W1
Product
Windows 11 22h2
On CISA KEVExploited in the wildRansomware-linked
1,651
CVEs
74
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 41High 446Medium 13Low 0
Watch
Add Windows 11 22h2 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-37981 | 8.0 | Jul 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3880 |
| CVE-2024-37978 | 8.0 | Jul 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3880 |
| CVE-2024-37977 | 8.0 | Jul 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3880 |
| CVE-2024-37975 | 8.0 | Jul 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3880 |
| CVE-2024-37974 | 8.0 | Jul 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3880 |
| CVE-2024-37972 | 8.0 | Jul 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3880 |
| CVE-2024-37971 | 8.0 | Jul 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3880 |
| CVE-2024-37970 | 8.0 | Jul 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3880 |
| CVE-2024-37969 | 8.0 | Jul 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3880 |
| CVE-2024-30077 | 8.0 | Jun 11 | Windows OLE Remote Code Execution Vulnerability Affected: before 10.0.22621.3737 |
| CVE-2024-28925 | 8.0 | Apr 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3447 |
| CVE-2024-26240 | 8.0 | Apr 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3447 |
| CVE-2024-26189 | 8.0 | Apr 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3447 |
| CVE-2024-26180 | 8.0 | Apr 9 | Secure Boot Security Feature Bypass Vulnerability Affected: before 10.0.22621.3447 |
| CVE-2024-20654 | 8.0 | Jan 9 | Microsoft ODBC Driver Remote Code Execution Vulnerability Affected: before 10.0.22621.3007; before 10.0.22621.3007 |
| CVE-2023-36425 | 8.0 | Nov 14 | Windows Distributed File System (DFS) Remote Code Execution Vulnerability Affected: before 10.0.22621.2715 |
| CVE-2023-36697 | 8.0 | Oct 10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability Affected: before 10.0.22621.2428; before 10.0.22621.2428 |
| CVE-2025-64680 | 7.8 | Dec 9 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-64679 | 7.8 | Dec 9 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-59290 | 7.8 | Oct 14 | Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5909 |
| CVE-2025-59278 | 7.8 | Oct 14 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-59277 | 7.8 | Oct 14 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-59275 | 7.8 | Oct 14 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-59255 | 7.8 | Oct 14 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-59254 | 7.8 | Oct 14 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-59242 | 7.8 | Oct 14 | Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-59207 | 7.8 | Oct 14 | Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-59201 | 7.8 | Oct 14 | Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-59199 | 7.8 | Oct 14 | Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-59192 | 7.8 | Oct 14 | Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-59191 | 7.8 | Oct 14 | Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-59187 | 7.8 | Oct 14 | Improper input validation in Windows Kernel allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-58728 | 7.8 | Oct 14 | Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-58722 | 7.8 | Oct 14 | Heap-based buffer overflow in Windows DWM allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-58720 | 7.8 | Oct 14 | Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally Affected: before 10.0.22621.6060 |
| CVE-2025-58714 | 7.8 | Oct 14 | Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-55701 | 7.8 | Oct 14 | Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-55692 | 7.8 | Oct 14 | Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-55681 | 7.8 | Oct 14 | Out-of-bounds read in Windows DWM allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-55339 | 7.8 | Oct 14 | Out-of-bounds read in Windows NDIS allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-53768 | 7.8 | Oct 14 | Use after free in Xbox allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-53150 | 7.8 | Oct 14 | Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-50175 | 7.8 | Oct 14 | Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-50152 | 7.8 | Oct 14 | Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.6060 |
| CVE-2025-24052 | 7.8 | Oct 14 | Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems Affected: before 10.0.22621.6060 |
| CVE-2025-55236 | 7.8 | Sep 9 | Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally Affected: before 10.0.22621.5909 |
| CVE-2025-55228 | 7.8 | Sep 9 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally Affected: before 10.0.22621.5909 |
| CVE-2025-55224 | 7.8 | Sep 9 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally Affected: before 10.0.22621.5909 |
| CVE-2025-54916 | 7.8 | Sep 9 | Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally Affected: before 10.0.22621.5909 |
| CVE-2025-54913 | 7.8 | Sep 9 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized attacker to elevate… Affected: before 10.0.22621.5909 |
The 500 most important CVEs for this product (exploited first, then by severity)
