Microsoft vulnerabilities
Published CVEs affecting Microsoft products: 5261 record(s), with severity, exploitation and fixes.
Windows Server 2025 3001Windows Server 2025 (Server Core installation) 2987Windows 11 Version 24H2 2873Windows 11 24h2 2856Windows 11 Version 25H2 2825Windows Server 2022 2820Windows 11 25h2 2808Windows Server 2019 2708Windows Server 2019 (Server Core installation) 2657Windows 10 1809 2624Windows 10 Version 1809 2590Windows 10 Version 21H2 2567Windows 11 version 26H1 2555Windows 10 21h2 2551Windows 10 Version 22H2 2550Windows 10 22h2 2537Windows 11 26h1 2516Windows 11 version 23H2 2383Windows 11 23h2 2364Windows Server 2016 2297Windows Server 2016 (Server Core installation) 2233Windows 10 1607 2214Windows 10 Version 1607 2171Windows Server 2012 1885Windows Server 2012 R2 1807Windows Server 2012 R2 (Server Core installation) 1798Windows Server 2012 (Server Core installation) 1693Windows 11 Version 26H2 1007Windows 11 26h2 980Microsoft 365 Apps for Enterprise 576365 Apps 575Microsoft Office LTSC 2024 554Microsoft Office LTSC 2021 551Windows Server 2022 23h2 544Windows Server 2022, 23H2 Edition (Server Core installation) 543Office 2021 465Office 2024 465Microsoft Office LTSC for Mac 2021 459Microsoft Office LTSC for Mac 2024 459Microsoft Office 2019 386
CVE-2026-66325
Medium · 6.1
CWE-918 Aug 3, 2026
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66322
Medium · 5.4
CWE-346 Aug 3, 2026
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66321
Critical · 9.6
CWE-843 Aug 3, 2026
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-66318
High · 8.1
CWE-346 Aug 3, 2026
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-66317
Medium · 5.4
CWE-346 Aug 3, 2026
Microsoft Edge (Chromium-based) Tampering Vulnerability
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.
CVE-2026-66316
Medium · 5.4
CWE-346 Aug 3, 2026
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66315
High · 7.5
CWE-416 Aug 3, 2026
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-66314
Medium · 5.3
CWE-367 Aug 3, 2026
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-66313
Medium · 6.8
CWE-346 Aug 3, 2026
Microsoft Edge (Chromium-based) Tampering Vulnerability
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
CVE-2026-66312
High · 8.8
CWE-126 Aug 3, 2026
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
CVE-2026-66311
Medium · 6.2
CWE-862 Aug 3, 2026
Microsoft Edge (Chromium-based) Tampering Vulnerability
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
CVE-2026-66310
High · 7.1
CWE-73 Aug 3, 2026
Microsoft Edge for Android Information Disclosure Vulnerability
External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
CVE-2026-65804
Medium · 6.1
CWE-94 Aug 3, 2026
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-65802
High · 7.4
CWE-73 Aug 3, 2026
Microsoft Edge for Android Information Disclosure Vulnerability
External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
CVE-2026-62870
High · 8.8
CWE-416 Aug 3, 2026
Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-66803
Critical · 10.0
CWE-284 Jul 30, 2026
Azure Cosmos DB Remote Code Execution Vulnerability
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
CVE-2026-62828
Medium · 5.4
CWE-20 Jul 28, 2026
Microsoft Edge for Android (Chromium-based) Tampering Vulnerability
Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network.
CVE-2026-57990
High · 7.4
CWE-552 Jul 26, 2026
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-57989
High · 7.4
CWE-346 Jul 26, 2026
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-57978
Medium · 5.4
CWE-346 Jul 26, 2026
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-62835
High · 7.5
CWE-285 Jul 24, 2026
Azure Portal Information Disclosure Vulnerability
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
CVE-2026-58630
Critical · 9.8
CWE-284 Jul 24, 2026
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-57106
Critical · 10.0
CWE-918 Jul 24, 2026
Data Quality Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-56163
Critical · 10.0
CWE-306 Jul 24, 2026
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-62825
Critical · 9.8
CWE-287 Jul 23, 2026
Azure Key Vault Elevation of Privilege Vulnerability
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.