Microsoft vulnerabilities
Published CVEs affecting Microsoft products: 5245 record(s), with severity, exploitation and fixes.
Windows Server 2025 3001Windows Server 2025 (Server Core installation) 2993Windows 11 Version 24H2 2879Windows 11 Version 25H2 2831Windows Server 2022 2820Windows Server 2019 2708Windows Server 2019 (Server Core installation) 2662Windows 11 24h2 2646Windows 11 25h2 2598Windows 10 Version 1809 2595Windows 10 Version 21H2 2572Windows 11 version 26H1 2561Windows 10 Version 22H2 2555Windows 10 1809 2438Windows 11 version 23H2 2389Windows 10 21h2 2362Windows 10 22h2 2348Windows 11 26h1 2306Windows Server 2016 2297Windows Server 2016 (Server Core installation) 2239Windows 10 Version 1607 2177Windows 11 23h2 2165Windows 10 1607 2069Windows Server 2012 1878Windows Server 2012 R2 1813Windows Server 2012 R2 (Server Core installation) 1804Windows Server 2012 (Server Core installation) 1699Windows 11 Version 26H2 1007Windows 11 26h2 771Microsoft 365 Apps for Enterprise 576365 Apps 575Microsoft Office LTSC 2024 556Microsoft Office LTSC 2021 553Windows Server 2022 23h2 544Windows Server 2022, 23H2 Edition (Server Core installation) 543Office 2021 465Office 2024 465Microsoft Office LTSC for Mac 2021 454Microsoft Office LTSC for Mac 2024 453Microsoft Office 2019 386
CVE-2026-69281
High · 7.0
CWE-416 Sep 8, 2026
Windows License Manager Elevation of Privilege Vulnerability
Use after free in Windows License Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-69280
High · 7.0
CWE-416 Sep 8, 2026
Windows Push Notifications Elevation of Privilege Vulnerability
Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
CVE-2026-69279
High · 7.0
CWE-416 Sep 8, 2026
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-69277
High · 7.8
CWE-121 Sep 8, 2026
Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability
Stack-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
CVE-2026-69276
Critical · 9.8
CWE-122 Sep 8, 2026
Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability
Integer underflow (wrap or wraparound) in Microsoft UxTheme Library (uxtheme.dll) allows an unauthorized attacker to execute code over a network.
CVE-2026-69275
High · 7.0
CWE-416 Sep 8, 2026
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-69274
High · 7.1
CWE-416 Sep 8, 2026
Windows Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network.
CVE-2026-69273
High · 8.8
CWE-284 Sep 8, 2026
Microsoft Office SharePoint Remote Code Execution Vulnerability
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-69272
High · 7.1
CWE-122 Sep 8, 2026
Microsoft Standard XPS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.
CVE-2026-69271
High · 8.0
CWE-122 Sep 8, 2026
Microsoft Standard XPS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.
CVE-2026-69270
High · 7.8
CWE-20 Sep 8, 2026
Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-69269
High · 7.8
CWE-191 Sep 8, 2026
Microsoft Standard XPS Elevation of Privilege Vulnerability
Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.
CVE-2026-69268
High · 8.8
CWE-284 Sep 8, 2026
Microsoft Office SharePoint Remote Code Execution Vulnerability
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-69267
Medium · 6.5
CWE-1220 Sep 8, 2026
Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability
Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally.
CVE-2026-69266
High · 8.8
CWE-190 Sep 8, 2026
Windows DHCP Server Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVE-2026-69265
High · 7.8
CWE-125 Sep 8, 2026
Windows NTFS Elevation of Privilege Vulnerability
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-68898
Medium · 6.5
CWE-125 Sep 8, 2026
Windows iSCSI Denial of Service Vulnerability
Out-of-bounds read in Windows iSCSI allows an unauthorized attacker to deny service over a network.
CVE-2026-68897
High · 7.0
CWE-122 Sep 8, 2026
Microsoft Standard XPS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.
CVE-2026-68896
High · 7.8
CWE-36 Sep 8, 2026
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-68895
Medium · 5.5
CWE-197 Sep 8, 2026
Internet Storage Name Service Information Disclosure Vulnerability
Numeric truncation error in Internet Storage Name Service allows an authorized attacker to disclose information locally.
CVE-2026-68894
High · 8.0
CWE-122 Sep 8, 2026
Windows Error Reporting Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network.
CVE-2026-68893
High · 7.1
CWE-416 Sep 8, 2026
Remote Desktop Licensing Service Elevation of Privilege Vulnerability
Use after free in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges over a network.
CVE-2026-68892
High · 7.8
CWE-122 Sep 8, 2026
Microsoft Standard XPS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.
CVE-2026-68891
Medium · 4.7
CWE-125 Sep 8, 2026
Microsoft Standard XPS Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.
CVE-2026-68890
High · 7.8
CWE-122 Sep 8, 2026
Microsoft Standard XPS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.