VulnSea

Microsoft has 4,599 CVEs on record between 2012 and 2026. Disclosure cadence is accelerating: 2930 in the last 90 days against 932 in the 90 before. The busiest recent month was October 2026 with 1482. The median CVSS is 7.8 (high), with 273 rated critical. 2% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 112 days (95 cases). The dominant weakness classes are CWE-122 (931) and CWE-416 (851). Most affected products: windows_10_1607 (988), Windows 10 Version 1607 (877), 365_apps (267).

CVEs per month

Last 12 months, by publish date

120102030405060708091011
Exploited share
2% vs 1% corpus
Median CVSS
7.8
Publish → KEV
112 d median(95)
Last 90 days
2930 prev 932

Products

  • windows_10_1607 988
  • Windows 10 Version 1607 877
  • 365_apps 267
  • Microsoft 365 Apps for Enterprise 232
  • Windows 10 Version 1809 199
  • windows_10_1809 174
Follow Microsoft:RSS feedSave a search →Embed badge ↗
4599
Total CVEs
273
Critical
95
CISA KEV
96
Exploited

Worst active — by depth score

Microsoft vulnerabilities

CVEs affecting Microsoft, newest first. Open any entry for full detail, references, and exploit status.

4599 CVEsRSS

CVE-2021-40444High· 8.8CISA KEV0dayPoC
5y ago

Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows

Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft …

▾ Abyssalmicrosoft · windows_10_1507EPSS 98%via NVD
CVE-2021-38649High· 7.0CISA KEV
5y ago

Open Management Infrastructure Elevation of Privilege Vulnerability

Open Management Infrastructure Elevation of Privilege Vulnerability

▾ Abyssalmicrosoft · azure_automation_state_configurationEPSS 2.9%via NVD
CVE-2021-38648High· 7.8CISA KEVPoC
5y ago

Open Management Infrastructure Elevation of Privilege Vulnerability

Open Management Infrastructure Elevation of Privilege Vulnerability

▾ Abyssalmicrosoft · azure_automation_state_configurationEPSS 11%via NVD
CVE-2021-38647Critical· 9.8CISA KEVPoC
5y ago

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

▾ Hadalmicrosoft · azure_automation_state_configurationEPSS 100%via NVD
CVE-2021-38646High· 7.8CISA KEV
5y ago

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

▾ Abyssalmicrosoft · 365_appsEPSS 8.0%via NVD
CVE-2021-38645High· 7.8CISA KEV
5y ago

Open Management Infrastructure Elevation of Privilege Vulnerability

Open Management Infrastructure Elevation of Privilege Vulnerability

▾ Abyssalmicrosoft · azure_automation_state_configurationEPSS 2.7%via NVD
CVE-2021-36955High· 7.8CISA KEVPoC
5y ago

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

▾ Abyssalmicrosoft · windows_10_1507EPSS 4.1%via NVD
CVE-2021-34532Medium· 5.5
5y ago

ASP.NET Core and Visual Studio Information Disclosure Vulnerability

ASP.NET Core and Visual Studio Information Disclosure Vulnerability

▾ SunlitMicrosoft · ASP.NET Core 2.1EPSS 1.2%via CVEORG
CVE-2021-34485Medium· 5.0
5y ago

.NET Core and Visual Studio Information Disclosure Vulnerability

.NET Core and Visual Studio Information Disclosure Vulnerability

▾ Sunlitmicrosoft · .netEPSS 2.1%via NVD
CVE-2021-36948High· 7.8CISA KEV0day
5y ago

Windows Update Medic Service Elevation of Privilege Vulnerability

Windows Update Medic Service Elevation of Privilege Vulnerability

▾ Abyssalmicrosoft · windows_10_1809EPSS 23%via NVD
CVE-2021-36942High· 7.5CISA KEVPoC
5y ago

Windows LSA Spoofing Vulnerability

Windows LSA Spoofing Vulnerability

▾ Abyssalmicrosoft · windows_server_2004EPSS 66%via NVD
CVE-2021-34486High· 7.8CISA KEVPoC
5y ago

Windows Event Tracing Elevation of Privilege Vulnerability

Windows Event Tracing Elevation of Privilege Vulnerability

▾ Abyssalmicrosoft · windows_10_1809EPSS 9.3%via NVD
CVE-2021-34484High· 7.8CISA KEV
5y ago

