Microsoft
Page 46 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47987 | High | 7.8 | 2025-07-08 | Heap-based buffer overflow in Windows Cred SSProvider Protocol allows an authorized attacker to elevate privileges locally. |
CVE-2025-47986 | High | 8.8 | 2025-07-08 | Use after free in Universal Print Management Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-47985 | High | 7.8 | 2025-07-08 | Untrusted pointer dereference in Windows Event Tracing allows an authorized attacker to elevate privileges locally. |
CVE-2025-47984 | High | 7.5 | 2025-07-08 | Protection mechanism failure in Windows GDI allows an unauthorized attacker to disclose information over a network. |
CVE-2025-47982 | High | 7.8 | 2025-07-08 | Improper input validation in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-47981 | Critical | 9.8 | 2025-07-08 | Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network. |
CVE-2025-47980 | Medium | 6.2 | 2025-07-08 | Exposure of sensitive information to an unauthorized actor in Windows Imaging Component allows an unauthorized attacker to disclose information locally. |
CVE-2025-47978 | Medium | 6.5 | 2025-07-08 | Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network. |
CVE-2025-47976 | High | 7.8 | 2025-07-08 | Use after free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-47975 | High | 7.0 | 2025-07-08 | Double free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-47973 | High | 7.8 | 2025-07-08 | Buffer over-read in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-47972 | High | 8.0 | 2025-07-08 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Input Method Editor (IME) allows an authorized attacke… |
CVE-2025-47971 | High | 7.8 | 2025-07-08 | Buffer over-read in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-47178 | High | 8.0 | 2025-07-08 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to execut… |
CVE-2025-47159 | High | 7.8 | 2025-07-08 | Protection mechanism failure in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
CVE-2025-47109 | Medium | 5.5 | 2025-07-08 | After Effects versions 25.2, 24.6.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An a… |
CVE-2025-43587 | Medium | 5.5 | 2025-07-08 | After Effects versions 25.2, 24.6.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-43580 | Medium | 5.5 | 2025-07-08 | Audition versions 25.2, 24.6.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could result in application deni… |
CVE-2025-33054 | High | 8.1 | 2025-07-08 | Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-26636 | Medium | 5.5 | 2025-07-08 | Processor optimization removal or modification of security-critical code in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-21195 | Medium | 6.0 | 2025-07-08 | Improper link resolution before file access ('link following') in Service Fabric allows an authorized attacker to elevate privileges locally. |
CVE-2025-7326 | High | 7.0 | 2025-07-08 | Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) so… |
CVE-2025-3630 | Medium | 6.4 | 2025-07-08 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 … |
CVE-2025-2827 | Medium | 4.3 | 2025-07-08 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 could disclose sensitive installation directory information to an authent… |
CVE-2025-2793 | Medium | 5.4 | 2025-07-08 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 … |
CVE-2025-49713 | High | 8.8 | 2025-07-02 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2025-36630 | High | 8.4 | 2025-07-02 | In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log… |
CVE-2025-49741 | High | 7.4 | 2025-07-01 | No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-6554 | High | 8.1 | 2025-06-30 | Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium secur… |
CVE-2024-24915 | Medium | 6.1 | 2025-06-29 | Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them. |
CVE-2024-52928 | Critical | 9.6 | 2025-06-26 | Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new permissions when the… |
CVE-2025-36038 | Critical | 9.0 | 2025-06-25 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of seriali… |
CVE-2025-0966 | High | 7.6 | 2025-06-25 | IBM InfoSphere Information Server 11.7 vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attack… |
CVE-2025-6557 | Medium | 5.4 | 2025-06-24 | Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-3629 | Medium | 4.3 | 2025-06-21 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an authenticated user to delete another user's comments due to improper ownership man… |
CVE-2025-3221 | High | 7.5 | 2025-06-21 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a remote attacker to cause a denial of service due to insufficient validation of incomi… |
CVE-2025-6218 | High | 7.8 | 2025-06-21 | RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected install… |
CVE-2025-49715 | High | 7.5 | 2025-06-20 | Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose i… |
CVE-2024-24916 | Medium | 6.5 | 2025-06-19 | Untrusted DLLs in the installer's directory may be loaded and executed, leading to potentially arbitrary code execution with the installer's privileges (admin). |
CVE-2025-1349 | Medium | 5.5 | 2025-06-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. T… |
CVE-2025-1348 | Medium | 4.0 | 2025-06-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 could allow a local user to obtain sensitive info… |
CVE-2024-54172 | Medium | 4.3 | 2025-06-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site request forgery which… |
CVE-2025-36049 | High | 8.8 | 2025-06-18 | IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A rem… |
CVE-2025-36048 | High | 7.2 | 2025-06-18 | IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due t… |
CVE-2024-54183 | Medium | 5.4 | 2025-06-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulne… |
