Vendor
Microsoft
- CVEs tracked · all time
- 147
- in CISA KEV · all time
- 50
- articles · since 11 Sep
- 36
- articles · all time
- 363
36 articles since 11 Sep; 3 CISA notices, marked below the bars.
Show as table
| Day (UTC) | Articles |
|---|---|
| Sat 12 Sep | 1 |
| Tue 15 Sep | 2 |
| Wed 16 Sep | 2 |
| Fri 18 Sep | 1 |
| Mon 21 Sep | 2 |
| Thu 24 Sep | 1 |
| Fri 25 Sep | 4 |
| Sun 27 Sep | 1 |
| Fri 2 Oct | 1 |
| Sat 3 Oct | 1 |
| Mon 5 Oct | 1 |
| Tue 6 Oct | 1 |
| Tue 13 Oct | 3 |
| Wed 14 Oct | 12 |
| Tue 20 Oct | 1 |
| Thu 22 Oct | 2 |
Products: Active Directory, Active Directory Federation Services, ASP.NET Core 10.0, Azure Automation and 97 more
Active DirectoryActive Directory Federation ServicesASP.NET Core 10.0Azure AutomationAzure DevOpsAzure HorizonDBAzure Logic AppsAzure Managed Instance for Apache CassandraAzure SQL DatabaseConfiguration ManagerDefenderDirectXExchange ServerInternet ExplorerInternet Key Exchange (IKE) Service ExtensionsMicrosoftMicrosoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2Microsoft .NET Framework 3.5 AND 4.7.2Microsoft .NET Framework 3.5 AND 4.8Microsoft .NET Framework 3.5 AND 4.8.1Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2Microsoft .NET Framework 4.8Microsoft .NET Framework 4.8.1Microsoft 365 Apps for EnterpriseMicrosoft 365 CopilotMicrosoft Authenticator for AndroidMicrosoft Configuration ManagerMicrosoft Configuration Manager 2509Microsoft Configuration Manager 2603Microsoft Confluence SAML SSO pluginMicrosoft Copilot StudioMicrosoft Dynamics 365 (on-premises) version 9.1Microsoft Edge (Chromium-based)Microsoft EntraMicrosoft Exchange Server 2013Microsoft Exchange Server 2016 Cumulative Update 23Microsoft Exchange Server 2019 Cumulative Update 14Microsoft Exchange Server 2019 Cumulative Update 15Microsoft Exchange Server Subscription Edition RTMMicrosoft JIRA SAML SSO pluginMicrosoft Malware Protection EngineMicrosoft Office 2016Microsoft Office 2019Microsoft Office 365 for MacMicrosoft Office LTSC 2021Microsoft Office LTSC 2024Microsoft Office LTSC for Mac 2021Microsoft Office LTSC for Mac 2024Microsoft Planetary Computer Pro (GeoCatalog)Microsoft SharePoint Enterprise Server 2016Microsoft SharePoint Server 2019Microsoft SharePoint Server Subscription EditionMicrosoft SQL Server 2019 (GDR)Microsoft SQL Server 2019 for x64-based Systems (CU32)Microsoft SQL Server 2022 (GDR)Microsoft SQL Server 2022 for x64-based Systems (CU27)Microsoft SQL Server 2025 for x64-based Systems (CU9)Microsoft SQL Server 2025 for x64-based Systems (GDR)Microsoft TeamsMicrosoft Visual Studio 2022 version 17.14Microsoft Visual Studio 2026 version 18.10Microsoft Visual Studio 2026 version 18.5Microsoft Word 2016OfficeOutlook.comRemote Desktop Servicessemantic-kernelSharePointSharePoint ServerSMBv1SQL ServerSQL Server Management Studio 22Visual Basic for Applications (VBA)WDSWindowsWindows 10 Version 1507Windows 10 Version 1607Windows 10 Version 1809Windows 10 Version 21H2Windows 10 Version 22H2Windows 11 version 22H2Windows 11 version 22H3Windows 11 Version 23H2Windows 11 Version 24H2Windows 11 Version 25H2Windows 11 version 26H1Windows 11 Version 26H2Windows Ancillary Function Driver for WinSockWindows ServerWindows Server 2012Windows Server 2012 (Server Core installation)Windows Server 2012 R2Windows Server 2012 R2 (Server Core installation)Windows Server 2016Windows Server 2016 (Server Core installation)Windows Server 2019Windows Server 2019 (Server Core installation)Windows Server 2022Windows Server 2022, 23H2 Edition (Server Core installation)Windows Server 2025Windows Server 2025 (Server Core installation)
CVEs
147 CVEs, the 40 listed known exploited firstCVE-2026-21509Microsoft Office Security Feature Bypass VulnerabilityCVSS7.8HighExploited71%EPSS22articles
CVE-2026-96951Microsoft Windows Command Injection VulnerabilityCVSS8.8HighExploited1.5%EPSS13articles
CVE-2026-58644Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVSS9.8CriticalExploited16%EPSS14articles
