Vendor advisories

Microsoft Security Response Center

Browse 17,776 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 hours ago Checked every 6 hours

17,776 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results

Microsoft Security Response CenterCVE-2026-11257

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-11257 Inappropriate implementation in Browser

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-11257

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-11201

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-11201 Use after free in ServiceWorker

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-11201

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-11094

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-11094 Use after free in Codecs

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-11094

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-11041

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-11041 Insufficient validation of untrusted input in Media

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-11041

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-10988

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-10988 Use after free in Views

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-10988

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-10936

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-10936 Type Confusion in V8

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-10936

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-33841

Updated Jun 5, 2026

HighCVSS 7.8

Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2022, Windows Server 2022 (Server Core installation), Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems

Fixed versions10.0.20348.5139, 10.0.20348.5074, 10.0.19044.7291, 10.0.19045.7417

Vendor guidance

Install KB5087545. Install KB5087424. Install KB5087544. Install KB5094127. Install KB5087539. Install KB5087423. Install KB5089549. Install KB5089466. Install KB5087420. Install KB5093998. Install KB5087541. Install ...

CVE-2026-33841

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-11256

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-11256 Out of bounds read in GPU

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-11256

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-11200

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-11200 Inappropriate implementation in WebRTC

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-11200

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-11093

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-11093 Insufficient validation of untrusted input in Printing

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-11093

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-11040

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-11040 Use after free in ANGLE

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-11040

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-10987

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-10987 Integer overflow in V8

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-10987

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-10935

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-10935 Inappropriate implementation in V8

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-10935

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-10882

Published Jun 5, 2026

Severity not listed

Chromium: CVE-2026-10882 Use after free in Network

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions149.0.4022.52

Vendor guidance

Release Notes

CVE-2026-10882

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-48579

Published Jun 4, 2026

CriticalCVSS 9.1

Microsoft Exchange Online Information Disclosure Vulnerability

Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.

Affected productsMicrosoft Exchange Online

CVE-2026-48579

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-48567

Published Jun 4, 2026

CriticalCVSS 10.0

Azure HorizonDB Elevation of Privilege Vulnerability

Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network.

Affected productsAzure HorizonDB

CVE-2026-48567

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-47655

Published Jun 4, 2026

CriticalCVSS 6.5

Microsoft Graph Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.

Affected productsMicrosoft Graph

CVE-2026-47655

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-47644

Published Jun 4, 2026

CriticalCVSS 6.5

Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.

Affected productsCopilot Chat (Microsoft Edge)

CVE-2026-47644

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-45497

Published Jun 4, 2026

CriticalCVSS 7.7

Microsoft M365 Copilot Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.

Affected productsMicrosoft 365 Copilot

CVE-2026-45497

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-42824

Published Jun 4, 2026

CriticalCVSS 6.5

M365 Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Affected productsMicrosoft 365 Copilot

CVE-2026-42824

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-7374

Updated Jun 3, 2026

CriticalCVSS 9.9

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

Mariner

Affected productsazl3 kubevirt 1.7.1-2 on Azure Linux 3.0, azl3 kubevirt 1.7.1-7 on Azure Linux 3.0

Fixed versions1.7.1-6

Vendor guidance

CBL-Mariner Releases

CVE-2026-7374

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-44777

Updated Jun 3, 2026

Medium

jq: stack overflow in module loading on mutual `include`

Mariner

Affected productsazl3 jq 1.7.1-5 on Azure Linux 3.0, azl3 jq 1.7.1-6 on Azure Linux 3.0

Fixed versions1.7.1-6

Vendor guidance

CBL-Mariner Releases

CVE-2026-44777

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-8177

Updated Jun 3, 2026

MediumCVSS 7.5

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences

Mariner

Affected productsazl3 perl-XML-LibXML 2.0209-2 on Azure Linux 3.0, azl3 perl-XML-LibXML 2.0209-3 on Azure Linux 3.0

Fixed versions2.0209-3

Vendor guidance

CBL-Mariner Releases

CVE-2026-8177

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41256

Updated Jun 3, 2026

MediumCVSS 5.5

jq: Embedded NUL truncates top-level jq programs loaded with -f

Mariner

Affected productsazl3 jq 1.7.1-5 on Azure Linux 3.0, azl3 jq 1.7.1-6 on Azure Linux 3.0

Fixed versions1.7.1-6

Vendor guidance

CBL-Mariner Releases

CVE-2026-41256

Read the vendor advisory Watch this product

Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources