Microsoft
Page 47 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47174 | High | 7.8 | 2025-06-10 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-47173 | High | 7.8 | 2025-06-10 | Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-47172 | High | 8.8 | 2025-06-10 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute co… |
CVE-2025-47171 | Medium | 6.7 | 2025-06-10 | Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally. |
CVE-2025-47170 | High | 7.8 | 2025-06-10 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-47169 | High | 7.8 | 2025-06-10 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-47168 | High | 7.8 | 2025-06-10 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-47167 | High | 8.4 | 2025-06-10 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-47166 | High | 8.8 | 2025-06-10 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-47165 | High | 7.8 | 2025-06-10 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-47164 | High | 8.4 | 2025-06-10 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-47163 | High | 8.8 | 2025-06-10 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-47162 | High | 8.4 | 2025-06-10 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-47160 | Medium | 5.4 | 2025-06-10 | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-47106 | Medium | 5.5 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An att… |
CVE-2025-47105 | Medium | 5.5 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |
CVE-2025-47104 | Medium | 5.5 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |
CVE-2025-43593 | High | 7.8 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-43590 | High | 7.8 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-43589 | High | 7.8 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-43558 | High | 7.8 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-33075 | High | 7.8 | 2025-06-10 | Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-33073 | High | 8.8 | 2025-06-10 | Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network. |
CVE-2025-33071 | High | 8.1 | 2025-06-10 | Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network. |
CVE-2025-33070 | High | 8.1 | 2025-06-10 | Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-33069 | Medium | 5.1 | 2025-06-10 | Improper verification of cryptographic signature in App Control for Business (WDAC) allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-33068 | High | 7.5 | 2025-06-10 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-33067 | High | 8.4 | 2025-06-10 | Improper privilege management in Windows Kernel allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-33066 | High | 8.8 | 2025-06-10 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-33065 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33064 | High | 8.8 | 2025-06-10 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-33063 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33062 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33061 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33060 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33059 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33058 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33057 | Medium | 6.5 | 2025-06-10 | Null pointer dereference in Windows Local Security Authority (LSA) allows an authorized attacker to deny service over a network. |
CVE-2025-33056 | High | 7.5 | 2025-06-10 | Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network. |
CVE-2025-33055 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33053 | High | 8.8 | 2025-06-10 | External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. |
CVE-2025-33052 | Medium | 5.5 | 2025-06-10 | Use of uninitialized resource in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
CVE-2025-33050 | High | 7.5 | 2025-06-10 | Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
CVE-2025-32725 | High | 7.5 | 2025-06-10 | Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
CVE-2025-32724 | High | 7.5 | 2025-06-10 | Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. |
CVE-2025-32722 | Medium | 5.5 | 2025-06-10 | Improper access control in Windows Storage Port Driver allows an authorized attacker to disclose information locally. |
CVE-2025-32721 | High | 7.3 | 2025-06-10 | Improper link resolution before file access ('link following') in Windows Recovery Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-32720 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-32719 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-32718 | High | 7.8 | 2025-06-10 | Integer overflow or wraparound in Windows SMB allows an authorized attacker to elevate privileges locally. |
CVE-2025-32716 | High | 7.8 | 2025-06-10 | Out-of-bounds read in Windows Media allows an authorized attacker to elevate privileges locally. |
CVE-2025-32715 | Medium | 6.5 | 2025-06-10 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2025-32714 | High | 7.8 | 2025-06-10 | Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-32713 | High | 7.8 | 2025-06-10 | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-32712 | High | 7.8 | 2025-06-10 | Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2025-32710 | High | 8.1 | 2025-06-10 | Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. |
