Microsoft vulnerabilities
Published CVEs affecting Microsoft products: 5261 record(s), with severity, exploitation and fixes.
Windows Server 2025 3001Windows Server 2025 (Server Core installation) 2987Windows 11 Version 24H2 2873Windows 11 24h2 2856Windows 11 Version 25H2 2825Windows Server 2022 2820Windows 11 25h2 2808Windows Server 2019 2708Windows Server 2019 (Server Core installation) 2657Windows 10 1809 2624Windows 10 Version 1809 2590Windows 10 Version 21H2 2567Windows 11 version 26H1 2555Windows 10 21h2 2551Windows 10 Version 22H2 2550Windows 10 22h2 2537Windows 11 26h1 2516Windows 11 version 23H2 2383Windows 11 23h2 2364Windows Server 2016 2297Windows Server 2016 (Server Core installation) 2233Windows 10 1607 2214Windows 10 Version 1607 2171Windows Server 2012 1885Windows Server 2012 R2 1807Windows Server 2012 R2 (Server Core installation) 1798Windows Server 2012 (Server Core installation) 1693Windows 11 Version 26H2 1007Windows 11 26h2 980Microsoft 365 Apps for Enterprise 576365 Apps 575Microsoft Office LTSC 2024 554Microsoft Office LTSC 2021 551Windows Server 2022 23h2 544Windows Server 2022, 23H2 Edition (Server Core installation) 543Office 2021 465Office 2024 465Microsoft Office LTSC for Mac 2021 459Microsoft Office LTSC for Mac 2024 459Microsoft Office 2019 386
CVE-2026-54991
High · 7.0
CWE-125 Jul 14, 2026
Windows USB Print Driver Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-54990
High · 8.8
CWE-122 Jul 14, 2026
Remote Desktop Client Remote Code Execution Vulnerability
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-54989
High · 7.8
CWE-416 Jul 14, 2026
Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
CVE-2026-54987
High · 7.8
CWE-122 Jul 14, 2026
Windows Overlay Filter Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVE-2026-54986
High · 7.8
CWE-122 Jul 14, 2026
Windows Win32k Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-54988
Medium · 6.1
CWE-125 Jul 14, 2026
Microsoft Excel Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2026-54983
High · 7.5
CWE-121 Jul 14, 2026
Windows Active Directory Federation Services Denial of Service Vulnerability
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
CVE-2026-54982
High · 8.8
CWE-191 Jul 14, 2026
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
Integer underflow (wrap or wraparound) in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-54132
Medium · 6.8
CWE-122 Jul 14, 2026
Windows Kernel Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-54129
High · 7.8
CWE-416 Jul 14, 2026
Windows Hyper-V Elevation of Privilege Vulnerability
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2026-54127
High · 8.4
CWE-416 Jul 14, 2026
Windows Hyper-V Elevation of Privilege Vulnerability
Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
CVE-2026-54122
High · 8.4
CWE-122 Jul 14, 2026
Windows GDI+ Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.
CVE-2026-54119
High · 7.5
CWE-835 Jul 14, 2026
Windows Active Directory Denial of Service Vulnerability
Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unauthorized attacker to deny service over a network.
CVE-2026-54118
Critical · 9.8
CWE-502 Jul 14, 2026
Microsoft SQL Server Remote Code Execution Vulnerability
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-54117
Critical · 9.8
CWE-502 Jul 14, 2026
Microsoft SQL Server Remote Code Execution Vulnerability
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-54114
High · 7.8
CWE-416 Jul 14, 2026
Windows Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-54112
High · 7.0
CWE-362 Jul 14, 2026
Windows Win32k Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-54111
High · 7.0
CWE-125 Jul 14, 2026
Universal Print Management Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-54109
High · 7.8
CWE-122 Jul 14, 2026
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
CVE-2026-54108
Medium · 6.5
CWE-73 Jul 14, 2026
Microsoft SharePoint Server Spoofing Vulnerability
External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-54107
High · 7.0
CWE-362 Jul 14, 2026
Windows Win32k Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-50697
High · 7.8
CWE-200 Jul 14, 2026
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-50696
High · 7.5
CWE-122 Jul 14, 2026
Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
Heap-based buffer overflow in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
CVE-2026-50695
High · 7.5
CWE-121 Jul 14, 2026
Windows Active Directory Federation Services Denial of Service Vulnerability
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
CVE-2026-50694
Critical · 9.8
CWE-416 Jul 14, 2026
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.