Microsoft
Page 48 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-43546 | High | 7.8 | 2025-05-13 | Bridge versions 15.0.3, 14.1.6 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code executio… |
CVE-2025-43545 | High | 7.8 | 2025-05-13 | Bridge versions 15.0.3, 14.1.6 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in th… |
CVE-2025-30330 | High | 7.8 | 2025-05-13 | Illustrator versions 29.3, 28.7.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the c… |
CVE-2025-30329 | Medium | 5.5 | 2025-05-13 | Animate versions 24.0.8, 23.0.11 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An atta… |
CVE-2025-30328 | High | 7.8 | 2025-05-13 | Animate versions 24.0.8, 23.0.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context… |
CVE-2025-30325 | High | 7.8 | 2025-05-13 | Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execut… |
CVE-2025-30324 | High | 7.8 | 2025-05-13 | Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary cod… |
CVE-2025-32709 | High | 7.8 | 2025-05-13 | Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-32707 | High | 7.8 | 2025-05-13 | Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-32706 | High | 7.8 | 2025-05-13 | Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-32705 | High | 7.8 | 2025-05-13 | Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to execute code locally. |
CVE-2025-32704 | High | 8.4 | 2025-05-13 | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-32703 | Medium | 5.5 | 2025-05-13 | Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally. |
CVE-2025-32702 | High | 7.8 | 2025-05-13 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally. |
CVE-2025-32701 | High | 7.8 | 2025-05-13 | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-30400 | High | 7.8 | 2025-05-13 | Use after free in Windows DWM allows an authorized attacker to elevate privileges locally. |
CVE-2025-30397 | High | 7.5 | 2025-05-13 | Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network. |
CVE-2025-30394 | Medium | 5.9 | 2025-05-13 | Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-30393 | High | 7.8 | 2025-05-13 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-30388 | High | 7.8 | 2025-05-13 | Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally. |
CVE-2025-30387 | Critical | 9.8 | 2025-05-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-30386 | High | 8.4 | 2025-05-13 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-30385 | High | 7.8 | 2025-05-13 | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-30384 | High | 7.4 | 2025-05-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. |
CVE-2025-30383 | High | 7.8 | 2025-05-13 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-30382 | High | 7.8 | 2025-05-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. |
CVE-2025-30381 | High | 7.8 | 2025-05-13 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-30379 | High | 7.8 | 2025-05-13 | Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-30378 | High | 7.0 | 2025-05-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. |
CVE-2025-30377 | High | 8.4 | 2025-05-13 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-30376 | High | 7.8 | 2025-05-13 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-30375 | High | 7.8 | 2025-05-13 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-30320 | Medium | 5.5 | 2025-05-13 | InDesign Desktop versions ID19.5.2, ID20.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-servic… |
CVE-2025-30319 | Medium | 5.5 | 2025-05-13 | InDesign Desktop versions ID19.5.2, ID20.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-servic… |
CVE-2025-30318 | High | 7.8 | 2025-05-13 | InDesign Desktop versions ID19.5.2, ID20.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-30310 | High | 7.8 | 2025-05-13 | Dreamweaver Desktop versions 21.4 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result… |
CVE-2025-29979 | High | 7.8 | 2025-05-13 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-29978 | High | 7.8 | 2025-05-13 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
CVE-2025-29977 | High | 7.8 | 2025-05-13 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-29976 | High | 7.8 | 2025-05-13 | Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally. |
CVE-2025-29975 | High | 7.8 | 2025-05-13 | Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-29974 | Medium | 5.7 | 2025-05-13 | Integer underflow (wrap or wraparound) in Windows Kernel allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2025-29973 | High | 7.0 | 2025-05-13 | Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally. |
CVE-2025-29971 | High | 7.5 | 2025-05-13 | Out-of-bounds read in Web Threat Defense (WTD.sys) allows an unauthorized attacker to deny service over a network. |
CVE-2025-29970 | High | 7.8 | 2025-05-13 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-29969 | High | 7.5 | 2025-05-13 | Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network. |
CVE-2025-29968 | Medium | 6.5 | 2025-05-13 | Improper input validation in Active Directory Certificate Services (AD CS) allows an authorized attacker to deny service over a network. |
CVE-2025-29967 | High | 8.8 | 2025-05-13 | Heap-based buffer overflow in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-29966 | High | 8.8 | 2025-05-13 | Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code over a network. |
CVE-2025-29964 | High | 8.8 | 2025-05-13 | Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. |
CVE-2025-29963 | High | 8.8 | 2025-05-13 | Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. |
CVE-2025-29962 | High | 8.8 | 2025-05-13 | Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. |
CVE-2025-29961 | Medium | 6.5 | 2025-05-13 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-29960 | Medium | 6.5 | 2025-05-13 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-29959 | Medium | 6.5 | 2025-05-13 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-29958 | Medium | 6.5 | 2025-05-13 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-29957 | Medium | 6.2 | 2025-05-13 | Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to deny service locally. |
CVE-2025-29956 | Medium | 5.4 | 2025-05-13 | Buffer over-read in Windows SMB allows an authorized attacker to disclose information over a network. |
CVE-2025-29955 | Medium | 6.2 | 2025-05-13 | Improper input validation in Windows Hyper-V allows an unauthorized attacker to deny service locally. |
CVE-2025-29954 | Medium | 5.9 | 2025-05-13 | Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2025-29842 | High | 7.5 | 2025-05-13 | Acceptance of extraneous untrusted data with trusted data in UrlMon allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-29841 | High | 7.0 | 2025-05-13 | Concurrent execution using shared resource with improper synchronization ('race condition') in Universal Print Management Service allows an authorized attacker… |
CVE-2025-29840 | High | 8.8 | 2025-05-13 | Stack-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. |
CVE-2025-29839 | Medium | 4.0 | 2025-05-13 | Out-of-bounds read in Windows File Server allows an unauthorized attacker to disclose information locally. |
CVE-2025-29838 | High | 7.4 | 2025-05-13 | Null pointer dereference in Windows Drivers allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-29837 | Medium | 5.5 | 2025-05-13 | Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to disclose information locally. |
CVE-2025-29836 | Medium | 6.5 | 2025-05-13 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-29835 | Medium | 6.5 | 2025-05-13 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-29833 | High | 7.7 | 2025-05-13 | Time-of-check time-of-use (toctou) race condition in Windows Virtual Machine Bus allows an unauthorized attacker to execute code locally. |
CVE-2025-29832 | Medium | 6.5 | 2025-05-13 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-29831 | High | 7.5 | 2025-05-13 | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-29830 | Medium | 6.5 | 2025-05-13 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-29829 | Medium | 5.5 | 2025-05-13 | Use of uninitialized resource in Windows Trusted Runtime Interface Driver allows an authorized attacker to disclose information locally. |
CVE-2025-29826 | High | 7.3 | 2025-05-13 | Improper handling of insufficient permissions or privileges in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. |
CVE-2025-27488 | Medium | 6.7 | 2025-05-13 | Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally. |
CVE-2025-27468 | High | 7.0 | 2025-05-13 | Improper privilege management in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. |
CVE-2025-26685 | Medium | 6.5 | 2025-05-13 | Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network. |
CVE-2025-26684 | Medium | 6.7 | 2025-05-13 | External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
CVE-2025-26677 | High | 7.5 | 2025-05-13 | Uncontrolled resource consumption in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-24063 | High | 7.8 | 2025-05-13 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-21264 | High | 7.1 | 2025-05-13 | Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-35471 | High | 7.3 | 2025-05-13 | conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by no… |
CVE-2025-4540 | High | 7.0 | 2025-05-11 | A vulnerability was found in MTSoftware C-Lodop 6.6.1.1 on Windows. It has been rated as critical. This issue affects some unknown processing of the component… |
CVE-2025-4525 | High | 7.0 | 2025-05-10 | A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the l… |
CVE-2025-47733 | Critical | 9.1 | 2025-05-08 | Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network |
CVE-2025-47732 | High | 8.7 | 2025-05-08 | Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. |
CVE-2025-33072 | High | 8.1 | 2025-05-08 | Improper access control in Azure allows an unauthorized attacker to disclose information over a network. |
CVE-2025-29972 | Critical | 9.9 | 2025-05-08 | Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing over a network. |
CVE-2025-29827 | Critical | 9.9 | 2025-05-08 | Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network. |
CVE-2025-29813 | Critical | 10.0 | 2025-05-08 | Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-1992 | Medium | 5.3 | 2025-05-05 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user in federati… |
CVE-2025-29825 | Medium | 6.5 | 2025-05-02 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2024-52903 | Medium | 5.3 | 2025-05-01 | IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially cr… |
CVE-2025-4178 | Medium | 5.4 | 2025-05-01 | A vulnerability was found in xiaowei1118 java_server up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows and classified as critical. This issue affects s… |
CVE-2025-46619 | High | 7.6 | 2025-04-30 | A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sens… |
CVE-2025-33074 | High | 7.5 | 2025-04-30 | Improper verification of cryptographic signature in Microsoft Azure Functions allows an authorized attacker to execute code over a network. |
CVE-2025-30392 | Critical | 9.8 | 2025-04-30 | Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-30391 | High | 8.1 | 2025-04-30 | Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network. |
CVE-2025-30390 | Critical | 9.9 | 2025-04-30 | Improper authorization in Azure allows an authorized attacker to elevate privileges over a network. |
CVE-2025-30389 | High | 8.7 | 2025-04-30 | Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network. |