Microsoft
Page 50 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27471 | Medium | 5.9 | 2025-04-08 | Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-27470 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-27469 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2025-27467 | High | 7.8 | 2025-04-08 | Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. |
CVE-2025-27204 | Medium | 5.5 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-27202 | Medium | 5.5 | 2025-04-08 | Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2025-27201 | Medium | 5.5 | 2025-04-08 | Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2025-27200 | High | 7.8 | 2025-04-08 | Animate versions 24.0.7, 23.0.10 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the… |
CVE-2025-27199 | High | 7.8 | 2025-04-08 | Animate versions 24.0.7, 23.0.10 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the co… |
CVE-2025-27198 | High | 7.8 | 2025-04-08 | Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2025-27196 | High | 7.8 | 2025-04-08 | Premiere Pro versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2025-27195 | High | 7.8 | 2025-04-08 | Media Encoder versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2025-27194 | High | 7.8 | 2025-04-08 | Media Encoder versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-27193 | High | 7.8 | 2025-04-08 | Bridge versions 14.1.5, 15.0.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-27187 | Medium | 5.5 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-27186 | Medium | 5.5 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-27185 | Medium | 5.5 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service… |
CVE-2025-27184 | Medium | 5.5 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-27183 | High | 7.8 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-27182 | High | 7.8 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-26688 | High | 7.8 | 2025-04-08 | Stack-based buffer overflow in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally. |
CVE-2025-26687 | High | 7.5 | 2025-04-08 | Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-26686 | High | 7.5 | 2025-04-08 | Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker to execute code over a network. |
CVE-2025-26682 | High | 7.5 | 2025-04-08 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2025-26681 | Medium | 6.7 | 2025-04-08 | Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2025-26680 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-26679 | High | 7.8 | 2025-04-08 | Use after free in RPC Endpoint Mapper Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-26678 | High | 8.4 | 2025-04-08 | Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-26676 | Medium | 6.5 | 2025-04-08 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-26675 | High | 7.8 | 2025-04-08 | Out-of-bounds read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
CVE-2025-26674 | High | 7.8 | 2025-04-08 | Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally. |
CVE-2025-26673 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2025-26672 | Medium | 6.5 | 2025-04-08 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-26671 | High | 8.1 | 2025-04-08 | Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. |
CVE-2025-26670 | High | 8.1 | 2025-04-08 | Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network. |
CVE-2025-26669 | High | 8.8 | 2025-04-08 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-26668 | High | 7.5 | 2025-04-08 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-26667 | Medium | 6.5 | 2025-04-08 | Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose info… |
CVE-2025-26666 | High | 7.8 | 2025-04-08 | Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally. |
CVE-2025-26665 | High | 7.0 | 2025-04-08 | Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized attacker to elevate privileges locally. |
CVE-2025-26664 | Medium | 6.5 | 2025-04-08 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-26663 | High | 8.1 | 2025-04-08 | Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network. |
CVE-2025-26652 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-26651 | Medium | 6.5 | 2025-04-08 | Exposed dangerous method or function in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
CVE-2025-26649 | High | 7.0 | 2025-04-08 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate… |
CVE-2025-26648 | High | 7.8 | 2025-04-08 | Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-26647 | High | 8.8 | 2025-04-08 | Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network. |
CVE-2025-26644 | Medium | 5.1 | 2025-04-08 | Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hello allows an unauthorized attacker to pe… |
CVE-2025-26642 | High | 7.8 | 2025-04-08 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-26641 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network. |
CVE-2025-26640 | High | 7.0 | 2025-04-08 | Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. |
CVE-2025-26639 | High | 7.8 | 2025-04-08 | Integer overflow or wraparound in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-26637 | Medium | 6.8 | 2025-04-08 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-26635 | Medium | 6.5 | 2025-04-08 | Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network. |
CVE-2025-26628 | High | 7.3 | 2025-04-08 | Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locally. |
CVE-2025-25002 | Medium | 6.8 | 2025-04-08 | Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network. |
CVE-2025-24074 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-24073 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-24062 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-24060 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-24058 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-21222 | High | 8.8 | 2025-04-08 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-21221 | High | 8.8 | 2025-04-08 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-21205 | High | 8.8 | 2025-04-08 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-21204 | High | 7.8 | 2025-04-08 | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. |
CVE-2025-21203 | Medium | 6.5 | 2025-04-08 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-21197 | Medium | 6.5 | 2025-04-08 | Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permissi… |
CVE-2025-21191 | High | 7.0 | 2025-04-08 | Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally. |
CVE-2025-21174 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-1095 | High | 8.8 | 2025-04-08 | IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interact… |
CVE-2025-29815 | High | 7.6 | 2025-04-04 | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. |
CVE-2025-29796 | Medium | 4.7 | 2025-04-04 | User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-25001 | Medium | 4.3 | 2025-04-04 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2025-25000 | High | 8.8 | 2025-04-04 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2024-4877 | High | 8.8 | 2025-04-03 | OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would conn… |
CVE-2024-56341 | Medium | 5.4 | 2025-04-02 | IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaS… |
CVE-2024-25051 | Medium | 6.6 | 2025-04-02 | IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another u… |
CVE-2025-27556 | Medium | 5.8 | 2025-04-02 | An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.view… |
CVE-2025-21384 | High | 8.3 | 2025-04-01 | An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network. |
CVE-2025-26683 | High | 8.1 | 2025-03-31 | Improper authorization in Azure Playwright allows an unauthorized attacker to elevate privileges over a network. |
CVE-2024-55895 | Low | 2.7 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2024-7577 | Medium | 4.4 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could disclose sensitive user credentials from log files during new installation of the product. |
CVE-2024-51477 | Medium | 4.3 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow an authenticated to obtain sensitive username information due to an observable response discrepancy. |
CVE-2024-43186 | Medium | 5.3 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that is stored locally under certain conditions. |
CVE-2025-2783 | High | 8.3 | 2025-03-26 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandb… |
CVE-2022-39163 | Medium | 4.7 | 2025-03-26 | IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connect… |
CVE-2025-29806 | Medium | 6.5 | 2025-03-23 | No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2025-29795 | High | 7.8 | 2025-03-23 | Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. |
CVE-2025-29814 | Critical | 9.3 | 2025-03-21 | Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network. |
CVE-2025-29807 | High | 8.7 | 2025-03-21 | Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. |
CVE-2024-8196 | Critical | 9.8 | 2025-03-20 | In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vu… |
CVE-2024-51459 | High | 8.4 | 2025-03-19 | IBM InfoSphere Information Server 11.7 could allow a local user to execute privileged commands due to the improper handling of permissions. |
CVE-2025-24053 | High | 7.2 | 2025-03-13 | Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. |
CVE-2025-23360 | High | 7.1 | 2025-03-11 | NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successful exploit of this v… |
CVE-2025-27179 | Medium | 5.5 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-s… |
CVE-2025-27178 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-27177 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2025-27176 | Medium | 5.5 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-s… |
CVE-2025-27175 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-27174 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |