NVD や CVE、ほか複数の脅威フィードを束ね、RCE など高リスクな事象を深く追える一覧です。CVSS と EPSS を組み合わせ、Exploit 参照や PoC の有無から悪用しやすさを追跡します。ベンダー修正や緩和策の文脈とあわせて優先度を決め、対応サイクルを短く保ちつつ重要資産を守る支援をします。
Assigner（CNA／発行元）：[email protected] この条件を外す
| CVE | 説明 | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|
| CVE-2019-0708 KEV | A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'. | 9.8 | 94.46% | 2019-05-16 | 2025-10-29 |
| CVE-2020-0796 KEV | A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'. | 10.0 | 94.44% | 2020-03-12 | 2025-10-29 |
| CVE-2019-0604 KEV | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594. | 9.8 | 94.41% | 2019-03-05 | 2025-10-29 |
| CVE-2020-0688 KEV | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'. | 8.8 | 94.40% | 2020-02-11 | 2025-10-29 |
| CVE-2017-11882 KEV | Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884. | 7.8 | 94.38% | 2017-11-15 | 2026-04-22 |
| CVE-2020-1472 KEV | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is ad | 5.5 | 94.38% | 2020-08-17 | 2026-02-23 |
| CVE-2021-38647 KEV | Open Management Infrastructure Remote Code Execution Vulnerability | 9.8 | 94.36% | 2021-09-15 | 2025-10-30 |
| CVE-2023-29357 KEV | Microsoft SharePoint Server Elevation of Privilege Vulnerability | 9.8 | 94.36% | 2023-06-14 | 2025-10-28 |
| CVE-2021-26855 KEV | Microsoft Exchange Server Remote Code Execution Vulnerability | 9.1 | 94.34% | 2021-03-03 | 2025-12-18 |
| CVE-2021-40444 KEV | <p>Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents.</p> <p>An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accoun | 8.8 | 94.33% | 2021-09-15 | 2025-10-30 |
| CVE-2017-0199 KEV | Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API." | 7.8 | 94.33% | 2017-04-12 | 2026-04-22 |
| CVE-2012-0158 KEV | The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web | 8.8 | 94.32% | 2012-04-10 | 2026-04-22 |
| CVE-2017-0144 KEV | The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148. | 8.8 | 94.32% | 2017-03-17 | 2026-04-22 |
| CVE-2021-1675 KEV | Windows Print Spooler Remote Code Execution Vulnerability | 7.8 | 94.31% | 2021-06-08 | 2025-10-30 |
| CVE-2015-1635 KEV | HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability." | 9.8 | 94.31% | 2015-04-14 | 2026-04-22 |
| CVE-2018-8174 KEV | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. | 7.5 | 94.28% | 2018-05-09 | 2025-10-28 |
| CVE-2017-8570 KEV | Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243. | 7.8 | 94.25% | 2017-07-11 | 2026-04-22 |
| CVE-2020-0618 KEV | A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'. | 8.8 | 94.24% | 2020-02-11 | 2026-01-13 |
| CVE-2021-34527 KEV | <p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>UPDATE July 7, 2021: The security update for Windows Server 2012, Windows Server 2016 and Windows 10, Version 1607 have been released. | 8.8 | 94.20% | 2021-07-02 | 2025-12-18 |
| CVE-2021-34473 KEV | Microsoft Exchange Server Remote Code Execution Vulnerability | 9.1 | 94.19% | 2021-07-14 | 2025-10-29 |