| CVE-2026-54118 | 9.8 | — | — | — | microsoft / sql server 2016 | Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | 101d ago |
| CVE-2026-54117 | 9.8 | — | — | — | microsoft / sql server 2016 | Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | 101d ago |
| CVE-2026-50522exploited | 9.8 | 3.0% | 3/3 | +6d | microsoft / sharepoint server | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code o | 101d ago |
| CVE-2026-49172 | 9.8 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network. | 101d ago |
| CVE-2026-42990 | 9.8 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a networ | 101d ago |
| CVE-2026-54130 | 9.8 | — | — | — | microsoft / 365 copilot | Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose informati | 127d ago |
| CVE-2026-47643 | 9.8 | — | — | — | microsoft / azure stack edge | External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a n | 136d ago |
| CVE-2026-47291 | 9.8 | — | — | — | microsoft / windows 10 1607 | Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network. | 136d ago |
| CVE-2026-45657 | 9.8 | — | — | — | microsoft / windows 11 23h2 | Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network. | 136d ago |
| CVE-2026-44815 | 9.8 | — | — | — | microsoft / windows 10 1607 | Stack-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to execute code over a network. | 136d ago |
| CVE-2026-26142 | 9.8 | — | — | — | microsoft / nuance powerscribe 360 | Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a net | 136d ago |
| CVE-2026-41096 | 9.8 | — | — | — | microsoft / windows 11 23h2 | Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network | 164d ago |
| CVE-2026-41089exploited | 9.8 | 0.97% | 1/3 | +17d | microsoft / windows server 2012 | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. | 164d ago |
| CVE-2026-32194 | 9.8 | — | — | — | microsoft / bing images | Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allow | 218d ago |
| CVE-2026-32191 | 9.8 | — | — | — | microsoft / bing images | Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Image | 218d ago |
| CVE-2026-69400 | 9.6 | — | — | — | microsoft / azure logic apps | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unaut | 64d ago |
| CVE-2026-70332 | 9.6 | — | — | — | microsoft / sharepoint online | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoin | 78d ago |
| CVE-2026-62896 | 9.6 | — | — | — | microsoft / teams | Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network. | 78d ago |
| CVE-2026-56161 | 9.6 | — | — | — | microsoft / azure logic apps | Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network. | 78d ago |
| CVE-2026-50380 | 9.6 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. | 101d ago |
| CVE-2026-55008 | 9.6 | — | — | — | microsoft / exchange server | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server | 101d ago |
| CVE-2026-48561 | 9.6 | — | — | — | microsoft / 365 copilot | Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edg | 101d ago |
| CVE-2026-48582 | 9.6 | — | — | — | microsoft / exchange online | Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a netw | 126d ago |
| CVE-2026-47281 | 9.6 | — | — | — | microsoft / visual studio code | Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. | 136d ago |
| CVE-2026-42904 | 9.6 | — | — | — | microsoft / windows 10 21h2 | Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacen | 136d ago |
| CVE-2026-41615 | 9.6 | — | — | — | microsoft / authenticator | Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attac | 162d ago |
| CVE-2026-50516 | 9.4 | — | — | — | microsoft / azure kubernetes service | Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker | 73d ago |
| CVE-2026-62834 | 9.3 | — | — | — | microsoft / azure data factory | Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate | 64d ago |
| CVE-2026-70306 | 9.3 | — | — | — | microsoft / sharepoint server | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoin | 73d ago |
| CVE-2026-59118 | 9.3 | — | — | — | microsoft / power apps | Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network. | 78d ago |
| CVE-2026-62835 | 9.3 | — | — | — | microsoft / azure portal | Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network. | 91d ago |
| CVE-2026-49798 | 9.3 | — | — | — | microsoft / windows 10 1607 | Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally. | 101d ago |
| CVE-2026-47646 | 9.3 | — | — | — | microsoft / dynamics 365 customer voice | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voic | 107d ago |
| CVE-2026-41106 | 9.3 | — | — | — | microsoft / 365 copilot | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate pri | 113d ago |
| CVE-2026-41090 | 9.3 | — | — | — | microsoft / 365 copilot | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an | 154d ago |
| CVE-2026-40402 | 9.3 | — | — | — | microsoft / windows 11 23h2 | Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally. | 164d ago |
| CVE-2026-40379 | 9.3 | — | — | — | microsoft / entra id | Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to pe | 164d ago |
| CVE-2026-66309 | 9.1 | — | — | — | microsoft / azure sql database | Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network. | 64d ago |
| CVE-2026-68823 | 9.1 | — | — | — | microsoft / azure confidential ledger | Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code ov | 78d ago |
| CVE-2026-56160 | 9.1 | — | — | — | microsoft / azure red hat openshift | Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a | 92d ago |
| CVE-2026-55040exploited | 9.1 | 69.5% | 3/3 | +29d | microsoft / sharepoint server | Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature ov | 101d ago |
| CVE-2025-62821 | 9.1 | — | — | — | microsoft / heif image extension | Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can retu | 126d ago |
| CVE-2026-45602 | 9.1 | — | — | — | microsoft / windows 10 1607 | No cwe for this issue in Windows DHCP Server allows an unauthorized attacker to perform tampering over a network. | 136d ago |
| CVE-2026-48579 | 9.1 | — | — | — | microsoft / exchange online | Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a | 141d ago |
| CVE-2026-33843 | 9.1 | — | — | — | microsoft / entra id | Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unautho | 154d ago |
| CVE-2026-42833 | 9.1 | — | — | — | microsoft / dynamics 365 | Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an author | 164d ago |
| CVE-2026-41103 | 9.1 | — | — | — | microsoft / confluence saml sso | Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an u | 164d ago |
| CVE-2026-33117 | 9.1 | — | — | — | microsoft / azure sdk for java | The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verificatio | 164d ago |
| CVE-2026-58289 | 9 | — | — | — | microsoft / edge chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho | 112d ago |
| CVE-2026-72984 | 8.8 | — | — | — | microsoft / edge chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho | 56d ago |
| CVE-2026-70337 | 8.8 | — | — | — | microsoft / powershell | Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a networ | 73d ago |
| CVE-2026-70336 | 8.8 | — | — | — | microsoft / visual studio code | Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to | 73d ago |
| CVE-2026-70329 | 8.8 | — | — | — | microsoft / 365 apps | Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a | 73d ago |
| CVE-2026-70326 | 8.8 | — | — | — | microsoft / sharepoint server | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privile | 73d ago |
| CVE-2026-70324 | 8.8 | — | — | — | microsoft / sharepoint server | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privile | 73d ago |
| CVE-2026-70321 | 8.8 | — | — | — | microsoft / sharepoint server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code ove | 73d ago |
| CVE-2026-69320 | 8.8 | — | — | — | microsoft / visual studio code | Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code a | 73d ago |
| CVE-2026-66808 | 8.8 | — | — | — | microsoft / sharepoint server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code ove | 73d ago |
| CVE-2026-66805 | 8.8 | — | — | — | microsoft / sharepoint server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code ove | 73d ago |
| CVE-2026-65815 | 8.8 | — | — | — | microsoft / dynamics 365 | Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute | 73d ago |
