Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,972 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 hours ago Checked every 6 hours
All vendor sources Official source

15,972 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2023-31973
HighCVSS 7.8

yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 yasm 1.3.0-17 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2023-31973
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-78510
CriticalCVSS 8.4

Microsoft Outlook and Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems
Fixed versions16.0.10417.20207, 16.0.20326.20138, 16.113.26091433, 16.0.14334.20906
Vendor guidance

Release Notes Install KB5002916.

CVE-2026-78510
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-100208
HighCVSS 7.5

Microsoft Office Outlook Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Affected productsMicrosoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office LTSC 2021 for 32-bit editions, Microsoft Office LTSC 2021 for 64-bit editions
Fixed versionshttps://aka.ms/OfficeSecurityReleases
Vendor guidance

Click to Run

CVE-2026-100208
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-71328
HighCVSS 8.8

.NET and Visual Studio Remote Code Execution Vulnerability

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

Affected productsMicrosoft Visual Studio 2026 version 18.9, .NET 10.0 runtime installed on Windows, .NET 8.0 runtime installed on Windows, .NET 9.0 runtime installed on Windows
Fixed versions18.9.3, 10.0.12, 8.0.31, 9.0.20
Vendor guidance

Release Notes Install KB5126106. Install KB5126104. Install KB5126105.

CVE-2026-71328
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-69806
HighCVSS 7.0

.NET Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.

Affected productsMicrosoft Visual Studio 2026 version 18.9, Microsoft Visual Studio 2022 version 17.14, .NET 9.0 runtime installed on Linux, .NET 10.0 runtime installed on Linux
Fixed versions18.9.3, 17.14.40, 9.0.20, 10.0.12
Vendor guidance

Release Notes Install KB5126105. Install KB5126106.

CVE-2026-69806
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-69439
HighCVSS 8.8

.NET and Visual Studio Elevation of Privilege Vulnerability

Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Affected products.NET 10.0 runtime installed on Windows, .NET 8.0 runtime installed on Windows, .NET 9.0 runtime installed on Windows, Microsoft Visual Studio 2022 version 17.14
Fixed versions10.0.12, 8.0.31, 9.0.20, 17.14.40
Vendor guidance

Release Notes Install KB5126106. Install KB5126104. Install KB5126105.

CVE-2026-69439
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-69304
HighCVSS 5.9

ASP.NET Core Denial of Service Vulnerability

Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected productsASP.NET Core 11.0, .NET 10.0 runtime installed on Windows, .NET 9.0 runtime installed on Windows, .NET 8.0 runtime installed on Windows
Fixed versions11.0 RC1, 10.0.12, 9.0.20, 8.0.31
Vendor guidance

Release Notes Install KB5126106. Install KB5126105. Install KB5126104.

CVE-2026-69304
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-65660
HighCVSS 8.8

Microsoft SharePoint Server Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Affected productsMicrosoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition
Fixed versions16.0.5565.1001, 16.0.10417.20198, 16.0.19725.20522
Vendor guidance

Install KB5002905. Install KB5002906. Install KB5002894. Install KB5002896. Install KB5002893.

CVE-2026-65660
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources