CVE Intelligence

Vulnerabilidades de Microsoft

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Microsoft: 5262 registro(s), com severidade, exploração e correções.

Windows Server 2025 3001Windows Server 2025 (Server Core installation) 2987Windows 11 Version 24H2 2873Windows 11 24h2 2856Windows 11 Version 25H2 2825Windows Server 2022 2820Windows 11 25h2 2808Windows Server 2019 2708Windows Server 2019 (Server Core installation) 2657Windows 10 1809 2624Windows 10 Version 1809 2590Windows 10 Version 21H2 2567Windows 11 version 26H1 2555Windows 10 21h2 2551Windows 10 Version 22H2 2550Windows 10 22h2 2537Windows 11 26h1 2516Windows 11 version 23H2 2383Windows 11 23h2 2364Windows Server 2016 2297Windows Server 2016 (Server Core installation) 2233Windows 10 1607 2214Windows 10 Version 1607 2171Windows Server 2012 1885Windows Server 2012 R2 1807Windows Server 2012 R2 (Server Core installation) 1798Windows Server 2012 (Server Core installation) 1693Windows 11 Version 26H2 1007Windows 11 26h2 980Microsoft 365 Apps for Enterprise 576365 Apps 575Microsoft Office LTSC 2024 554Microsoft Office LTSC 2021 551Windows Server 2022 23h2 544Windows Server 2022, 23H2 Edition (Server Core installation) 543Office 2021 465Office 2024 465Microsoft Office LTSC for Mac 2021 462Microsoft Office LTSC for Mac 2024 462Microsoft Office 365 for Mac 389

Somente exploradas (KEV) →

CVE-2025-59509 Média · 5.5 CWE-201 11/11/2025
Windows Speech Recognition Information Disclosure Vulnerability
Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally.
CVE-2025-59508 Alta · 7.0 CWE-362 11/11/2025
Windows Speech Recognition Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally.
CVE-2025-59507 Alta · 7.0 CWE-362 11/11/2025
Windows Speech Runtime Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally.
CVE-2025-59506 Alta · 7.0 CWE-362 11/11/2025
DirectX Graphics Kernel Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally.
CVE-2025-59505 Alta · 7.8 CWE-415 11/11/2025
Windows Smart Card Reader Elevation of Privilege Vulnerability
Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally.
CVE-2025-59504 Alta · 7.3 CWE-122 11/11/2025
Azure Monitor Agent Remote Code Execution Vulnerability
Heap-based buffer overflow in Azure Monitor Agent allows an unauthorized attacker to execute code locally.
CVE-2025-59499 Alta · 8.8 CWE-89 11/11/2025
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-59240 Média · 5.5 CWE-200 11/11/2025
Microsoft Excel Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2025-47179 Média · 6.7 CWE-284 11/11/2025
Configuration Manager Elevation of Privilege Vulnerability
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally.
CVE-2025-30398 Alta · 8.1 CWE-862 11/11/2025
Nuance PowerScribe 360 Information Disclosure Vulnerability
Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network.
CVE-2025-60711 Média · 6.3 CWE-693 31/10/2025
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2025-59501 Média · 4.8 CWE-290 31/10/2025
Microsoft Configuration Manager Spoofing Vulnerability
Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent network.
CVE-2025-59503 Crítica · 9.8 CWE-918 23/10/2025
Azure Compute Resource Provider Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-59500 Alta · 8.8 CWE-284 23/10/2025
Azure Notification Service Elevation of Privilege Vulnerability
Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network.
CVE-2025-59273 Crítica · 9.8 CWE-284 23/10/2025
Azure Event Grid System Elevation of Privilege Vulnerability
Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-59502 Alta · 7.5 CWE-400 14/10/2025
Remote Procedure Call Denial of Service Vulnerability
Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network.
CVE-2025-59497 Média · 4.7 CWE-367 14/10/2025
Microsoft Defender for Linux Denial of Service Vulnerability
Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Linux allows an authorized attacker to deny service locally.
CVE-2025-59494 Alta · 7.8 CWE-284 14/10/2025
Azure Monitor Agent Elevation of Privilege Vulnerability
Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
CVE-2025-59295 Alta · 8.8 CWE-122 14/10/2025
Windows URL Parsing Remote Code Execution Vulnerability
Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network.
CVE-2025-59294 Média · 4.6 CWE-200 14/10/2025
Windows Taskbar Live Preview Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information with a physical attack.
CVE-2025-59290 Alta · 7.8 CWE-416 14/10/2025
Windows Bluetooth Service Elevation of Privilege Vulnerability
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
CVE-2025-59289 Alta · 7.0 CWE-415 14/10/2025
Windows Bluetooth Service Elevation of Privilege Vulnerability
Double free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
CVE-2025-59292 Alta · 8.2 CWE-73 14/10/2025
Azure Compute Gallery Elevation of Privilege Vulnerability
External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.
CVE-2025-59291 Alta · 8.2 CWE-73 14/10/2025
Confidential Azure Container Instances Elevation of Privilege Vulnerability
External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.
CVE-2025-59284 Média · 5.5 CWE-200 14/10/2025
Windows NTLM Spoofing Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally.