cve.bz

microsoft vulnerabilities, newest first, page 71

Filter
  1. 7.9CVE-2026-48575EPSS 0.3%

    Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

  2. 7.8CVE-2026-48574EPSS 0.4%

    Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.

  3. 7.9CVE-2026-48573EPSS 1.0%

    No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

  4. 7.9CVE-2026-48570EPSS 0.3%

    Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

  5. 5.5CVE-2026-48569EPSS 0.4%

    Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

  6. 7.9CVE-2026-48568EPSS 0.3%

    Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

  7. 5.5CVE-2026-48566EPSS 0.4%

    Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

  8. 7.8CVE-2026-48565EPSS 0.4%

    Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

  9. 7.5CVE-2026-48563EPSS 0.5%

    Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  10. 4.6CVE-2026-48562EPSS 0.5%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  11. 5.4CVE-2026-48560EPSS 0.9%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  12. 7.9CVE-2026-47656EPSS 0.3%

    Protection mechanism failure in Windows Boot Manager allows an authorized attacker to bypass a security feature locally.

  13. 7.5CVE-2026-47654EPSS 0.5%

    Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  14. 8.8CVE-2026-47653EPSS 0.6%

    Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  15. 8.2CVE-2026-47652EPSS 0.3%

    Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

  16. 7.0CVE-2026-47648EPSS 0.2%

    Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.

  17. 9.8CVE-2026-47643EPSS 0.8%

    External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network.

  18. 5.4CVE-2026-47641EPSS 0.5%

    Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  19. 5.4CVE-2026-47640EPSS 0.5%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  20. 5.4CVE-2026-47639EPSS 0.5%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

  21. 5.4CVE-2026-47638EPSS 0.5%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  22. 5.4CVE-2026-47637EPSS 0.5%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  23. 5.4CVE-2026-47636EPSS 0.5%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

  24. 8.4CVE-2026-47635EPSS 0.3%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  25. 5.4CVE-2026-47634EPSS 0.6%

    Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  26. 5.4CVE-2026-47631EPSS 0.4%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

  27. 8.0CVE-2026-47298EPSS 0.7%

    Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  28. 7.0CVE-2026-47293EPSS 0.2%

    Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.

  29. 7.8CVE-2026-47292EPSS 0.4%

    Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

  30. 9.8CVE-2026-47291EPSS 25%

    Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.

  31. 8.8CVE-2026-47289EPSS 1.0%

    Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  32. 7.1CVE-2026-47288EPSS 0.5%

    Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network.

  33. 6.5CVE-2026-47287EPSS 0.8%

    Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.

  34. 6.5CVE-2026-47284EPSS 1.0%

    Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  35. 9.6CVE-2026-47281EPSS 0.8%

    Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

  36. 6.8CVE-2026-45658EPSS 0.4%

    Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature locally.

  37. 9.8CVE-2026-45657EPSS 15%

    Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.

  38. 7.8CVE-2026-45656EPSS 0.3%

    Protection mechanism failure in Windows UEFI allows an authorized attacker to bypass a security feature locally.

  39. 5.3CVE-2026-45655EPSS 0.4%

    Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

  40. 7.9CVE-2026-45654EPSS 0.3%

    Improper access control in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

  41. 7.0CVE-2026-45653EPSS 0.3%

    Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

  42. 4.3CVE-2026-45650EPSS 0.6%

    User interface (ui) misrepresentation of critical information in Microsoft Bing allows an unauthorized attacker to perform spoofing over a network.

  43. 7.1CVE-2026-45649EPSS 0.4%

    Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally.

  44. 8.8CVE-2026-45648EPSS 1.1%

    Stack-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.

  45. 7.0CVE-2026-45647EPSS 0.2%

    Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.

  46. 7.8CVE-2026-45645EPSS 0.4%

    Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

  47. 8.0CVE-2026-45644EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Live Share Canvas SDK allows an authorized attacker to elevate privileges over a network.

  48. 7.8CVE-2026-45643EPSS 0.4%

    Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  49. 3.9CVE-2026-45642EPSS 0.3%

    Improper input validation in Microsoft Azure Attestation service and Device Health Attestation Service allows an authorized attacker to perform spoofing with a physical attack.

  50. 7.8CVE-2026-45641EPSS 0.3%

    Access of resource using incompatible type ('type confusion') in Windows Hyper-V allows an unauthorized attacker to execute code locally.