Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,547 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 hours ago Checked every 6 hours
All vendor sources Official source

15,547 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-111497
CriticalCVSS 8.1

Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder

Out-of-bounds write in .NET allows an unauthorized attacker to elevate privileges over a network.

Affected productsazl3 brotli 1.1.0-2 on Azure Linux 3.0, .NET 8.0 installed on Windows, .NET 8.0 installed on Linux, .NET 8.0 installed on Mac OS
Fixed versions1.2.1-1, 8.0.427, 9.0.320, 10.0.403
Vendor guidance

Release Notes Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompress...

CVE-2026-111497
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-96202
CriticalCVSS 8.8

Windows Raw Image Extension Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.

Affected productsRaw Image Extension on Windows 10 Version 1607 for x64-based Systems, Raw Image Extension on Windows 10 Version 1607 for 32-bit Systems, Raw Image Extension on Windows 10 for x64-based Systems, Raw Image Extension on Windows 10 for 32-bit Systems
Fixed versions2.4.36.0, 2.5.35.0, 154.0.4258.37, 154.0.4258.38
Vendor guidance

Release Notes

CVE-2026-96202
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-88074
CriticalCVSS 7.8

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

Affected productsWindows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems
Fixed versions10.0.22631.7652, 10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711
Vendor guidance

Install KB5126653. Install KB5127648. Install KB5127646.

CVE-2026-88074
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-95339
CriticalCVSS 9.6

Chromium CVE-2026-95339: Use after free in ServiceWorker

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)
Fixed versions154.0.4258.37, 154.0.4258.38
Vendor guidance

Release Notes

CVE-2026-95339
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-95329
CriticalCVSS 9.6

Chromium CVE-2026-95329: Out of bounds write in WebGL

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)
Fixed versions154.0.4258.37, 154.0.4258.38
Vendor guidance

Release Notes

CVE-2026-95329
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-95313
CriticalCVSS 9.6

Chromium CVE-2026-95313: Use after free in Fullscreen

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)
Fixed versions154.0.4258.37, 154.0.4258.38
Vendor guidance

Release Notes

CVE-2026-95313
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources