Windows
by Microsoft
CVEs (2,699)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2010-3957 | Hig | 0.48 | 7.3 | 0.02 | Dec 16, 2010 | Double free vulnerability in the OpenType Font (OTF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges via a crafted OpenType font, aka… | ||
| CVE-2024-38239 | Hig | 0.47 | 7.2 | 0.02 | Sep 10, 2024 | Windows Kerberos Elevation of Privilege Vulnerability | ||
| CVE-2023-36399 | Hig | 0.47 | 7.1 | 0.08 | Nov 14, 2023 | Windows Storage Elevation of Privilege Vulnerability | ||
| CVE-2023-36584 | Med | 0.47 | 5.4 | 0.03 | KEV | Oct 10, 2023 | Windows Mark of the Web Security Feature Bypass Vulnerability | |
| CVE-2022-41049 | Med | 0.47 | 5.4 | 0.02 | KEV | Nov 9, 2022 | Windows Mark of the Web Security Feature Bypass Vulnerability | |
| CVE-2019-1252 | Med | 0.47 | 6.5 | 0.60 | Sep 11, 2019 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1286. | ||
| CVE-2017-11823 | Med | 0.47 | 6.7 | 0.03 | Oct 13, 2017 | The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security feature bypass by the way it handles Windows PowerShell sessions, aka "Microsoft Windows Security Feature Bypass". | ||
| CVE-2016-3319 | Hig | 0.47 | 7.0 | 0.19 | Aug 9, 2016 | The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote Code Execution Vulnerability." | ||
| CVE-2026-73005 | Hig | 0.46 | 7.0 | 0.00 | Sep 8, 2026 | Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-70565 | Hig | 0.46 | 7.0 | 0.00 | Sep 8, 2026 | Use after free in Windows AF_UNIX Socket Provider allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-69834 | Hig | 0.46 | 7.0 | 0.00 | Sep 8, 2026 | Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-69706 | Hig | 0.46 | 7.1 | 0.00 | Sep 8, 2026 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network. | ||
| CVE-2026-69501 | Hig | 0.46 | 7.0 | 0.00 | Sep 8, 2026 | Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-69333 | Hig | 0.46 | 7.0 | 0.00 | Sep 8, 2026 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-69274 | Hig | 0.46 | 7.1 | 0.00 | Sep 8, 2026 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network. | ||
| CVE-2026-65678 | Hig | 0.46 | 7.0 | 0.00 | Aug 11, 2026 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-59126 | Hig | 0.46 | 7.0 | 0.00 | Aug 11, 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Event Logging Service allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-50472 | Hig | 0.46 | 7.0 | 0.00 | Aug 11, 2026 | Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-34347 | Hig | 0.46 | 7.0 | 0.00 | May 12, 2026 | Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-34331 | Hig | 0.46 | 7.0 | 0.00 | May 12, 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
- risk 0.48cvss 7.3epss 0.02
Double free vulnerability in the OpenType Font (OTF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges via a crafted OpenType font, aka…
- risk 0.47cvss 7.2epss 0.02
Windows Kerberos Elevation of Privilege Vulnerability
- risk 0.47cvss 7.1epss 0.08
Windows Storage Elevation of Privilege Vulnerability
- risk 0.47cvss 5.4epss 0.03
Windows Mark of the Web Security Feature Bypass Vulnerability
- risk 0.47cvss 5.4epss 0.02
Windows Mark of the Web Security Feature Bypass Vulnerability
- risk 0.47cvss 6.5epss 0.60
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1286.
- risk 0.47cvss 6.7epss 0.03
The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security feature bypass by the way it handles Windows PowerShell sessions, aka "Microsoft Windows Security Feature Bypass".
- risk 0.47cvss 7.0epss 0.19
The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote Code Execution Vulnerability."
- risk 0.46cvss 7.0epss 0.00
Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.0epss 0.00
Use after free in Windows AF_UNIX Socket Provider allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.0epss 0.00
Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.1epss 0.00
Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network.
- risk 0.46cvss 7.0epss 0.00
Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.0epss 0.00
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.1epss 0.00
Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network.
- risk 0.46cvss 7.0epss 0.00
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.0epss 0.00
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.0epss 0.00
Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.0epss 0.00
Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.0epss 0.00
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
Page 62 of 135