Export limit exceeded: 425860 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 11764 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 30292 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 30,292

Export CSV
CVE-2026-105509

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 11 26h1 Windows 11 26h1
CVE-2026-105507

Windows Installer Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-108469

Microsoft Authentication Library for JavaScript Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Authentication Library for JavaScript allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Authentication Library For Javascript
CVE-2026-109495

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-109504

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-119982

Visual Studio Code Security Feature Bypass Vulnerability

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2026-119981

Visual Studio Code Elevation of Privilege Vulnerability

Missing authentication for critical function in Visual Studio Code allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2026-119976

Visual Studio Code GitHub Pull Requests and Issues Extension Information Disclosure Vulnerability

External control of file name or path in Visual Studio Code - GitHub Pull Requests and Issues Extension allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2026-119975

Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2026-122194

Microsoft Defender Remote Code Execution Vulnerability

Null pointer dereference in Microsoft Defender allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Malware Protection Engine
CVE-2026-119985

Visual Studio Code Remote Code Execution Vulnerability

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2026-120780

Visual Studio Code Remote Code Execution Vulnerability

Improper access control in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2026-120779

Visual Studio Code Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2026-118750

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Microsoft
Products
Microsoft.aspnetcore.webutilities