malicious ELF… |
CVE-2025-23308 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where an attacker may cause a heap-based buffer overflow by getting the user to run… |
CVE-2025-23275 | Medium | 4.2 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvJPEG where a local authenticated user may cause a GPU out-of-bounds write by providing cert… |
CVE-2025-23273 | Low | 2.5 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvJPEG where a local authenticated user may cause a divide by zero error by submitting a spec… |
CVE-2025-23271 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF f… |
CVE-2025-23248 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF f… |
CVE-2025-54081 | Medium | 6.7 | 2025-09-23 | Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted ex… |
CVE-2025-34195 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (Windows client deployments) contain a… |
CVE-2025-34194 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments)… |
CVE-2025-34193 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 include Windows client compo… |
CVE-2025-59220 | High | 7.0 | 2025-09-18 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to eleva… |
CVE-2025-59216 | High | 7.0 | 2025-09-18 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2025-59215 | High | 7.0 | 2025-09-18 | Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2025-23336 | Medium | 4.4 | 2025-09-17 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause a denial of service by loading a misconfigured mode… |
CVE-2025-23329 | High | 7.5 | 2025-09-17 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause memory corruption by identifying and accessing the… |
CVE-2025-23328 | High | 7.5 | 2025-09-17 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write through a specially crafted… |