Filtered by vendor Microsoft
Subscriptions
Total
29131 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-24303 | 1 Microsoft | 1 Partner Center | 2026-10-14 | 9.6 Critical |
| Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-32078 | 1 Microsoft | 22 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 19 more | 2026-10-14 | 7.8 High |
| Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-32225 | 1 Microsoft | 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more | 2026-10-14 | 8.8 High |
| Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-32176 | 1 Microsoft | 18 Microsoft Sql Server 2016 Service Pack 3 (gdr), Microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft Sql Server 2017 (cu 31) and 15 more | 2026-10-14 | 6.7 Medium |
| Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-32074 | 1 Microsoft | 22 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 19 more | 2026-10-14 | 7.8 High |
| Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-32070 | 1 Microsoft | 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more | 2026-10-14 | 7 High |
| Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-32069 | 1 Microsoft | 22 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 19 more | 2026-10-14 | 7.8 High |
| Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2015-6093 | 1 Microsoft | 4 Office, Office Web Apps, Office Web Apps Server and 1 more | 2026-10-14 | N/A |
| Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." | ||||
| CVE-2015-2468 | 1 Microsoft | 7 Office, Office Compatibility Pack, Sharepoint Server and 4 more | 2026-10-14 | N/A |
| Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." | ||||
| CVE-2015-0085 | 1 Microsoft | 11 Excel, Excel Viewer, Office and 8 more | 2026-10-14 | N/A |
| Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 Gold and SP1, Word 2013 Gold and SP1, Office 2013 RT Gold and SP1, Word 2013 RT Gold and SP1, Excel Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Excel Services on SharePoint Server 2013 Gold and SP1, Word Automation Services on SharePoint Server 2013 Gold and SP1, Web Applications 2010 SP2, Office Web Apps Server 2010 SP2, Web Apps Server 2013 Gold and SP1, SharePoint Server 2007 SP3, Windows SharePoint Services 3.0 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability." | ||||
| CVE-2026-70268 | 1 Microsoft | 13 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 10 more | 2026-10-14 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-70269 | 1 Microsoft | 13 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 10 more | 2026-10-14 | 8.1 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-105718 | 1 Microsoft | 8 365 Apps, Microsoft 365, Office 2021 and 5 more | 2026-10-14 | 8.8 High |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-70287 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-10-14 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-70263 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-10-14 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-69922 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-14 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-70214 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-14 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-72923 | 1 Microsoft | 2 Openapi.readers, Openapi.yamlreader | 2026-10-14 | 7.5 High |
| The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.11.0 and 3.0.0 through 3.9.0, parsing a YAML OpenAPI document with nested anchors and aliases can consume uncontrolled memory. SharpYaml represents aliases as shared nodes in a small directed acyclic graph, but conversion to independent OpenAPI or System.Text.Json.Nodes.JsonNode trees duplicates every aliased path; without a node-count or nesting-depth limit, N nested anchors referenced k times can require k^N materialized nodes and terminate the process through an out-of-memory condition. The fixed readers bound materialization to 5,000,000 nodes and a nesting depth of 64 by default and report an OpenApiDiagnostic error when a limit is exceeded. This vulnerability is fixed in Microsoft.OpenApi.Readers 1.6.30 and Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0. | ||||
| CVE-2026-70206 | 1 Microsoft | 13 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 10 more | 2026-10-14 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-105715 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-10-14 | 7.5 High |
| Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||