| CVE-2026-23658 | 8.6 | — | — | — | microsoft / azure devops | Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a | 218d ago |
| CVE-2026-69543 | 8.5 | — | — | — | microsoft / azure virtual machines | Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges o | 64d ago |
| CVE-2026-69419 | 8.5 | — | — | — | microsoft / azure data manager for energy | Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over | 64d ago |
| CVE-2026-56167 | 8.5 | — | — | — | microsoft / azure ai search | Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a n | 92d ago |
| CVE-2026-50340 | 8.5 | — | — | — | microsoft / windows 11 24h2 | Use after free in Windows Runtime allows an authorized attacker to elevate privileges over a network. | 101d ago |
| CVE-2026-70130 | 8.4 | — | — | — | microsoft / 365 apps | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 73d ago |
| CVE-2026-55045 | 8.4 | — | — | — | microsoft / 365 apps | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. | 101d ago |
| CVE-2026-54128 | 8.4 | — | — | — | microsoft / windows 10 1607 | Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally. | 101d ago |
| CVE-2026-54992 | 8.4 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute cod | 101d ago |
| CVE-2026-54122 | 8.4 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally. | 101d ago |
| CVE-2026-50520 | 8.4 | — | — | — | microsoft / visual studio code | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows a | 101d ago |
| CVE-2026-49184 | 8.4 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. | 101d ago |
| CVE-2026-47635 | 8.4 | — | — | — | microsoft / office 2024 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 136d ago |
| CVE-2026-45641 | 8.4 | — | — | — | microsoft / windows 10 21h2 | Access of resource using incompatible type ('type confusion') in Windows Hyper-V allows an unauthorized attacker t | 136d ago |
| CVE-2026-45607 | 8.4 | — | — | — | microsoft / windows 10 1607 | Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally. | 136d ago |
| CVE-2026-45482 | 8.4 | — | — | — | microsoft / visual studio code | Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio | 136d ago |
| CVE-2026-45474 | 8.4 | — | — | — | microsoft / 365 apps | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 136d ago |
| CVE-2026-45472 | 8.4 | — | — | — | microsoft / 365 apps | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 136d ago |
| CVE-2026-45463 | 8.4 | — | — | — | microsoft / 365 apps | Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally | 136d ago |
| CVE-2026-45461 | 8.4 | — | — | — | microsoft / 365 apps | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 136d ago |
| CVE-2026-45458 | 8.4 | — | — | — | microsoft / 365 apps | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 136d ago |
| CVE-2026-45456 | 8.4 | — | — | — | microsoft / 365 apps | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker | 136d ago |
| CVE-2026-44810 | 8.4 | — | — | — | microsoft / windows 11 23h2 | Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges lo | 136d ago |
| CVE-2026-41098 | 8.4 | — | — | — | microsoft / azure stack edge | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an | 136d ago |
| CVE-2026-40367 | 8.4 | — | — | — | microsoft / 365 apps | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized atta | 164d ago |
| CVE-2026-40366 | 8.4 | — | — | — | microsoft / 365 apps | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized atta | 164d ago |
| CVE-2026-40364 | 8.4 | — | — | — | microsoft / 365 apps | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized atta | 164d ago |
| CVE-2026-40363 | 8.4 | — | — | — | microsoft / 365 apps | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 164d ago |
| CVE-2026-40361 | 8.4 | — | — | — | microsoft / 365 apps | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 164d ago |
| CVE-2026-40358 | 8.4 | — | — | — | microsoft / 365 apps | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 164d ago |
| CVE-2026-72970 | 8.3 | — | — | — | microsoft / edge chromium | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over | 70d ago |
| CVE-2026-56179 | 8.3 | — | — | — | microsoft / windows 11 24h2 | Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform sp | 73d ago |
| CVE-2026-56181 | 8.3 | — | — | — | microsoft / windows 11 24h2 | Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform sp | 101d ago |
| CVE-2026-58596 | 8.3 | — | — | — | microsoft / edge chromium | Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privil | 103d ago |
| CVE-2026-58281 | 8.3 | — | — | — | microsoft / edge chromium | Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute co | 104d ago |
| CVE-2026-58295 | 8.3 | — | — | — | microsoft / edge chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho | 112d ago |
| CVE-2026-58288 | 8.3 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 112d ago |
| CVE-2026-58287 | 8.3 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 112d ago |
| CVE-2026-58285 | 8.3 | — | — | — | microsoft / edge chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho | 112d ago |
| CVE-2026-58284 | 8.3 | — | — | — | microsoft / edge chromium | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a n | 112d ago |
| CVE-2026-50521 | 8.3 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. | 114d ago |
| CVE-2026-35438 | 8.3 | — | — | — | microsoft / windows admin center | Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network. | 164d ago |
| CVE-2026-69306 | 8.2 | — | — | — | microsoft / visual studio code | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security f | 73d ago |
| CVE-2026-50528 | 8.2 | — | — | — | microsoft / .net | Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. | 101d ago |
| CVE-2026-50680 | 8.2 | — | — | — | microsoft / windows 10 1809 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | 101d ago |
| CVE-2026-50429 | 8.2 | — | — | — | microsoft / windows 10 1607 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network. | 101d ago |
| CVE-2026-50338 | 8.2 | — | — | — | microsoft / azure spring cloud | Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network. | 101d ago |
| CVE-2026-58525 | 8.2 | — | — | — | microsoft / edge chromium | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security fe | 107d ago |
| CVE-2026-47652 | 8.2 | — | — | — | microsoft / windows 11 23h2 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. | 136d ago |
| CVE-2026-45476 | 8.2 | — | — | — | microsoft / azure network adapter | Use after free in Linux MANA Driver allows an authorized attacker to elevate privileges locally. | 136d ago |
| CVE-2026-44822 | 8.2 | — | — | — | microsoft / 365 apps | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a networ | 136d ago |
| CVE-2026-33833 | 8.2 | — | — | — | microsoft / azure machine learning | Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machin | 164d ago |
| CVE-2026-71331 | 8.1 | — | — | — | microsoft / windows 10 1809 | Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execu | 73d ago |
| CVE-2026-70340 | 8.1 | — | — | — | microsoft / azure cyclecloud | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. | 73d ago |
| CVE-2026-66802 | 8.1 | — | — | — | microsoft / windows 10 1809 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Heal | 73d ago |
| CVE-2026-65796 | 8.1 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a | 73d ago |
| CVE-2026-65789 | 8.1 | — | — | — | microsoft / windows 10 1607 | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | 73d ago |
| CVE-2026-65679 | 8.1 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a | 73d ago |
| CVE-2026-63520exploited | 8.1 | 0.96% | 1/3 | +14d | microsoft / sharepoint server | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a ne | 73d ago |
| CVE-2026-62889 | 8.1 | — | — | — | microsoft / windows 10 1607 | Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code ove | 73d ago |
