Windows
by Microsoft
CVEs (2,757)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-8710 | Med | 0.37 | 5.5 | 0.10 | Sep 13, 2017 | The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbitrary files via an XML external entity (XXE) declaration, due to the way that the Microsoft Common Console Document (.msc) parses XML input… | ||
| CVE-2017-0007 | Med | 0.37 | 5.5 | 0.11 | Mar 17, 2017 | Device Guard in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to modify PowerShell script without invalidating associated signatures, aka "PowerShell Security Feature Bypass Vulnerability." | ||
| CVE-2026-96865 | Med | 0.36 | 5.6 | — | Oct 13, 2026 | Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally. | ||
| CVE-2026-70294 | Med | 0.36 | 5.5 | — | Oct 13, 2026 | Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | ||
| CVE-2026-70288 | Med | 0.36 | 5.5 | — | Oct 13, 2026 | Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | ||
| CVE-2026-70284 | Med | 0.36 | 5.5 | — | Oct 13, 2026 | Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | ||
| CVE-2026-70211 | Med | 0.36 | 5.5 | — | Oct 13, 2026 | Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | ||
| CVE-2026-70017 | Med | 0.36 | 5.5 | — | Oct 13, 2026 | Access of resource using incompatible type ('type confusion') in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally. | ||
| CVE-2026-70290 | Med | 0.36 | 5.5 | 0.00 | Sep 8, 2026 | Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | ||
| CVE-2026-69770 | Med | 0.36 | 5.5 | 0.00 | Sep 8, 2026 | Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally. | ||
| CVE-2026-69741 | Med | 0.36 | 5.5 | 0.00 | Sep 8, 2026 | Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally. | ||
| CVE-2026-69390 | Med | 0.36 | 5.5 | 0.00 | Sep 8, 2026 | Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally. | ||
| CVE-2026-69286 | Med | 0.36 | 5.5 | 0.00 | Sep 8, 2026 | Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to disclose information locally. | ||
| CVE-2026-61347 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally. | ||
| CVE-2026-59136 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally. | ||
| CVE-2026-32216 | Med | 0.36 | 5.5 | 0.00 | Apr 14, 2026 | Null pointer dereference in Windows Redirected Drive Buffering allows an authorized attacker to deny service locally. | ||
| CVE-2026-32181 | Med | 0.36 | 5.5 | 0.00 | Apr 14, 2026 | Improper privilege management in Microsoft Windows allows an authorized attacker to deny service locally. | ||
| CVE-2026-32085 | Med | 0.36 | 5.5 | 0.00 | Apr 14, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an authorized attacker to disclose information locally. | ||
| CVE-2025-21374 | Med | 0.36 | 5.5 | 0.01 | Jan 14, 2025 | Windows CSC Service Information Disclosure Vulnerability | ||
| CVE-2025-21336 | Med | 0.36 | 5.6 | 0.01 | Jan 14, 2025 | Windows Cryptographic Information Disclosure Vulnerability |
- risk 0.37cvss 5.5epss 0.10
The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbitrary files via an XML external entity (XXE) declaration, due to the way that the Microsoft Common Console Document (.msc) parses XML input…
- risk 0.37cvss 5.5epss 0.11
Device Guard in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to modify PowerShell script without invalidating associated signatures, aka "PowerShell Security Feature Bypass Vulnerability."
- risk 0.36cvss 5.6epss —
Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss —
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss —
Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss —
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss —
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss —
Access of resource using incompatible type ('type confusion') in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Null pointer dereference in Windows Redirected Drive Buffering allows an authorized attacker to deny service locally.
- risk 0.36cvss 5.5epss 0.00
Improper privilege management in Microsoft Windows allows an authorized attacker to deny service locally.
- risk 0.36cvss 5.5epss 0.00
Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.01
Windows CSC Service Information Disclosure Vulnerability
- risk 0.36cvss 5.6epss 0.01
Windows Cryptographic Information Disclosure Vulnerability
Page 80 of 138