By year
99
00
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Microsoft flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-96951 Microsoft Windows Command InjectionExploited since Oct 13, 2026 · CVSS 8.8
- CVE-2026-65660 Microsoft SharePoint Code InjectionExploited since Sep 25, 2026 · CVSS 8.8
- CVE-2026-85880 Microsoft Windows Heap-Based Buffer OverflowExploited since Sep 8, 2026 · CVSS 7.8
- CVE-2026-81963 Microsoft Windows Link FollowingExploited since Sep 8, 2026 · CVSS 7.8
- CVE-2019-1068 Microsoft SQL Server Remote Code ExecutionExploited since Aug 26, 2026 · CVSS 8.8
- CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double FreeExploited since Aug 18, 2026 · CVSS 9.8
- CVE-2026-55040 Microsoft SharePoint Weak AuthenticationExploited since Aug 18, 2026 · CVSS 9.1
- CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock Use-After-FreeExploited since Aug 11, 2026 · CVSS 7
- CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Exploited since Jul 22, 2026 · CVSS 9.8
- CVE-2026-58644 Microsoft SharePoint Deserialization of Untrusted DataExploited since Jul 16, 2026 · CVSS 9.8
- CVE-2026-56155 Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability Exploited since Jul 14, 2026 · CVSS 7.8
- CVE-2026-56164 Microsoft SharePoint Server Missing Authentication for Critical FunctionExploited since Jul 14, 2026 · CVSS 5.3
- CVE-2026-45659 Microsoft SharePoint Server Deserialization of Untrusted DataExploited since Jul 1, 2026 · ransomware · CVSS 8.8
- CVE-2010-0249 Microsoft Internet Explorer Use-After-FreeExploited since May 20, 2026 · CVSS 8.8
- CVE-2010-0806 Microsoft Internet Explorer Use-After-FreeExploited since May 20, 2026 · CVSS 8.8
- CVE-2008-4250 Microsoft Windows Buffer OverflowExploited since May 20, 2026 · CVSS 9.8
- CVE-2026-45498 Microsoft Defender Denial of ServiceExploited since May 20, 2026 · CVSS 4
- CVE-2009-1537 Microsoft DirectX NULL Byte OverwriteExploited since May 20, 2026 · CVSS 8.8
- CVE-2026-41091 Microsoft Defender Link FollowingExploited since May 20, 2026 · CVSS 7.8
- CVE-2026-42897 Microsoft Exchange Server Cross-Site ScriptingExploited since May 15, 2026 · CVSS 8.1
- CVE-2026-32202 Microsoft Windows Protection Mechanism FailureExploited since Apr 28, 2026 · CVSS 4.3
- CVE-2026-33825 Microsoft Defender Insufficient Granularity of Access ControlExploited since Apr 22, 2026 · ransomware · CVSS 7.8
- CVE-2009-0238 Microsoft Office Remote Code ExecutionExploited since Apr 14, 2026 · CVSS 8.8
- CVE-2026-32201 Microsoft SharePoint Server Improper Input ValidationExploited since Apr 14, 2026 · CVSS 6.5
- CVE-2025-60710 Microsoft Windows Link FollowingExploited since Apr 13, 2026 · ransomware · CVSS 7.8
- CVE-2023-36424 Microsoft Windows Out-of-Bounds ReadExploited since Apr 13, 2026 · CVSS 7.8
- CVE-2023-21529 Microsoft Exchange Server Deserialization of Untrusted DataExploited since Apr 13, 2026 · ransomware · CVSS 8.8
- CVE-2012-1854 Microsoft Visual Basic for Applications Insecure Library LoadingExploited since Apr 13, 2026 · CVSS 7.8
- CVE-2026-20963 Microsoft SharePoint Deserialization of Untrusted DataExploited since Mar 18, 2026 · CVSS 9.8
- CVE-2008-0015 Microsoft Windows Video ActiveX Control Remote Code ExecutionExploited since Feb 17, 2026 · CVSS 8.8
- CVE-2024-43468 Microsoft Configuration Manager SQL InjectionExploited since Feb 12, 2026 · CVSS 9.8
- CVE-2026-21510 Microsoft Windows Shell Protection Mechanism FailureExploited since Feb 10, 2026 · CVSS 8.8
- CVE-2026-21533 Microsoft Windows Improper Privilege ManagementExploited since Feb 10, 2026 · CVSS 7.8
- CVE-2026-21513 Microsoft MSHTML Framework Protection Mechanism FailureExploited since Feb 10, 2026 · CVSS 8.8
- CVE-2026-21514 Microsoft Office Word Reliance on Untrusted Inputs in a Security DecisionExploited since Feb 10, 2026 · CVSS 7.8
- CVE-2026-21519 Microsoft Windows Type ConfusionExploited since Feb 10, 2026 · CVSS 7.8
- CVE-2026-21525 Microsoft Windows NULL Pointer DereferenceExploited since Feb 10, 2026 · CVSS 6.2
- CVE-2026-21509 Microsoft Office Security Feature BypassExploited since Jan 26, 2026 · CVSS 7.8
- CVE-2026-20805 Microsoft Windows Information DisclosureExploited since Jan 13, 2026 · CVSS 5.5
- CVE-2009-0556 Microsoft Office PowerPoint Code InjectionExploited since Jan 7, 2026 · CVSS 8.8
