Filtered by vendor Microsoft Subscriptions
Total 23051 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-62455 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-01-28 7.8 High
Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
CVE-2025-64666 1 Microsoft 4 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 1 more 2026-01-28 7.5 High
Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-64667 1 Microsoft 4 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 1 more 2026-01-28 5.3 Medium
User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-62563 1 Microsoft 11 365 Apps, Excel, Excel 2016 and 8 more 2026-01-28 7.8 High
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62458 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-01-28 7.8 High
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVE-2026-23889 2 Microsoft, Pnpm 2 Windows, Pnpm 2026-01-28 6.5 Medium
pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for `./` but not `.\`. On Windows, backslashes are directory separators, enabling path traversal. This vulnerability is Windows-only. This issue impacts Windows pnpm users and Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps). It can lead to overwriting `.npmrc`, build configs, or other files. Version 10.28.1 contains a patch.
CVE-2024-1545 3 Linux, Microsoft, Wolfssl 4 Linux Kernel, Windows, Wolfcrypt and 1 more 2026-01-28 5.9 Medium
Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the RsaKey structure.
CVE-2026-22035 3 Getgreenshot, Greenshot, Microsoft 3 Greenshot, Greenshot, Windows 2026-01-27 7.8 High
Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.
CVE-2021-47828 2 Microsoft, Weird Solutions 2 Windows, Bootpturbo 2026-01-26 7.8 High
BOOTP Turbo 2.0.0.1253 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path to execute arbitrary code with elevated LocalSystem privileges during system startup or reboot.
CVE-2020-36934 1 Microsoft 1 Windows 2026-01-26 7.8 High
Deep Instinct Windows Agent 1.2.24.0 contains an unquoted service path vulnerability in the DeepNetworkService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files\HP Sure Sense\DeepNetworkService.exe to inject malicious code that would execute with LocalSystem permissions during service startup.
CVE-2025-54313 5 Alexghr, Homarr, Microsoft and 2 more 8 Got-fetch, Homarr, Windows and 5 more 2026-01-23 7.5 High
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
CVE-2026-0747 2 Devolutions, Microsoft 2 Remote Desktop Manager, Windows 2026-01-22 3.3 Low
Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external observer to view a password on screen via a defective masking feature, for example during physical observation or screen sharing.
CVE-2022-46764 2 Microsoft, Trueconf 2 Windows, Server 2026-01-21 9.8 Critical
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6) allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution.
CVE-2022-46763 2 Microsoft, Trueconf 2 Windows, Server 2026-01-21 8.8 High
A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6) allows a low-privileged database user to execute arbitrary SQL commands as the database administrator, resulting in execution of arbitrary code.
CVE-2025-26627 1 Microsoft 1 Azure Arc 2026-01-21 7 High
Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally.
CVE-2025-10215 2 Microsoft, Updf 2 Windows, Updf 2026-01-20 7.8 High
DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a FREngine.dll file of their choice in the 'C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\' directory, which could lead to arbitrary code execution and persistence.
CVE-2025-10198 2 Lizardbyte, Microsoft 2 Sunshine, Windows 2026-01-20 7.8 High
Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories.
CVE-2025-63916 2 Luotengyuan, Microsoft 2 Myscreentools, Windows 2026-01-17 8.1 High
MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properly sanitize user-supplied file paths before passing them to cmd.exe, allowing attackers to execute arbitrary system commands with the privileges of the user running the application. The vulnerability exists in the CMD() function within GIFSicleTool\Form_gif_sicle_tool.cs, which constructs shell commands by concatenating unsanitized user input (file paths) and executes them via cmd.exe.
CVE-2024-58315 2 Microsoft, Tosi 2 Windows, Tosibox Key 2026-01-16 7.8 High
Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the service startup process by inserting malicious code in the system root path, enabling unauthorized code execution during application startup or system reboot.
CVE-2022-50696 3 Linux, Microsoft, Sound4 23 Linux, Windows, Big Voice2 and 20 more 2026-01-16 9.8 Critical
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.