CVE-2025-49385 | High | 7.8 | 2025-06-17 | Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentio… |
CVE-2025-49384 | High | 7.8 | 2025-06-17 | Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentio… |
CVE-2025-49218 | High | 7.7 | 2025-06-17 | A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installa… |
CVE-2025-49217 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected… |
CVE-2025-49216 | Critical | 9.8 | 2025-06-17 | An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and m… |
CVE-2025-49215 | High | 8.8 | 2025-06-17 | A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installa… |
CVE-2025-49214 | High | 8.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected… |
CVE-2025-49213 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected… |
CVE-2025-49212 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected… |
CVE-2025-49211 | High | 7.7 | 2025-06-17 | A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. … |
CVE-2025-30642 | Medium | 5.5 | 2025-06-17 | A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to create a denial of service (DoS) situation on affected… |
CVE-2025-30641 | High | 7.8 | 2025-06-17 | A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privilege… |
CVE-2025-30640 | High | 7.8 | 2025-06-17 | A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Pleas… |
CVE-2025-30680 | High | 7.1 | 2025-06-17 | A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to infor… |
CVE-2025-30679 | Medium | 6.5 | 2025-06-17 | A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain par… |
CVE-2025-30678 | Medium | 6.5 | 2025-06-17 | A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain par… |
CVE-2025-49487 | Medium | 6.8 | 2025-06-17 | An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical a… |
CVE-2025-49154 | High | 8.7 | 2025-06-17 | An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key mem… |
CVE-2025-49220 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected i… |
CVE-2025-49219 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected… |
CVE-2025-47867 | High | 7.5 | 2025-06-17 | A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to exec… |
CVE-2025-47866 | Medium | 4.3 | 2025-06-17 | An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affe… |
CVE-2025-47865 | High | 7.5 | 2025-06-17 | A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affec… |
CVE-2025-0320 | High | 7.8 | 2025-06-17 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Secure Access Client for Windows |
CVE-2025-36632 | High | 7.8 | 2025-06-16 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege. |
CVE-2025-36633 | High | 8.8 | 2025-06-13 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could arbitrarily delete local system files with SYSTE… |
CVE-2025-36631 | High | 8.4 | 2025-06-13 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log… |
CVE-2025-47959 | High | 7.1 | 2025-06-13 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a netwo… |
CVE-2025-30399 | High | 7.5 | 2025-06-13 | Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2025-4613 | High | 8.8 | 2025-06-12 | Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking… |
CVE-2025-0913 | Medium | 5.5 | 2025-06-11 | os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile wi… |
CVE-2025-32711 | Critical | 9.3 | 2025-06-11 | Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2025-32717 | High | 8.4 | 2025-06-11 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-47112 | Medium | 5.5 | 2025-06-10 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure… |
CVE-2025-47111 | Medium | 5.5 | 2025-06-10 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to applic… |
CVE-2025-47107 | High | 7.8 | 2025-06-10 | InCopy versions 20.2, 19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contex… |
CVE-2025-43579 | Medium | 5.5 | 2025-06-10 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an Information Exposure vulnerability that could result in a Secur… |
CVE-2025-43578 | Medium | 5.5 | 2025-06-10 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure… |
CVE-2025-43577 | High | 7.8 | 2025-06-10 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-43576 | High | 7.8 | 2025-06-10 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-43575 | High | 7.8 | 2025-06-10 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrar… |
CVE-2025-43574 | High | 7.8 | 2025-06-10 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-43573 | High | 7.8 | 2025-06-10 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-43550 | High | 7.8 | 2025-06-10 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-30327 | High | 7.8 | 2025-06-10 | InCopy versions 20.2, 19.5.3 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the c… |
CVE-2025-47977 | High | 8.2 | 2025-06-10 | Improper neutralization of input during web page generation ('cross-site scripting') in Nuance Digital Engagement Platform allows an unauthorized attacker to p… |
CVE-2025-47969 | Medium | 4.4 | 2025-06-10 | Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally. |
CVE-2025-47968 | High | 7.8 | 2025-06-10 | Improper input validation in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally. |
CVE-2025-47962 | High | 7.8 | 2025-06-10 | Improper access control in Windows SDK allows an authorized attacker to elevate privileges locally. |
CVE-2025-47957 | High | 8.4 | 2025-06-10 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-47956 | Medium | 5.5 | 2025-06-10 | External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally. |
CVE-2025-47955 | High | 7.8 | 2025-06-10 | Improper privilege management in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-47953 | High | 8.4 | 2025-06-10 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-47176 | High | 7.8 | 2025-06-10 | '.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally. |
CVE-2025-47175 | High | 7.8 | 2025-06-10 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |