Windows Server 2025
by Microsoft
CVEs (1,879)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-21308 | Med | 0.42 | 6.5 | 0.02 | Jan 14, 2025 | Windows Themes Spoofing Vulnerability | ||
| CVE-2025-21301 | Med | 0.42 | 6.5 | 0.02 | Jan 14, 2025 | Windows Geolocation Service Information Disclosure Vulnerability | ||
| CVE-2025-21288 | Med | 0.42 | 6.5 | 0.01 | Jan 14, 2025 | Windows COM Server Information Disclosure Vulnerability | ||
| CVE-2025-21272 | Med | 0.42 | 6.5 | 0.01 | Jan 14, 2025 | Windows COM Server Information Disclosure Vulnerability | ||
| CVE-2025-21217 | Med | 0.42 | 6.5 | 0.02 | Jan 14, 2025 | Windows NTLM Spoofing Vulnerability | ||
| CVE-2025-21193 | Med | 0.42 | 6.5 | 0.01 | Jan 14, 2025 | Active Directory Federation Server Spoofing Vulnerability | ||
| CVE-2025-60723 | Med | 0.41 | 6.3 | 0.01 | Nov 11, 2025 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service over a network. | ||
| CVE-2025-48813 | Med | 0.41 | 6.3 | 0.00 | Oct 14, 2025 | Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally. | ||
| CVE-2026-40380 | Med | 0.40 | 6.2 | 0.00 | May 12, 2026 | Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack. | ||
| CVE-2026-32088 | Med | 0.40 | 6.1 | 0.00 | Apr 14, 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an unauthorized attacker to bypass a security feature with a physical attack. | ||
| CVE-2026-32072 | Med | 0.40 | 6.2 | 0.00 | Apr 14, 2026 | Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally. | ||
| CVE-2026-26169 | Med | 0.40 | 6.1 | 0.02 | Apr 14, 2026 | Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally. | ||
| CVE-2026-25169 | Med | 0.40 | 6.2 | 0.00 | Mar 10, 2026 | Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally. | ||
| CVE-2026-25168 | Med | 0.40 | 6.2 | 0.00 | Mar 10, 2026 | Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally. | ||
| CVE-2026-20851 | Med | 0.40 | 6.2 | 0.01 | Jan 13, 2026 | Out-of-bounds read in Capability Access Management Service (camsvc) allows an unauthorized attacker to disclose information locally. | ||
| CVE-2026-20821 | Med | 0.40 | 6.2 | 0.01 | Jan 13, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally. | ||
| CVE-2026-20818 | Med | 0.40 | 6.2 | 0.01 | Jan 13, 2026 | Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally. | ||
| CVE-2025-59258 | Med | 0.40 | 6.2 | 0.01 | Oct 14, 2025 | Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally. | ||
| CVE-2025-55682 | Med | 0.40 | 6.1 | 0.00 | Oct 14, 2025 | Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | ||
| CVE-2025-55338 | Med | 0.40 | 6.1 | 0.03 | Oct 14, 2025 | Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
- risk 0.42cvss 6.5epss 0.02
Windows Themes Spoofing Vulnerability
- risk 0.42cvss 6.5epss 0.02
Windows Geolocation Service Information Disclosure Vulnerability
- risk 0.42cvss 6.5epss 0.01
Windows COM Server Information Disclosure Vulnerability
- risk 0.42cvss 6.5epss 0.01
Windows COM Server Information Disclosure Vulnerability
- risk 0.42cvss 6.5epss 0.02
Windows NTLM Spoofing Vulnerability
- risk 0.42cvss 6.5epss 0.01
Active Directory Federation Server Spoofing Vulnerability
- risk 0.41cvss 6.3epss 0.01
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service over a network.
- risk 0.41cvss 6.3epss 0.00
Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally.
- risk 0.40cvss 6.2epss 0.00
Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.
- risk 0.40cvss 6.1epss 0.00
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an unauthorized attacker to bypass a security feature with a physical attack.
- risk 0.40cvss 6.2epss 0.00
Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally.
- risk 0.40cvss 6.1epss 0.02
Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally.
- risk 0.40cvss 6.2epss 0.00
Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.
- risk 0.40cvss 6.2epss 0.00
Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.
- risk 0.40cvss 6.2epss 0.01
Out-of-bounds read in Capability Access Management Service (camsvc) allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 6.2epss 0.01
Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 6.2epss 0.01
Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 6.2epss 0.01
Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 6.1epss 0.00
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- risk 0.40cvss 6.1epss 0.03
Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
Page 63 of 94