Vendor advisories

Microsoft Security Response Center

Browse 4,355 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked about an hour ago Checked every 6 hours

4,355 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results

Microsoft Security Response CenterCVE-2026-16805

Published Jul 25, 2026

Severity not listed

Chromium: CVE-2026-16805 Use after free in Blink

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.99

Vendor guidance

Release Notes

CVE-2026-16805

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16804

Published Jul 25, 2026

Severity not listed

Chromium: CVE-2026-16804 Use after free in Input

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.99

Vendor guidance

Release Notes

CVE-2026-16804

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-48561

Updated Jul 24, 2026

Critical

Microsoft Edge Copilot Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

Affected productsMicrosoft Edge Copilot for Android, Microsoft Edge Copilot for IOS

Vendor guidance

Release Notes

CVE-2026-48561

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16424

Published Jul 23, 2026

Severity not listed

Chromium: CVE-2026-16424 Use after free in GPU

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.96

Vendor guidance

Release Notes

CVE-2026-16424

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16423

Published Jul 23, 2026

Severity not listed

Chromium: CVE-2026-16423 Use after free in UI

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.96

Vendor guidance

Release Notes

CVE-2026-16423

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16422

Published Jul 23, 2026

Severity not listed

Chromium: CVE-2026-16422 Insufficient validation of untrusted input in Certificate

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.96

Vendor guidance

Release Notes

CVE-2026-16422

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16421

Published Jul 23, 2026

Severity not listed

Chromium: CVE-2026-16421 Inappropriate implementation in WebAudio

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.96

Vendor guidance

Release Notes

CVE-2026-16421

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16420

Published Jul 23, 2026

Severity not listed

Chromium: CVE-2026-16420 Type Confusion in WebAudio

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.96

Vendor guidance

Release Notes

CVE-2026-16420

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16419

Published Jul 23, 2026

Severity not listed

Chromium: CVE-2026-16419 Out of bounds read and write in ANGLE

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.96

Vendor guidance

Release Notes

CVE-2026-16419

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16418

Published Jul 23, 2026

Severity not listed

Chromium: CVE-2026-16418 Stack buffer overflow in V8

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.96

Vendor guidance

Release Notes

CVE-2026-16418

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16417

Published Jul 23, 2026

Severity not listed

Chromium: CVE-2026-16417 Uninitialized Use in Skia

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.96

Vendor guidance

Release Notes

CVE-2026-16417

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16416

Published Jul 23, 2026

Severity not listed

Chromium: CVE-2026-16416 Integer overflow in Chromecast

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.96

Vendor guidance

Release Notes

CVE-2026-16416

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16415

Published Jul 23, 2026

Severity not listed

Chromium: CVE-2026-16415 Insufficient validation of untrusted input in Extensions

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.96

Vendor guidance

Release Notes

CVE-2026-16415

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16414

Published Jul 23, 2026

Severity not listed

Chromium: CVE-2026-16414 Insufficient validation of untrusted input in Chromecast

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.96

Vendor guidance

Release Notes

CVE-2026-16414

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-16413

Published Jul 23, 2026

Severity not listed

Chromium: CVE-2026-16413 Out of bounds write in ANGLE

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.96

Vendor guidance

Release Notes

CVE-2026-16413

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-50243

Published Jul 23, 2026

Medium

'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL

Mariner

Affected productsazl3 unbound 1.25.1-1 on Azure Linux 3.0

Fixed versions1.25.2-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-50243

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41637

Published Jul 23, 2026

LowCVSS 3.7

Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

Mariner

Affected productsazl3 unbound 1.25.1-1 on Azure Linux 3.0

Fixed versions1.25.2-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-41637

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-50252

Published Jul 23, 2026

Medium

Possible cache poisoning attack by mapping source port population per thread

Mariner

Affected productsazl3 unbound 1.25.1-1 on Azure Linux 3.0

Fixed versions1.25.2-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-50252

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-50251

Published Jul 23, 2026

MediumCVSS 5.3

Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush

Mariner

Affected productsazl3 unbound 1.25.1-1 on Azure Linux 3.0

Fixed versions1.25.2-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-50251

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-55991

Published Jul 23, 2026

MediumCVSS 5.9

Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

Mariner

Affected productsazl3 unbound 1.25.1-1 on Azure Linux 3.0

Fixed versions1.25.2-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-55991

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-55990

Published Jul 23, 2026

MediumCVSS 5.9

Packet of death for a DNSCrypt misconfigured Unbound

Mariner

Affected productsazl3 unbound 1.25.1-1 on Azure Linux 3.0

Fixed versions1.25.2-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-55990

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-50046

Published Jul 23, 2026

MediumCVSS 5.9

Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

Mariner

Affected productsazl3 unbound 1.25.1-1 on Azure Linux 3.0

Fixed versions1.25.2-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-50046

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-14586

Published Jul 23, 2026

MediumCVSS 5.9

Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments

Mariner

Affected productsazl3 unbound 1.25.1-1 on Azure Linux 3.0

Fixed versions1.25.2-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-14586

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-42955

Published Jul 23, 2026

LowCVSS 3.7

Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records

Mariner

Affected productsazl3 unbound 1.25.1-1 on Azure Linux 3.0

Fixed versions1.25.2-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-40622 CVE-2026-42955

Read the vendor advisory Watch this product

Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

Read how SecurityAlert collects and checks threat intelligence.