Microsoft vulnerabilities, page 5
17,342 vulnerabilities
Known vulnerabilities in Microsoft products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2,371 products.
CVE-2026-97799microsoftwindows_11_24h2+7
EPSS score0.29%
Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-97798microsoftwindows_10_21h2+16EPSS score0.34%
Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.CVE-2026-97794microsoftwindows_11_23h2+12EPSS score0.31%
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.CVE-2026-97793microsoftwindows_10_1809+20EPSS score0.24%
Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.CVE-2026-97792microsoftwindows_11_23h2+10EPSS score0.30%
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.CVE-2026-97790microsoftwindows_11_24h2+10EPSS score0.36%
Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.CVE-2026-97789microsoftwindows 10 version 1607+19EPSS score0.56%
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-97788microsoftmicrosoft .net framework 3.5+37EPSS score0.68%
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.CVE-2026-97787microsoftwindows_11_23h2+12EPSS score0.20%
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.CVE-2026-97783microsoftmicrosoft sharepoint server 2019+1EPSS score0.50%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.CVE-2026-97782microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.53%
Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.CVE-2026-97781microsoft365_apps+1EPSS score0.76%
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.CVE-2026-97780microsoft365_apps+10EPSS score0.78%
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97779microsoft365_apps+10EPSS score0.83%
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-97778microsoft365_apps+10EPSS score0.59%
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97777microsoft365_apps+10EPSS score0.72%
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97776microsoft365_apps+10EPSS score0.78%
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97775microsoft365_apps+10EPSS score0.72%
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-97774microsoft365_apps+1EPSS score0.18%
Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.CVE-2026-97773microsoft365_apps+10EPSS score0.72%
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.