Microsoft vulnerabilities

Published CVEs affecting Microsoft products: 5262 record(s), with severity, exploitation and fixes.

Windows Server 2025 3001 Windows Server 2025 (Server Core installation) 2987 Windows 11 Version 24H2 2873 Windows 11 24h2 2856 Windows 11 Version 25H2 2825 Windows Server 2022 2820 Windows 11 25h2 2808 Windows Server 2019 2708 Windows Server 2019 (Server Core installation) 2657 Windows 10 1809 2624 Windows 10 Version 1809 2590 Windows 10 Version 21H2 2567 Windows 11 version 26H1 2555 Windows 10 21h2 2551 Windows 10 Version 22H2 2550 Windows 10 22h2 2537 Windows 11 26h1 2516 Windows 11 version 23H2 2383 Windows 11 23h2 2364 Windows Server 2016 2297 Windows Server 2016 (Server Core installation) 2233 Windows 10 1607 2214 Windows 10 Version 1607 2171 Windows Server 2012 1885 Windows Server 2012 R2 1807 Windows Server 2012 R2 (Server Core installation) 1798 Windows Server 2012 (Server Core installation) 1693 Windows 11 Version 26H2 1007 Windows 11 26h2 980 Microsoft 365 Apps for Enterprise 576 365 Apps 575 Microsoft Office LTSC 2024 554 Microsoft Office LTSC 2021 551 Windows Server 2022 23h2 544 Windows Server 2022, 23H2 Edition (Server Core installation) 543 Office 2021 465 Office 2024 465 Microsoft Office LTSC for Mac 2021 462 Microsoft Office LTSC for Mac 2024 462 Microsoft Office 365 for Mac 389

Exploited only (KEV) →

CVE-2026-41613 High · 8.8 CWE-384 May 12, 2026

Visual Studio Code Elevation of Privilege Vulnerability

Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-41612 Medium · 5.5 CWE-22 May 12, 2026

Visual Studio Code Information Disclosure Vulnerability

Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.

CVE-2026-41611 Low · 3.3 CWE-79 May 12, 2026

Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.

CVE-2026-41610 Medium · 5.0 CWE-79 May 12, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-41109 High · 8.8 CWE-74 May 12, 2026

GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-41107 High · 7.4 CWE-610 May 12, 2026

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

CVE-2026-41103 Critical · 9.1 CWE-303 May 12, 2026

Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability

Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-41102 Medium · 5.5 CWE-284 May 12, 2026

Microsoft PowerPoint for Android Spoofing Vulnerability

Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.

CVE-2026-41101 Medium · 5.5 CWE-284 May 12, 2026

Microsoft Word for Android Spoofing Vulnerability

Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.

CVE-2026-41100 Medium · 4.4 CWE-284 May 12, 2026

Microsoft 365 Copilot for Android Spoofing Vulnerability

Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.

CVE-2026-41097 Medium · 6.7 CWE-1329 May 12, 2026

Secure Boot Security Feature Bypass Vulnerability

Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CVE-2026-41096 Critical · 9.8 CWE-122 May 12, 2026

Windows DNS Client Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

CVE-2026-41095 High · 7.8 CWE-416 May 12, 2026

Data Deduplication Elevation of Privilege Vulnerability

Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.

CVE-2026-41094 High · 8.8 CWE-94 May 12, 2026

Microsoft Data Formulator Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.

CVE-2026-41089 Critical · 9.8 CWE-121 May 12, 2026

Windows Netlogon Remote Code Execution Vulnerability

Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

CVE-2026-41088 High · 7.8 CWE-73 May 12, 2026

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-41086 High · 8.8 CWE-284 May 12, 2026

Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability

Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

CVE-2026-40421 Medium · 4.3 CWE-73 May 12, 2026

Microsoft Word Information Disclosure Vulnerability

Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2026-40420 High · 8.8 CWE-284 May 12, 2026

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

CVE-2026-40419 High · 7.8 CWE-416 May 12, 2026

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

CVE-2026-40418 High · 7.8 CWE-416 May 12, 2026

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

CVE-2026-40417 High · 7.8 CWE-1390 May 12, 2026

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.

CVE-2026-40416 Medium · 4.3 CWE-451 May 12, 2026

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-40415 High · 8.1 CWE-416 May 12, 2026

Windows TCP/IP Remote Code Execution Vulnerability

Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.

CVE-2026-40414 High · 7.4 CWE-476 May 12, 2026

Windows TCP/IP Denial of Service Vulnerability