Windows vulnerabilitiesAnd the versions its exploited flaws hit.
Windows is made by Microsoft. We track 8,294 published vulnerabilities listed under that exact name, across 11 versions. 78 of them are on the list of flaws known to be exploited, the newest added on 13 April 2026. Microsoft lists newer releases under their own names, such as Windows Server 2016, so check those pages too.
The most recent Windows flaw added to the known-exploited list is CVE-2020-9715, on 13 April 2026. We keep watching the known-exploited list.
Is Windows listed under other names? Yes.
Microsoft also lists Windows under more specific names, such as Windows Server 2016 and Windows Server 2019. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
- Windows Server 20164,711 published vulnerabilities
- Windows Server 20194,111 published vulnerabilities
- Windows 104,066 published vulnerabilities
- Windows Server 20083,906 published vulnerabilities
- Windows Server 20123,842 published vulnerabilities
- Windows 73,087 published vulnerabilities
- Windows 8.12,876 published vulnerabilities
- Windows Rt 8.12,336 published vulnerabilities
- Windows Server 20222,137 published vulnerabilities
- Windows 11 22H21,473 published vulnerabilities
- Windows 10 18091,465 published vulnerabilities
- Windows 10 21H21,430 published vulnerabilities
Which versions of Windows do the exploited flaws hit?
Each exploited flaw lists the versions it affects, as published by the vendor. Find your version, then patch.
Showing the 30 most recently added of 78 exploited flaws. The full list is below.
Which Windows vulnerabilities are being exploited?
50 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.8Adobe Acrobat Use-After-Free Vulnerability
Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
- 7.8Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability.
- 8.8Google Chromium V8 Type Confusion Vulnerability
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
- 8.8RARLAB WinRAR Path Traversal Vulnerability
RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR.
- 8.1Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page.
- 10.0Commvault Command Center Path Traversal Vulnerability
Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
- 8.8Commvault Web Server Unspecified Vulnerability
Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.
- 8.3Google Chromium Mojo Sandbox Escape Vulnerability
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances.
Which Windows flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via...
- >99%
Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before...
- 96%
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via...
- 95%CVE-2014-0515Critical
Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via...
- 94%CVE-2010-0425Critical
modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete...
- 94%
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in...
- 92%
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute...
- 90%CVE-2014-0569Critical
Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and...
- 87%
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as...
- 86%CVE-2011-2110Critical
Adobe Flash Player before 10.3.181.26 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.23 and earlier on Android, allows remote attackers to execute arbitrary code or cause a denial of service (memory...
Running Windows? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
- Matched to
- Windows on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 8,294 published vulnerabilities listed under the name Windows, across 11 versions. The most recent Windows flaw added to the known-exploited list is CVE-2020-9715, on 13 April 2026.
78 are on the list of flaws known to be exploited. The most recently added are CVE-2020-9715, CVE-2025-41244 and CVE-2025-10585.
Microsoft also lists Windows under more specific names, such as Windows Server 2016 and Windows Server 2019. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Create a EdgeProtect account and track Windows. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.