- CVE-2025-62221 Microsoft Windows Use After FreeExploited since Dec 9, 2025 · CVSS 7.8
- CVE-2025-62215 Microsoft Windows Race ConditionExploited since Nov 12, 2025 · CVSS 7
- CVE-2025-59287 Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted DataExploited since Oct 24, 2025 · CVSS 9.8
- CVE-2025-33073 Microsoft Windows SMB Client Improper Access ControlExploited since Oct 20, 2025 · CVSS 8.8
- CVE-2025-59230 Microsoft Windows Improper Access ControlExploited since Oct 14, 2025 · CVSS 7.8
- CVE-2025-24990 Microsoft Windows Untrusted Pointer DereferenceExploited since Oct 14, 2025 · CVSS 7.8
- CVE-2013-3918 Microsoft Windows Out-of-Bounds WriteExploited since Oct 6, 2025 · CVSS 8.8
- CVE-2021-43226 Microsoft Windows Privilege EscalationExploited since Oct 6, 2025 · ransomware · CVSS 7.8
- CVE-2011-3402 Microsoft Windows Remote Code ExecutionExploited since Oct 6, 2025 · CVSS 8.8
- CVE-2010-3962 Microsoft Internet Explorer Uninitialized Memory CorruptionExploited since Oct 6, 2025 · CVSS 8.1
- CVE-2013-3893 Microsoft Internet Explorer Resource Management ErrorsExploited since Aug 12, 2025 · CVSS 8.8
- CVE-2007-0671 Microsoft Office Excel Remote Code ExecutionExploited since Aug 12, 2025 · CVSS 8.8
- CVE-2025-49704 Microsoft SharePoint Code InjectionExploited since Jul 22, 2025 · ransomware · CVSS 8.8
- CVE-2025-49706 Microsoft SharePoint Improper AuthenticationExploited since Jul 22, 2025 · ransomware · CVSS 6.5
- CVE-2025-53770 Microsoft SharePoint Deserialization of Untrusted DataExploited since Jul 20, 2025 · ransomware · CVSS 9.8
- CVE-2025-33053 Microsoft Windows External Control of File Name or PathExploited since Jun 10, 2025 · CVSS 8.8
- CVE-2025-32706 Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer OverflowExploited since May 13, 2025 · CVSS 7.8
- CVE-2025-32709 Microsoft Windows Ancillary Function Driver for WinSock Use-After-FreeExploited since May 13, 2025 · CVSS 7.8
- CVE-2025-32701 Microsoft Windows Common Log File System (CLFS) Driver Use-After-FreeExploited since May 13, 2025 · CVSS 7.8
- CVE-2025-30397 Microsoft Windows Scripting Engine Type ConfusionExploited since May 13, 2025 · CVSS 7.5
Latest high and critical flaws
- CVE-2026-62765 Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.High 7.5 · Oct 27, 2026
- CVE-2026-85898 Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 27, 2026
- CVE-2026-83831 Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 27, 2026
- CVE-2026-97785 Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.Critical 10 · Oct 22, 2026
- CVE-2026-96185 Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.High 7.5 · Oct 22, 2026
- CVE-2026-83938 Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.Critical 10 · Oct 22, 2026
- CVE-2026-110063 Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges Critical 10 · Oct 22, 2026
- CVE-2026-108456 Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.High 7.7 · Oct 22, 2026
- CVE-2026-105014 Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a neCritical 9.1 · Oct 22, 2026
- CVE-2026-109468 Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.High 7.5 · Oct 15, 2026
- CVE-2026-108452 Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code overHigh 8.8 · Oct 15, 2026
- CVE-2026-108451 Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
- CVE-2026-108450 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
- CVE-2026-108449 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
- CVE-2026-108448 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.High 7.5 · Oct 15, 2026
- CVE-2026-108447 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
- CVE-2026-108446 Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
- CVE-2026-108445 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
- CVE-2026-108444 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
- CVE-2026-108443 Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
- CVE-2026-108442 Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
- CVE-2026-108441 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
- CVE-2026-108440 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
- CVE-2026-108439 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
- CVE-2026-108437 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.High 8.8 · Oct 15, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.