Microsoft CVEs
14,257 CVEs and advisories name Microsoft as an affected vendor, 292 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-44817Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-42902Microsoft PowerToys Elevation of Privilege Vulnerability
- CVE-2026-34335Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-33828Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
- CVE-2026-40404Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-40409Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
- CVE-2026-45483Microsoft Office Project Server Spoofing Vulnerability
- CVE-2026-45485Microsoft Office Information Disclosure Vulnerability
- CVE-2026-45486Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-45479Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-45474Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-45471Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-45472Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-45475Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-45469Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-45468Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-45467Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-41108Windows DNS Client Elevation of Privilege Vulnerability
- CVE-2026-48579Microsoft Exchange Online Information Disclosure Vulnerability
- CVE-2026-47655Microsoft Graph Information Disclosure Vulnerability
- CVE-2026-47644Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability
- CVE-2026-45497Microsoft M365 Copilot Remote Code Execution Vulnerability
- CVE-2026-42824M365 Copilot Information Disclosure Vulnerability
- CVE-2026-48567Azure HorizonDB Elevation of Privilege Vulnerability
- CVE-2026-47294Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2026-46538Microsoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injection
- CVE-2026-46416Microsoft UFO shared WebSocket handler state causes cross-client response hijacking
- CVE-2026-46414Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking
- CVE-2026-46402Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directory
- CVE-2026-46544Microsoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requesters