Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,943 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked about an hour ago Checked every 6 hours
All vendor sources Official source

15,943 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-100203
HighCVSS 7.0

Windows Update Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.

Affected productsWindows 11 Version 26H2 for x64-based Systems, Windows Server 2025, Windows Server 2025 (Server Core installation), Windows 11 Version 26H1 for ARM64-based Systems
Fixed versions10.0.26300.9711, 10.0.26100.33650, 10.0.28000.3231, 10.0.14393.9612
Vendor guidance

Install KB5127648. Install KB5126646. Install KB5127646. Install KB5126868. Install KB5126651. Install KB5126657. Install KB5126655. Install KB5126653.

CVE-2026-100203
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-100201
HighCVSS 7.0

Windows Client License Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9376, 10.0.19044.7807, 10.0.19045.7807, 10.0.20348.5761
Vendor guidance

Install KB5126651. Install KB5126657. Install KB5126655. Install KB5126653. Install KB5127648. Install KB5126646. Install KB5127646.

CVE-2026-100201
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-100200
HighCVSS 7.0

Windows Update Service Elevation of Privilege Vulnerability

Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.

Affected productsWindows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems
Fixed versions10.0.22631.7652, 10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711
Vendor guidance

Install KB5126653. Install KB5127648. Install KB5126646. Install KB5127646.

CVE-2026-100200
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-69896
HighCVSS 7.0

Windows Error Reporting Elevation of Privilege Vulnerability

Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems
Fixed versions10.0.26100.33438, 10.0.26200.9445, 10.0.26100.9445, 10.0.28000.2954
Vendor guidance

Install KB5122871. Install KB5124008. Install KB5124012.

CVE-2026-69896
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-62737
HighCVSS 7.8

Windows Kernel Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems
Fixed versions10.0.26100.33296, 10.0.26100.33222, 10.0.26200.9168, 10.0.26200.9106
Vendor guidance

Install KB5120233. Install KB5120228. Install KB5121003. Install KB5120994. Install KB5121000.

CVE-2026-62737
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-51480
HighCVSS 8.8

Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted external_data.location paths containing traversal sequences, bypassing intended directory restrictions.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 pytorch 2.0.0-11 on CBL Mariner 2.0, azl3 pytorch 2.2.2-9 on Azure Linux 3.0, azl3 pytorch 2.2.2-10 on Azure Linux 3.0, cbl2 pytorch 2.0.0-14 on CBL Mariner 2.0
Fixed versions2.2.2-15
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2025-51480
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-30896
CriticalCVSS 9.1

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 influxdb 2.6.1-22 on CBL Mariner 2.0, cbl2 influxdb 2.6.1-23 on CBL Mariner 2.0, cbl2 influxdb 2.6.1-24 on CBL Mariner 2.0, cbl2 influxdb 2.6.1-30 on CBL Mariner 2.0
Vendor guidance

Release Notes

CVE-2024-30896
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources