W1
Product
Windows 11 23h2
On CISA KEVExploited in the wildRansomware-linked
2,997
CVEs
64
On KEV
9.9
Max CVSS
555
New 30D
Severity mix
Critical 80High 409Medium 11Low 0
Watch
Add Windows 11 23h2 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-69491 | 9.8 | Sep 8 | Microsoft DirectMusic Remote Code Execution Vulnerability Affected: before 10.0.22631.7582; before 10.0.22631.7582 |
| CVE-2026-69431 | 9.8 | Sep 8 | Telnet Client Remote Code Execution Vulnerability Affected: before 10.0.22631.7582; before 10.0.22631.7582 |
| CVE-2026-69408 | 9.8 | Sep 8 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability Affected: before 10.0.22631.7582; before 10.0.22631.7582 |
| CVE-2026-69276 | 9.8 | Sep 8 | Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability Affected: before 10.0.22631.7582; before 10.0.22631.7582 |
| CVE-2026-62815 | 9.8 | Aug 11 | Microsoft QUIC Remote Code Execution Vulnerability Affected: before 10.0.22631.7517; before 10.0.22631.7517 |
| CVE-2026-49172 | 9.8 | Jul 14 | Windows FTP Service Remote Code Execution Vulnerability Affected: before 10.0.22631.7376; before 10.0.22631.7376 |
| CVE-2026-44815 | 9.8 | Jun 9 | DHCP Client Service Remote Code Execution Vulnerability Affected: before 10.0.22631.7219; before 10.0.22631.7219 |
| CVE-2026-47291 | 9.8 | Jun 9 | HTTP.sys Remote Code Execution Vulnerability Affected: before 10.0.22631.7219; before 10.0.22631.7219 |
| CVE-2026-45657 | 9.8 | Jun 9 | Windows Kernel Remote Code Execution Vulnerability Affected: before 10.0.22631.7219; before 10.0.22631.7219 |
| CVE-2026-41096 | 9.8 | May 12 | Windows DNS Client Remote Code Execution Vulnerability Affected: before 10.0.22631.7079; before 10.0.22631.7079 |
| CVE-2025-60724 | 9.8 | Nov 11 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network Affected: before 10.0.22631.6199 |
| CVE-2025-55234 | 9.8 | Sep 9 | SMB Server might be susceptible to relay attacks depending on the configuration Affected: before 10.0.22631.5909 |
| CVE-2025-53766 | 9.8 | Aug 12 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network Affected: before 10.0.22631.5768 |
| CVE-2025-47981 | 9.8 | Jul 8 | Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network Affected: before 10.0.22631.5624 |
| CVE-2025-21307 | 9.8 | Jan 14 | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability Affected: before 10.0.22631.4751 |
| CVE-2025-21298 | 9.8 | Jan 14 | Windows OLE Remote Code Execution Vulnerability Affected: before 10.0.22631.4751 |
| CVE-2024-21416 | 9.8 | Sep 10 | Windows TCP/IP Remote Code Execution Vulnerability Affected: before 10.0.22631.4169 |
| CVE-2024-38240 | 9.8 | Sep 10 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability Affected: before 10.0.22621.4169; before 10.0.22631.4169 |
| CVE-2024-38199 | 9.8 | Aug 13 | Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability Affected: before 10.0.22631.4037 |
| CVE-2024-38140 | 9.8 | Aug 13 | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability Affected: before 10.0.22631.4037 |
| CVE-2024-38063 | 9.8 | Aug 13 | Windows TCP/IP Remote Code Execution Vulnerability Affected: before 10.0.22631.4037 |
| CVE-2024-30080 | 9.8 | Jun 11 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability Affected: before 10.0.22631.3737 |
| CVE-2023-36397 | 9.8 | Nov 14 | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability Affected: before 10.0.22621.2715; before 10.0.22621.2715 |
| CVE-2023-36028 | 9.8 | Nov 14 | Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability Affected: before 10.0.22621.2715; before 10.0.22621.2715 |
| CVE-2023-38545 | 9.8 | Oct 18 | This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake Affected: before 10.0.22631.2715 |
| CVE-2026-42904 | 9.6 | Jun 9 | Windows TCP/IP Elevation of Privilege Vulnerability Affected: before 10.0.22631.7219; before 10.0.22631.7219 |
| CVE-2026-40402 | 9.3 | May 12 | Windows Hyper-V Elevation of Privilege Vulnerability Affected: before 10.0.22631.7079; before 10.0.22631.7079 |
| CVE-2026-45602 | 9.1 | Jun 9 | Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability Affected: before 10.0.22631.7219 |
| CVE-2026-105008 | 9.0 | Oct 13 | Windows Schannel Spoofing Vulnerability Affected: before 10.0.22631.7652; before 10.0.22631.7652 |
| CVE-2026-85818 | 9.0 | Oct 13 | Windows Schannel Spoofing Vulnerability Affected: before 10.0.22631.7652; before 10.0.22631.7652 |
The 500 most important CVEs for this product (exploited first, then by severity)