Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 4,355 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 2 hours ago Checked every 6 hours
All vendor sources Official source

4,355 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-70335
HighCVSS 7.8

GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

Affected productsVisual Studio Code
Fixed versions1.135
Vendor guidance

Release Notes

CVE-2026-70335
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-37236
MediumCVSS 5.3

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

Mariner

Affected productsazl3 cert-manager 1.12.15-11 on Azure Linux 3.0, azl3 cf-cli 8.7.11-8 on Azure Linux 3.0, azl3 cloud-provider-kubevirt 0.5.1-6 on Azure Linux 3.0, azl3 docker-buildx 0.14.0-16 on Azure Linux 3.0
CVE-2026-37236
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-62823
CriticalCVSS 8.8

Windows DHCP Server Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9121, 10.0.20348.5499, 10.0.20348.5440, 10.0.26100.33296
Vendor guidance

Install KB5120238. Install KB5120242. Install KB5120229. Install KB5120233. Install KB5120228. Install KB5120418. Install KB5120386. Install KB5120385.

CVE-2026-62823
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-62889
CriticalCVSS 8.1

Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9121, 10.0.20348.5499, 10.0.20348.5440, 10.0.19044.7663
Vendor guidance

Install KB5120238. Install KB5120242. Install KB5120229. Install KB5120249. Install KB5120233. Install KB5120228. Install KB5121003. Install KB5120994. Install KB5120240. Install KB5121000. Install KB5120418. Install ...

CVE-2026-62889
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-49177
HighCVSS 5.5

Windows TCP/IP Information Disclosure Vulnerability

Out-of-bounds read in Windows TCP/IP allows an authorized attacker to disclose information locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9020, 10.0.20348.5386, 10.0.19044.7548, 10.0.19045.7548
Vendor guidance

Install KB5099538. Install KB5099540. Install KB5099539. Install KB5099536. Install KB5101650. Install KB5101649. Install KB5099535. Install KB5099445. Install KB5099444.

CVE-2026-49177
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-65776
HighCVSS 7.0

Windows Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems
Fixed versions10.0.26100.33296, 10.0.26100.33222, 10.0.26200.9168, 10.0.26200.9106
Vendor guidance

Install KB5120233. Install KB5120228. Install KB5121003. Install KB5120994. Install KB5121000.

CVE-2026-65776
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

Read how SecurityAlert collects and checks threat intelligence.