CVE-2026-50522Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVSS9.8CriticalExploited3.0%EPSS10articles
CVE-2026-55040Microsoft SharePoint Weak Authentication VulnerabilityCVSS9.1CriticalExploited70%EPSS16articles
CVE-2026-45659Microsoft SharePoint Server Deserialization of Untrusted Data VulnerabilityCVSS8.8HighExploited2.7%EPSS12articles
CVE-2026-32201Microsoft SharePoint Server Improper Input Validation VulnerabilityCVSS6.5MediumExploited43%EPSS14articles
CVE-2026-56164Microsoft SharePoint Server Missing Authentication for Critical Function VulnerabilityCVSS5.3MediumExploited1.0%EPSS11articles
CVE-2026-65660Microsoft SharePoint Code Injection VulnerabilityCVSS8.8HighExploited8.2%EPSS5articles
CVE-2026-85880Microsoft Windows Heap-Based Buffer Overflow VulnerabilityCVSS7.8HighExploited3.6%EPSS22articles
CVE-2019-0708Microsoft Remote Desktop Services Remote Code Execution VulnerabilityCVSS9.8CriticalExploited99.9%EPSS2articles
CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution VulnerabilityCVSS8.8HighExploited99.9%EPSS1article
28 more CVEs
CVE-2023-21674Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation VulnerabilityCVSS8.8HighExploited34%EPSS1article
CVE-2019-1068Microsoft SQL Server Remote Code Execution VulnerabilityCVSS8.8HighExploited57%EPSS9articles
CVE-2026-33824Microsoft Internet Key Exchange (IKE) Service Extensions Double Free VulnerabilityCVSS9.8CriticalExploited1.6%EPSS14articles
CVE-2026-68820Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityCVSS7.0HighExploited0.3%EPSS17articles
CVE-2026-42897Microsoft Exchange Server Cross-Site Scripting VulnerabilityCVSS8.1HighExploited0.5%EPSS14articles
CVE-2026-56155Microsoft Active Directory Federation Services Insufficient Granularity of Access Control VulnerabilityCVSS7.8HighExploited0.3%EPSS7articles
CVE-2026-33825Microsoft Defender Insufficient Granularity of Access Control VulnerabilityCVSS7.8HighExploited6.8%EPSS17articles
CVE-2008-4250Microsoft Windows Buffer Overflow VulnerabilityCVSS9.8CriticalExploited99%EPSS4articles
CVE-2010-0806Microsoft Internet Explorer Use-After-Free VulnerabilityCVSS8.8HighExploited82%EPSS4articles
CVE-2010-0249Microsoft Internet Explorer Use-After-Free VulnerabilityCVSS8.8HighExploited92%EPSS4articles
CVE-2009-1537Microsoft DirectX NULL Byte Overwrite VulnerabilityCVSS8.8HighExploited51%EPSS4articles
CVE-2026-45498Microsoft Defender Denial of Service VulnerabilityCVSS4.0MediumExploited1.3%EPSS4articles
CVE-2025-33073Microsoft Windows SMB Client Improper Access Control VulnerabilityCVSS8.8HighExploited83%EPSS1article
CVE-2017-0144Microsoft SMBv1 Remote Code Execution VulnerabilityCVSS8.8HighExploited99.2%EPSS1article
CVE-2022-26923Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityCVSS8.8HighExploited84%EPSS1article
CVE-2026-21513Microsoft MSHTML Framework Protection Mechanism Failure VulnerabilityCVSS8.8HighExploited16%EPSS15articles
CVE-2026-21514Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision VulnerabilityCVSS7.8HighExploited1.6%EPSS9articles
CVE-2026-21510Microsoft Windows Shell Protection Mechanism Failure VulnerabilityCVSS8.8HighExploited25%EPSS11articles
CVE-2026-32202Microsoft Windows Protection Mechanism Failure VulnerabilityCVSS4.3MediumExploited4.9%EPSS6articles
CVE-2023-21529Microsoft Exchange Server Deserialization of Untrusted Data VulnerabilityCVSS8.8HighExploited59%EPSS7articles
CVE-2023-36424Microsoft Windows Out-of-Bounds Read VulnerabilityCVSS7.8HighExploited12%EPSS5articles
CVE-2012-1854Microsoft Visual Basic for Applications Insecure Library Loading VulnerabilityCVSS7.8HighExploited21%EPSS4articles
- APT41 Uses a BlackX UEFI Bootkit to Bypass Secure Boot in Central AsiaSecurityOnline
- BlackX UEFI bootkit targets Central Asian diplomats via Secure Boot flawSecurelist
- APT28 Breaches NATO Naval Shipbuilder and Steals Credentials in Week-Long IntrusionThe Hacker News
