CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
Microsoft has 18,911 CVEs, 392 exploited. Pick a weakness or a product to list them.
By weakness
- Memory Corruption7,287 · 135 exploited
- Access Control1,211 · 20 exploited
- Information Disclosure840 · 5 exploited
- Input Validation and Logic834 · 21 exploited
- Race Conditions591 · 7 exploited
- Denial of Service588 · 7 exploited
- File and Path Handling568 · 28 exploited
- Command and Code Injection558 · 14 exploited
- Cross-site Scripting520 · 2 exploited
- Authentication357 · 10 exploited
- Cryptography172 · 4 exploited
- Other weaknesses151
- Deserialization and Object Injection147 · 13 exploited
- Misconfiguration and Insecure Design113 · 8 exploited
- Server-Side Request Forgery91 · 4 exploited
- Injection and Smuggling74 · 2 exploited
- SQL Injection43 · 1 exploited
- Supply Chain and Malicious Code25
- Insecure Direct Object Reference23
- Open Redirect23
- Cross-Site Request Forgery15
- No weakness recorded4,680 · 111 exploited
By product
- Windows 10 Version 16072,511 · 11 exploited
- Windows 10 Version 18091,921 · 55 exploited
- Internet Explorer1,302 · 26 exploited
- Microsoft 365 Apps for Enterprise933 · 8 exploited
- Windows 10 Version 1507851 · 44 exploited
- Windows676 · 58 exploited
- Windows 7535 · 5 exploited
- Windows 2000363
- Windows 11 Version 24H2302 · 3 exploited
- Microsoft Edge (Chromium-based)297 · 1 exploited
- Microsoft SharePoint Enterprise Server 2016268 · 13 exploited
- Windows 10 Version 1803264 · 4 exploited
- Microsoft Edge248
- Office234 · 14 exploited
- Windows 10221
- Windows 10 Version 21H2210 · 3 exploited
- Excel186 · 2 exploited
- Windows 11 version 23H2173 · 1 exploited
- Edge169 · 2 exploited
- Windows Server 2019168
- Windows Xp137
- Windows Server 2016135 · 1 exploited
- Windows Nt131
- Microsoft Office117 · 5 exploited
- Microsoft Office 2019117 · 3 exploited
- Microsoft SQL Server 2017 (GDR)112
- Windows 10 Version 2004107 · 1 exploited
- Visual Studio Code106
- .net Framework99
- Windows 10 Version 2004 for 32-bit Systems90
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.