Public security advisories
Current vulnerabilities, known exploitation, Microsoft security updates, and practical guidance from Griffin Technology Partners.
Primary sources
Microsoft Security Response Center
CISA Known Exploited Vulnerabilities
Vulnerability intelligence
Last collection: October 9, 2026
Six-hour refresh · Public-source information only
494 bulletins · Page 11 of 21
JSON feedMicrosoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
Affected: Windows
Added to CISA KEV
Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
Affected: Office
Added to CISA KEV
Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.
Affected: Windows
Added to CISA KEV
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Affected: Windows
Added to CISA KEV
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
Affected: Exchange Server
Added to CISA KEV
Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.
Affected: Windows
Added to CISA KEV
Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
Affected: Defender
Added to CISA KEV
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
Affected: Windows
Added to CISA KEV
Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.
Affected: Windows
Added to CISA KEV
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
Affected: Windows
Added to CISA KEV
Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.
Affected: Windows
Added to CISA KEV
Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.
Affected: Windows
Added to CISA KEV
Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.
Affected: Windows COM+ Event System Service
Added to CISA KEV
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
Affected: Exchange Server
Added to CISA KEV
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
Affected: Exchange Server
Added to CISA KEV
Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.
Affected: Windows
Added to CISA KEV
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Affected: Windows
Added to CISA KEV
Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.
Affected: Windows
Added to CISA KEV
An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.
Affected: Active Directory
Added to CISA KEV
A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.
Affected: Windows
Added to CISA KEV
Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.
Affected: Windows
Added to CISA KEV
Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.
Affected: Windows
Added to CISA KEV
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
Affected: Windows
Added to CISA KEV
Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.
Affected: Word
Added to CISA KEV
The collection starts with 90 days of Microsoft updates and CISA additions, plus older Microsoft vulnerabilities still listed by CISA. Older entries do not imply that a product remains supported. Counts describe this collection, not every vulnerability or any customer environment.
Last successful check: October 9, 2026
Last successful check: October 9, 2026
Griffin Technology Partners managed customers may receive additional environment-specific security guidance and remediation assistance through their managed services relationship.
Security bulletins are provided for informational purposes and compiled from authoritative public sources. Vulnerability applicability varies by environment. Validate affected products, configuration, compatibility requirements, and vendor guidance before making production changes.