- CISA Flags Actively Exploited Windows Flaw That Bypasses Security ProtectionsSecurity Affairs
- Microsoft fixes 1,415 flaws as exploited Windows bug puts users at riskSecurity Affairs
- Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Zero DayMalwarebytes
- Microsoft Fixes Record 1,411 Flaws as Patch Tuesday Strain GrowsInfosecurity
- Broadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw DiscoverySecurityOnline
- Microsoft’s record 1,413 fixes include a Windows flaw exploited to bypass security warningsSecurityWeek
- Windows Defender flaw let attackers bypass a protected enclaveThe Hacker News
- Microsoft patches 1,413 flaws as hackers exploit Windows bugThe Hacker News
- Microsoft Fixes Actively Exploited Windows Flaw in Record Patch ReleaseSecurityOnline
- Microsoft patches Copilot flaw that could let attackers run code via filesSecurityOnline
- CISA flags actively exploited Windows flaw with 16 October patch deadlineCISA · official notice
- Microsoft fixes over 1,400 flaws, including a Windows zero dayKrebs on Security
- Microsoft Patches Windows Shell Zero Day Exploited in the WildRapid7
- Microsoft patches actively exploited Windows flaw that bypasses security checksDark Reading
- Adobe and Microsoft Patch Thousands of Flaws in Record Updatethezdi.com
- Microsoft Patches Exchange Flaw That Could Expose Staff MailboxesSecurity Affairs
- Microsoft Patches Exchange Flaw That Exposes Colleagues’ MailboxesThe Hacker News
- Microsoft Reissues Exchange Updates With New CVE-2026-96940 FlawSecurityOnline
- Warlock Ransomware Expands SharePoint Attacks Against Critical SectorsSecurityWeek
- Attackers Exploit Patched Microsoft SharePoint Flaw to Deploy WebshellsSecurityWeek
- CISA Warns of Active MikroTik RouterOS Attacks and SharePoint FlawSecurity Affairs
- CISA Flags Actively Exploited SharePoint and MikroTik FlawsCISA · official notice
- CISA Warns of Actively Exploited Microsoft SharePoint Code FlawCISA · official notice
- Attackers Exploit SharePoint Flaw to Deploy Stealthy Web ShellsSecurityOnline
- Chinese Hackers Exploited Chrome and Windows Zero Days in Espionage AttacksSecurityOnline
- AI Agents Expose New Attack Paths Through Skills and MemorySecurity Affairs
- NightEagle Hackers Target Russian Firms With GhostContainer BackdoorSecurityOnline
- Microsoft Fixes 18 Azure and Copilot Flaws, Urges Windows UpdateSecurityWeek
- Browser Extensions Hijacked AI Assistants in Five Major BrowsersDark Reading
- NightEagle Hackers Hide Exchange Backdoor Behind Stolen VPN AccessSecurelist
- China-Linked Groups Exploited Chrome Patch Gap to Target NGOsSecurity Affairs
- Microsoft Fixes Windows 11 RDS Failures and CVE-2026-62721SecurityOnline
- Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage SurgeSecurityWeek
- Chrome Zero Day Chain Targeted NGOs Before Google’s Patch ArrivedSecurityOnline
- Windows Defender Patch Bypass Exposes SYSTEM Files to AttackersDark Reading
- Public ShieldCrash PoC Claims to Bypass Microsoft Defender FixSOCRadar
- CISA Warns of Exploited Magento Flaw Enabling Remote Code ExecutionSecurity Affairs
- Microsoft Defender Zero Day Bypasses Patches to Expose Windows SystemsSecurityWeek
- Chrome and Windows Zero Days Fuel BlueMoon Espionage CampaignsSecurity Affairs
- BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows FlawsArs Technica
- Chrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on WindowsThe Hacker News
- Chinese-Linked Spies Exploit Chrome and Windows Zero-DaysSecurityOnline
- Microsoft Patches 964 CVEs as Two Windows Zero-Days Face AttacksMalwarebytes
- Microsoft Patches Record 974 CVEs Amid Exploited Windows Zero-DaysInfosecurity
- Microsoft Defender Zero Day Bypasses Patch to Read Windows Files as SYSTEMThe Hacker News
- ShieldCrash PoC Revives Microsoft Defender SYSTEM File Read FlawSecurity Affairs
- Microsoft Fixes Nearly 1,000 Flaws in Record Patch Tuesday UpdateSecurity Affairs
The latest 50 are listed. Every article is in the RSS feed.