Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.20%May 12, 2026
- High7.8Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.33%May 12, 2026
- High7.8Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.33%May 12, 2026
- High7.8Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.33%May 12, 2026
- High7.8Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.30%May 12, 2026
- High8.2Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform…Check if you run itEPSS 0.54%May 12, 2026
- Critical9.9Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.77%May 12, 2026
- Critical9.1The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implem…Check if you run itEPSS 0.50%May 12, 2026
- High8.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Check if you run itEPSS 2.29%May 12, 2026
- High8.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Check if you run itEPSS 2.29%May 12, 2026
- Medium4.4Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally.Check if you run itEPSS 0.26%May 12, 2026
- High7.8External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.36%May 12, 2026
- Medium5.5Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.Check if you run itEPSS 0.55%May 12, 2026
- High7.3Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.Check if you run itEPSS 0.57%May 12, 2026
- Medium4.3A tampering vulnerability exists when .NET Core improperly handles specially crafted files.Check if you run itEPSS 0.64%May 12, 2026
- Medium6.7Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.34%May 12, 2026
- High7.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to e…Check if you run itEPSS 0.32%May 12, 2026
- Medium6.7Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.32%May 12, 2026
- Medium6.5kafka-sink-azure-kusto Kafka Connect plugin is the official Microsoft sink for Azure Data Explorer (Kusto).Check if you run itEPSS 0.48%May 11, 2026
- Medium6.0Corteza contains a SQL injection vulnerability in its Microsoft SQL Server (MSSQL) backend when filtering Compose records by the meta field.This issue affects corteza: 2024.9.8.Check if you run itEPSS 0.28%May 11, 2026
- Medium5.5In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT This resolves the follow splat and lock-up…Check if you run itEPSS 0.16%May 8, 2026
- Critical9.3Nhost is an open source Firebase alternative with GraphQL.Check if you run itEPSS 0.91%May 8, 2026
- High7.5Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network.Check if you run itEPSS 1.17%May 7, 2026
- High8.1Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.69%May 7, 2026
- Critical10.0Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 1.08%May 7, 2026