Microsoft
Page 43 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53734 | High | 7.8 | 2025-08-12 | Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally. |
CVE-2025-53733 | High | 8.4 | 2025-08-12 | Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-53732 | High | 7.8 | 2025-08-12 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-53731 | High | 8.4 | 2025-08-12 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-53730 | High | 7.8 | 2025-08-12 | Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally. |
CVE-2025-53729 | High | 7.8 | 2025-08-12 | Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally. |
CVE-2025-53728 | Medium | 6.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over… |
CVE-2025-53727 | High | 8.8 | 2025-08-12 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-53726 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
CVE-2025-53725 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
CVE-2025-53724 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
CVE-2025-53723 | High | 7.8 | 2025-08-12 | Numeric truncation error in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2025-53722 | High | 7.5 | 2025-08-12 | Uncontrolled resource consumption in Windows Remote Desktop Services allows an unauthorized attacker to deny service over a network. |
CVE-2025-53721 | High | 7.0 | 2025-08-12 | Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-53720 | High | 8.0 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-53719 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53718 | High | 7.0 | 2025-08-12 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53716 | Medium | 6.5 | 2025-08-12 | Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. |
CVE-2025-53156 | Medium | 5.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Storage Port Driver allows an authorized attacker to disclose information locally. |
CVE-2025-53155 | High | 7.8 | 2025-08-12 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2025-53154 | High | 7.8 | 2025-08-12 | Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53153 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53152 | High | 7.8 | 2025-08-12 | Use after free in Desktop Windows Manager allows an authorized attacker to execute code locally. |
CVE-2025-53151 | High | 7.8 | 2025-08-12 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-53149 | High | 7.8 | 2025-08-12 | Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-53148 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53147 | High | 7.0 | 2025-08-12 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53145 | High | 8.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. |
CVE-2025-53144 | High | 8.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. |
CVE-2025-53143 | High | 8.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. |
CVE-2025-53142 | High | 7.0 | 2025-08-12 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-53141 | High | 7.8 | 2025-08-12 | Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53140 | High | 7.0 | 2025-08-12 | Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-53138 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53137 | High | 7.0 | 2025-08-12 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53136 | Medium | 5.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Windows NT OS Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-53135 | High | 7.0 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privile… |
CVE-2025-53134 | High | 7.0 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2025-53133 | High | 7.8 | 2025-08-12 | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
CVE-2025-53132 | High | 7.8 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
CVE-2025-53131 | High | 8.8 | 2025-08-12 | Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. |
CVE-2025-50177 | High | 8.1 | 2025-08-12 | Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. |
CVE-2025-50176 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Graphics Kernel allows an authorized attacker to execute code locally. |
CVE-2025-50173 | High | 7.8 | 2025-08-12 | Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-50172 | Medium | 6.5 | 2025-08-12 | Allocation of resources without limits or throttling in Windows DirectX allows an authorized attacker to deny service over a network. |
CVE-2025-50171 | Critical | 9.1 | 2025-08-12 | Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-50170 | High | 7.8 | 2025-08-12 | Improper handling of insufficient permissions or privileges in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges local… |
CVE-2025-50169 | High | 7.5 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an unauthorized attacker to execute code over… |
CVE-2025-50168 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
CVE-2025-50167 | High | 7.0 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privile… |
CVE-2025-50166 | Medium | 6.5 | 2025-08-12 | Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized attacker to disclose information over a network. |
CVE-2025-50165 | Critical | 9.8 | 2025-08-12 | Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
CVE-2025-50164 | High | 8.0 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-50163 | High | 8.8 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-50162 | High | 8.0 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-50161 | High | 7.3 | 2025-08-12 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2025-50160 | High | 8.0 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-50159 | High | 7.3 | 2025-08-12 | Use after free in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an authorized attacker to elevate privileges locally. |
CVE-2025-50158 | High | 7.0 | 2025-08-12 | Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an unauthorized attacker to disclose information locally. |
CVE-2025-50157 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-50156 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-50155 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
CVE-2025-50154 | Medium | 6.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-50153 | High | 7.8 | 2025-08-12 | Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-49762 | High | 7.0 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2025-49761 | High | 7.8 | 2025-08-12 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-49759 | High | 8.8 | 2025-08-12 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-49758 | High | 8.8 | 2025-08-12 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-49757 | High | 8.8 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-49755 | Medium | 4.3 | 2025-08-12 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-49751 | Medium | 6.8 | 2025-08-12 | Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network. |
CVE-2025-49745 | Medium | 5.4 | 2025-08-12 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to… |
CVE-2025-49743 | Medium | 6.7 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2025-49736 | Medium | 4.3 | 2025-08-12 | The ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-49712 | High | 8.8 | 2025-08-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-49707 | High | 7.9 | 2025-08-12 | Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally. |
CVE-2025-48807 | Medium | 6.7 | 2025-08-12 | Improper restriction of communication channel to intended endpoints in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2025-47954 | High | 8.8 | 2025-08-12 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-33051 | High | 7.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network. |
CVE-2025-25007 | Medium | 5.3 | 2025-08-12 | Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-25006 | Medium | 5.3 | 2025-08-12 | Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-25005 | Medium | 6.5 | 2025-08-12 | Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. |
CVE-2025-24999 | High | 8.8 | 2025-08-12 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-49568 | Medium | 5.5 | 2025-08-12 | Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. Exploitation… |
CVE-2025-49567 | Medium | 5.5 | 2025-08-12 | Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An a… |
CVE-2025-49564 | High | 7.8 | 2025-08-12 | Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-49563 | High | 7.8 | 2025-08-12 | Illustrator versions 28.7.8, 29.6.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-8088 | High | 8.8 | 2025-08-08 | A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This… |
CVE-2025-53792 | Critical | 9.1 | 2025-08-07 | Azure Portal Elevation of Privilege Vulnerability |
CVE-2025-53787 | High | 8.2 | 2025-08-07 | Microsoft 365 Copilot BizChat Information Disclosure Vulnerability |
CVE-2025-53774 | Medium | 6.5 | 2025-08-07 | Microsoft 365 Copilot BizChat Information Disclosure Vulnerability |
CVE-2025-53767 | Critical | 10.0 | 2025-08-07 | Azure OpenAI Elevation of Privilege Vulnerability |
CVE-2025-55077 | High | 7.4 | 2025-08-07 | Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Micros… |
CVE-2025-8583 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-8582 | Medium | 4.3 | 2025-08-07 | Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL… |
CVE-2025-8581 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-8580 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-8579 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-8578 | High | 8.8 | 2025-08-07 | Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2025-8577 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |