Microsoft

5956 CVEs tracked in the last 90 days

5956 Total CVEs

1534 Critical

2606 High

1671 Medium

145 Low

Severity Distribution

Critical 1534 (25.8%)

High 2606 (43.8%)

Medium 1671 (28.1%)

Low 145 (2.4%)

Top Affected Products

microsoft internet explorer 1477

Microsoft Windows 11 version 26H1 693

Microsoft Windows 11 Version 24H2 691

Microsoft Windows 11 Version 25H2 689

microsoft office 592

Microsoft Windows 10 Version 21H2 590

Microsoft Windows 10 Version 1809 588

Microsoft Windows 10 Version 22H2 588

CVSS Score Distribution

Latest CVEs

CVE ID	Severity	CVSS	Description	Published	Modified
CVE-2026-84452	medium	—	Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models …	Sep 2, 2026	Sep 3, 2026
CVE-2026-72984	high	8.8	Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) all…	Aug 28, 2026	Sep 1, 2026
CVE-2026-70331	medium	5.4	Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthor…	Aug 28, 2026	Sep 1, 2026
CVE-2026-70309	medium	5.4	Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass…	Aug 28, 2026	Aug 31, 2026
CVE-2026-66798	medium	4.3	Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code ov…	Aug 28, 2026	Sep 1, 2026
CVE-2026-66324	medium	6.5	External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized atta…	Aug 28, 2026	Aug 31, 2026
CVE-2026-66323	medium	5.4	Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows a…	Aug 28, 2026	Aug 31, 2026
CVE-2026-62904	medium	5.4	Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclo…	Aug 28, 2026	Aug 31, 2026
CVE-2026-58616	medium	4.4	Concurrent execution using shared resource with improper synchronization ('race condition') in Copil…	Aug 28, 2026	Aug 31, 2026
CVE-2026-62316	high	8.8	Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t…	Aug 21, 2026	Aug 25, 2026
CVE-2026-69851	critical	9.9	Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevat…	Aug 20, 2026	Aug 25, 2026
CVE-2026-69836	critical	10.0	Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute c…	Aug 20, 2026	Aug 25, 2026
CVE-2026-69558	high	8.6	Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized …	Aug 20, 2026	Aug 25, 2026
CVE-2026-69555	critical	10.0	Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a ne…	Aug 20, 2026	Aug 24, 2026
CVE-2026-69543	high	8.5	Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevat…	Aug 20, 2026	Aug 26, 2026
CVE-2026-69519	high	8.6	Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose infor…	Aug 20, 2026	Aug 25, 2026
CVE-2026-69400	critical	9.6	Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps a…	Aug 20, 2026	Aug 24, 2026
CVE-2026-68789	critical	9.9	Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Da…	Aug 20, 2026	Aug 24, 2026
CVE-2026-68782	critical	9.9	Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Da…	Aug 20, 2026	Aug 24, 2026
CVE-2026-66800	high	8.6	Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose…	Aug 20, 2026	Aug 24, 2026
CVE-2026-66309	critical	9.1	Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges ov…	Aug 20, 2026	Aug 24, 2026
CVE-2026-65816	critical	10.0	Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevat…	Aug 20, 2026	Aug 24, 2026
CVE-2026-65801	critical	10.0	Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to e…	Aug 20, 2026	Aug 24, 2026
CVE-2026-65770	critical	10.0	Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed …	Aug 20, 2026	Aug 25, 2026
CVE-2026-62834	critical	9.3	Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attack…	Aug 20, 2026	Aug 24, 2026