CVE-2025-30321 | Medium | 5.5 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-servic… |
CVE-2025-30317 | High | 7.8 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2025-29828 | High | 8.1 | 2025-06-10 | Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to execute code over a network. |
CVE-2025-24069 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-24068 | Medium | 5.5 | 2025-06-10 | Buffer over-read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-24065 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-5480 | High | 7.8 | 2025-06-06 | Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2025-47966 | Critical | 9.8 | 2025-06-05 | Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-47827 | Medium | 4.6 | 2025-06-05 | In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted roo… |
CVE-2025-20286 | Critical | 9.9 | 2025-06-04 | A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE)… |
CVE-2025-20259 | Medium | 5.3 | 2025-06-04 | Multiple vulnerabilities in the update process of Cisco ThousandEyes Endpoint Agent for Windows could allow an authenticated, local attacker to delete arbitrar… |
CVE-2025-5419 | High | 8.8 | 2025-06-03 | Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2025-20298 | High | 8.0 | 2025-06-02 | In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in inco… |
CVE-2025-23247 | Medium | 4.4 | 2025-05-27 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer could allow a user to c… |
CVE-2025-5180 | High | 7.0 | 2025-05-26 | A vulnerability, which was classified as critical, has been found in Wondershare Filmora 14.5.16. Affected by this issue is some unknown functionality in the l… |
CVE-2025-24917 | High | 7.8 | 2025-05-23 | In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run… |
CVE-2025-24916 | High | 7.0 | 2025-05-23 | When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did not enforce secure per… |
CVE-2025-47181 | High | 8.8 | 2025-05-22 | Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. |
CVE-2025-3944 | High | 7.2 | 2025-05-22 | Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File… |
CVE-2025-3943 | Medium | 4.1 | 2025-05-22 | Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security o… |
CVE-2025-3942 | Medium | 4.3 | 2025-05-22 | Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linu… |
CVE-2025-3941 | Medium | 5.4 | 2025-05-22 | Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows… |
CVE-2025-3940 | Medium | 5.3 | 2025-05-22 | Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux… |
CVE-2025-3939 | Medium | 5.3 | 2025-05-22 | Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX a… |
CVE-2025-3938 | Medium | 6.8 | 2025-05-22 | Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows… |
CVE-2025-3937 | High | 7.7 | 2025-05-22 | Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Secur… |
CVE-2025-3936 | Medium | 6.5 | 2025-05-22 | Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows all… |
CVE-2025-25539 | Medium | 6.5 | 2025-05-21 | Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information via help menu. |
CVE-2025-47161 | High | 7.8 | 2025-05-15 | Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
CVE-2025-33104 | Medium | 4.4 | 2025-05-14 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W… |
CVE-2025-26646 | High | 8.0 | 2025-05-13 | External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a networ… |
CVE-2025-43572 | High | 7.8 | 2025-05-13 | Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the c… |
CVE-2025-43571 | High | 7.8 | 2025-05-13 | Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-43570 | High | 7.8 | 2025-05-13 | Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-43569 | High | 7.8 | 2025-05-13 | Substance3D - Stager versions 3.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-43568 | High | 7.8 | 2025-05-13 | Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-43551 | Medium | 5.5 | 2025-05-13 | Substance3D - Stager versions 3.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-43549 | High | 7.8 | 2025-05-13 | Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2025-43548 | High | 7.8 | 2025-05-13 | Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the c… |
CVE-2025-4660 | Critical | 9.8 | 2025-05-13 | A remote code execution vulnerability exists in the Windows agent component of SecureConnector due to improper access controls on a named pipe. The pipe is acc… |
CVE-2025-43557 | High | 7.8 | 2025-05-13 | Animate versions 24.0.8, 23.0.11 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in… |
CVE-2025-43556 | High | 7.8 | 2025-05-13 | Animate versions 24.0.8, 23.0.11 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in t… |
CVE-2025-43555 | High | 7.8 | 2025-05-13 | Animate versions 24.0.8, 23.0.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execut… |
CVE-2025-43547 | High | 7.8 | 2025-05-13 | Bridge versions 15.0.3, 14.1.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the… |