Windows Server 2019
by Microsoft
CVEs (4,947)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-1053 | Med | 0.41 | 6.3 | 0.01 | Jun 12, 2019 | An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts. An attacker who successfully exploited the vulnerability could elevate privileges by escaping a sandbox. To exploit this vulnerability, an attacker would require… | ||
| CVE-2019-0986 | Med | 0.41 | 6.3 | 0.02 | Jun 12, 2019 | An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker… | ||
| CVE-2026-40380 | Med | 0.40 | 6.2 | 0.00 | May 12, 2026 | Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack. | ||
| CVE-2026-32088 | Med | 0.40 | 6.1 | 0.00 | Apr 14, 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an unauthorized attacker to bypass a security feature with a physical attack. | ||
| CVE-2026-32072 | Med | 0.40 | 6.2 | 0.00 | Apr 14, 2026 | Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally. | ||
| CVE-2026-26169 | Med | 0.40 | 6.1 | 0.02 | Apr 14, 2026 | Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally. | ||
| CVE-2026-25169 | Med | 0.40 | 6.2 | 0.00 | Mar 10, 2026 | Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally. | ||
| CVE-2026-25168 | Med | 0.40 | 6.2 | 0.00 | Mar 10, 2026 | Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally. | ||
| CVE-2026-20821 | Med | 0.40 | 6.2 | 0.01 | Jan 13, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally. | ||
| CVE-2026-20818 | Med | 0.40 | 6.2 | 0.01 | Jan 13, 2026 | Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally. | ||
| CVE-2025-59258 | Med | 0.40 | 6.2 | 0.01 | Oct 14, 2025 | Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally. | ||
| CVE-2025-55338 | Med | 0.40 | 6.1 | 0.03 | Oct 14, 2025 | Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | ||
| CVE-2025-55333 | Med | 0.40 | 6.1 | 0.01 | Oct 14, 2025 | Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | ||
| CVE-2025-55332 | Med | 0.40 | 6.1 | 0.01 | Oct 14, 2025 | Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | ||
| CVE-2025-47980 | Med | 0.40 | 6.2 | 0.01 | Jul 8, 2025 | Exposure of sensitive information to an unauthorized actor in Windows Imaging Component allows an unauthorized attacker to disclose information locally. | ||
| CVE-2025-30394 | Med | 0.40 | 5.9 | 0.30 | May 13, 2025 | Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network. | ||
| CVE-2025-29957 | Med | 0.40 | 6.2 | 0.01 | May 13, 2025 | Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to deny service locally. | ||
| CVE-2025-21278 | Med | 0.40 | 6.2 | 0.01 | Jan 14, 2025 | Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability | ||
| CVE-2025-21202 | Med | 0.40 | 6.1 | 0.01 | Jan 14, 2025 | Windows Recovery Environment Agent Elevation of Privilege Vulnerability | ||
| CVE-2024-38203 | Med | 0.40 | 6.2 | 0.01 | Nov 12, 2024 | Windows Package Library Manager Information Disclosure Vulnerability |
- risk 0.41cvss 6.3epss 0.01
An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts. An attacker who successfully exploited the vulnerability could elevate privileges by escaping a sandbox. To exploit this vulnerability, an attacker would require…
- risk 0.41cvss 6.3epss 0.02
An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker…
- risk 0.40cvss 6.2epss 0.00
Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.
- risk 0.40cvss 6.1epss 0.00
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an unauthorized attacker to bypass a security feature with a physical attack.
- risk 0.40cvss 6.2epss 0.00
Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally.
- risk 0.40cvss 6.1epss 0.02
Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally.
- risk 0.40cvss 6.2epss 0.00
Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.
- risk 0.40cvss 6.2epss 0.00
Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.
- risk 0.40cvss 6.2epss 0.01
Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 6.2epss 0.01
Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 6.2epss 0.01
Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 6.1epss 0.03
Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- risk 0.40cvss 6.1epss 0.01
Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- risk 0.40cvss 6.1epss 0.01
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- risk 0.40cvss 6.2epss 0.01
Exposure of sensitive information to an unauthorized actor in Windows Imaging Component allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 5.9epss 0.30
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
- risk 0.40cvss 6.2epss 0.01
Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to deny service locally.
- risk 0.40cvss 6.2epss 0.01
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
- risk 0.40cvss 6.1epss 0.01
Windows Recovery Environment Agent Elevation of Privilege Vulnerability
- risk 0.40cvss 6.2epss 0.01
Windows Package Library Manager Information Disclosure Vulnerability
Page 196 of 248