Windows User Profile Service Elevation of Privilege Vulnerability

Windows User Profile Service Elevation of Privilege Vulnerability

▾ Abyssalmicrosoft · windows_10_1507EPSS 22%via NVD
CVE-2021-36934High· 7.8CISA KEVPoC
5y ago

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnera…

▾ Abyssalmicrosoft · windows_10_1809EPSS 67%via NVD
CVE-2021-34448Medium· 6.8CISA KEV0day
5y ago

Scripting Engine Memory Corruption Vulnerability

Scripting Engine Memory Corruption Vulnerability

▾ Midnightmicrosoft · windows_10_1507EPSS 40%via NVD
CVE-2021-34447Medium· 6.8
5y ago

Windows MSHTML Platform Remote Code Execution Vulnerability

Windows MSHTML Platform Remote Code Execution Vulnerability

▾ Sunlitmicrosoft · windows_10EPSS 2.0%via NVD
CVE-2021-34446High· 8.0
5y ago

Windows HTML Platforms Security Feature Bypass Vulnerability

Windows HTML Platforms Security Feature Bypass Vulnerability

▾ Twilightmicrosoft · windows_10EPSS 2.0%via NVD
CVE-2021-34445High· 7.8
5y ago

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

▾ Twilightmicrosoft · windows_10EPSS 0.64%via NVD
CVE-2021-34444Medium· 6.5
5y ago

Windows DNS Server Denial of Service Vulnerability

Windows DNS Server Denial of Service Vulnerability

▾ Sunlitmicrosoft · windows_server_2008EPSS 3.5%via NVD
CVE-2021-34442High· 8.8
5y ago

Windows DNS Server Remote Code Execution Vulnerability

Windows DNS Server Remote Code Execution Vulnerability

▾ Twilightmicrosoft · windows_server_2008EPSS 3.2%via NVD
CVE-2021-34441High· 7.8
5y ago

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

▾ Twilightmicrosoft · windows_10EPSS 2.2%via NVD
CVE-2021-34440Medium· 5.5
5y ago

GDI+ Information Disclosure Vulnerability

GDI+ Information Disclosure Vulnerability

▾ Sunlitmicrosoft · windows_10EPSS 0.88%via NVD
CVE-2021-34439High· 7.8
5y ago

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

▾ Twilightmicrosoft · windows_10EPSS 2.7%via NVD
CVE-2021-34438High· 7.8
5y ago

Windows Font Driver Host Remote Code Execution Vulnerability

Windows Font Driver Host Remote Code Execution Vulnerability

▾ Twilightmicrosoft · windows_10EPSS 2.2%via NVD
CVE-2021-34529High· 7.80day
5y ago

Visual Studio Code Remote Code Execution Vulnerability

Visual Studio Code Remote Code Execution Vulnerability

▾ Abyssalmicrosoft · visual_studio_codeEPSS 5.1%via NVD
CVE-2021-34528High· 7.8
5y ago

Visual Studio Code Remote Code Execution Vulnerability

Visual Studio Code Remote Code Execution Vulnerability

▾ Twilightmicrosoft · visual_studio_codeEPSS 3.1%via NVD
CVE-2021-34525High· 8.8
5y ago

Windows DNS Server Remote Code Execution Vulnerability

Windows DNS Server Remote Code Execution Vulnerability

▾ Twilightmicrosoft · windows_server_2012EPSS 2.3%via NVD
CVE-2021-34523Critical· 9.0CISA KEV0dayPoC
5y ago

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

▾ Hadalmicrosoft · exchange_serverEPSS 100%via NVD
CVE-2021-34522High· 7.8
5y ago

Microsoft Defender Remote Code Execution Vulnerability

Microsoft Defender Remote Code Execution Vulnerability

▾ Twilightmicrosoft · malware_protection_engineEPSS 2.7%via NVD
CVE-2021-34521High· 7.8
5y ago

Raw Image Extension Remote Code Execution Vulnerability

Raw Image Extension Remote Code Execution Vulnerability

▾ Twilightmicrosoft · windows_10EPSS 2.4%via NVD
Microsoft vulnerabilities (CVEs) — page 145 · VulnSea