Filtered by vendor Microsoft
Subscribe
Total
22989 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-32701 | 1 Microsoft | 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more | 2025-10-27 | N/A | 7.8 HIGH |
|
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-32706 | 1 Microsoft | 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more | 2025-10-27 | N/A | 7.8 HIGH |
|
Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-33053 | 1 Microsoft | 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more | 2025-10-27 | N/A | 8.8 HIGH |
|
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
|
|||||
| CVE-2025-33073 | 1 Microsoft | 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more | 2025-10-27 | N/A | 8.8 HIGH |
|
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
|
|||||
| CVE-2025-53770 | 1 Microsoft | 1 Sharepoint Server | 2025-10-27 | N/A | 9.8 CRITICAL |
|
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.
Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
|
|||||
| CVE-2025-49704 | 1 Microsoft | 1 Sharepoint Server | 2025-10-27 | N/A | 8.8 HIGH |
|
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
|
|||||
| CVE-2025-49706 | 1 Microsoft | 2 Sharepoint Enterprise Server, Sharepoint Server | 2025-10-27 | N/A | 6.5 MEDIUM |
|
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
|
|||||
| CVE-2025-55336 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2025-10-27 | N/A | 5.5 MEDIUM |
|
Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally.
|
|||||
| CVE-2025-55337 | 1 Microsoft | 3 Windows 11 24h2, Windows 11 25h2, Windows Server 2025 | 2025-10-27 | N/A | 6.1 MEDIUM |
|
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
|
|||||
| CVE-2025-55339 | 1 Microsoft | 7 Windows 11 22h2, Windows 11 23h2, Windows 11 24h2 and 4 more | 2025-10-27 | N/A | 7.8 HIGH |
|
Out-of-bounds read in Windows NDIS allows an authorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-55683 | 1 Microsoft | 5 Windows Server 2016, Windows Server 2019, Windows Server 2022 and 2 more | 2025-10-27 | N/A | 5.5 MEDIUM |
|
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.
|
|||||
| CVE-2025-55684 | 1 Microsoft | 3 Windows 11 24h2, Windows 11 25h2, Windows Server 2025 | 2025-10-27 | N/A | 7.0 HIGH |
|
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-55685 | 1 Microsoft | 9 Windows 10 21h2, Windows 10 22h2, Windows 11 22h2 and 6 more | 2025-10-27 | N/A | 7.0 HIGH |
|
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-55686 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2025-10-27 | N/A | 7.0 HIGH |
|
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-55687 | 1 Microsoft | 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more | 2025-10-27 | N/A | 7.4 HIGH |
|
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Resilient File System (ReFS) allows an unauthorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-53782 | 1 Microsoft | 1 Exchange Server | 2025-10-27 | N/A | 8.4 HIGH |
|
Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-55333 | 1 Microsoft | 14 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 11 more | 2025-10-27 | N/A | 6.1 MEDIUM |
|
Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
|
|||||
| CVE-2025-55332 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2025-10-27 | N/A | 6.1 MEDIUM |
|
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
|
|||||
| CVE-2025-55326 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2025-10-27 | N/A | 7.5 HIGH |
|
Use after free in Connected Devices Platform Service (Cdpsvc) allows an unauthorized attacker to execute code over a network.
|
|||||
| CVE-2025-55328 | 1 Microsoft | 14 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 11 more | 2025-10-27 | N/A | 7.8 HIGH |
|
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-55330 | 1 Microsoft | 6 Windows 11 22h2, Windows 11 23h2, Windows 11 24h2 and 3 more | 2025-10-27 | N/A | 6.1 MEDIUM |
|
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
|
|||||
| CVE-2025-55331 | 1 Microsoft | 9 Windows 10 21h2, Windows 10 22h2, Windows 11 22h2 and 6 more | 2025-10-27 | N/A | 7.0 HIGH |
|
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-55334 | 1 Microsoft | 4 Windows 11 22h2, Windows 11 23h2, Windows 11 24h2 and 1 more | 2025-10-27 | N/A | 6.2 MEDIUM |
|
Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally.
|
|||||
| CVE-2025-55335 | 1 Microsoft | 16 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 13 more | 2025-10-27 | N/A | 7.4 HIGH |
|
Use after free in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
|
|||||
| CVE-2022-47986 | 3 Ibm, Linux, Microsoft | 3 Aspera Faspex, Linux Kernel, Windows | 2025-10-27 | N/A | 9.8 CRITICAL |
|
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
|
|||||
| CVE-2025-36002 | 3 Ibm, Linux, Microsoft | 5 Aix, Sterling B2b Integrator, Sterling File Gateway and 2 more | 2025-10-25 | N/A | 5.5 MEDIUM |
|
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5, and 6.2.1.0 stores user credentials in configuration files which can be read by a local user.
|
|||||
| CVE-2020-16009 | 6 Cefsharp, Debian, Fedoraproject and 3 more | 8 Cefsharp, Debian Linux, Fedora and 5 more | 2025-10-24 | 6.8 MEDIUM | 8.8 HIGH |
|
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
|||||
| CVE-2025-55340 | 1 Microsoft | 9 Windows 10 21h2, Windows 10 22h2, Windows 11 22h2 and 6 more | 2025-10-24 | N/A | 7.0 HIGH |
|
Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a security feature locally.
|
|||||
| CVE-2025-55676 | 1 Microsoft | 3 Windows 11 24h2, Windows 11 25h2, Windows Server 2025 | 2025-10-24 | N/A | 5.5 MEDIUM |
|
Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally.
|
|||||
| CVE-2025-55677 | 1 Microsoft | 3 Windows 11 24h2, Windows 11 25h2, Windows Server 2025 | 2025-10-24 | N/A | 7.8 HIGH |
|
Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-55678 | 1 Microsoft | 16 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 13 more | 2025-10-24 | N/A | 7.0 HIGH |
|
Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-55679 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2025-10-24 | N/A | 5.1 MEDIUM |
|
Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally.
|
|||||
| CVE-2025-55680 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2025-10-24 | N/A | 7.8 HIGH |
|
Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-55681 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2025-10-24 | N/A | 7.0 HIGH |
|
Out-of-bounds read in Windows DWM allows an authorized attacker to elevate privileges locally.
|
|||||
| CVE-2025-55682 | 1 Microsoft | 3 Windows 11 24h2, Windows 11 25h2, Windows Server 2025 | 2025-10-24 | N/A | 6.1 MEDIUM |
|
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
|
|||||
| CVE-2025-6554 | 4 Apple, Google, Linux and 1 more | 4 Macos, Chrome, Linux Kernel and 1 more | 2025-10-24 | N/A | 8.1 HIGH |
|
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
|
|||||
| CVE-2022-2856 | 5 Apple, Fedoraproject, Google and 2 more | 6 Macos, Fedora, Android and 3 more | 2025-10-24 | N/A | 6.5 MEDIUM |
|
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.
|
|||||
| CVE-2022-4135 | 2 Google, Microsoft | 3 Chrome, Edge, Edge Chromium | 2025-10-24 | N/A | 9.6 CRITICAL |
|
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
|
|||||
| CVE-2023-6345 | 4 Debian, Fedoraproject, Google and 1 more | 4 Debian Linux, Fedora, Chrome and 1 more | 2025-10-24 | N/A | 9.6 CRITICAL |
|
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
|
|||||
| CVE-2023-3079 | 7 Apple, Couchbase, Debian and 4 more | 7 Macos, Couchbase Server, Debian Linux and 4 more | 2025-10-24 | N/A | 8.8 HIGH |
|
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
|
|||||