Vendor advisories

Microsoft Security Response Center

Browse 17,903 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked about an hour ago Checked every 6 hours

17,903 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results

Microsoft Security Response CenterCVE-2026-9122

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9121 Out of bounds read in GPU

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9121 CVE-2026-9122

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9121

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9126 Use after free in DOM

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9126 CVE-2026-9121

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9126

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9124 Insufficient validation of untrusted input in Input

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9124 CVE-2026-9126

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9120

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9120 Use after free in WebRTC

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9120

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9119

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9119 Heap buffer overflow in WebRTC

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9119

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9118

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9118 Use after free in XR

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9118

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9117

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9117 Type Confusion in GFX

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9117

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9116

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9116 Insufficient policy enforcement in ServiceWorker

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9116

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9115

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9115 Insufficient policy enforcement in Service Worker

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9115

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9114

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9114 Use after free in QUIC

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9114

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9113

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9113 Out of bounds read in GPU

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9113

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9112

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9112 Use after free in GPU

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9112

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9110

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9110 Inappropriate implementation in UI

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9110

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-9111

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-9111 Use after free in WebRTC

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.83

Vendor guidance

Release Notes

CVE-2026-9111

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-8522

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-8522 Use after free in Downloads

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.70

Vendor guidance

Release Notes

CVE-2026-8522

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-8521

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-8521 Use after free in Tab Groups

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.70

Vendor guidance

Release Notes

CVE-2026-8521

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-8520

Published May 21, 2026

Severity not listed

Chromium: CVE-2026-8520 Race in Payments

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions148.0.3967.70

Vendor guidance

Release Notes

CVE-2026-8520

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-47280

Published May 21, 2026

CriticalCVSS 10.0

Azure Resource Manager Elevation of Privilege Vulnerability

Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network.

Affected productsAzure Resource Manager

CVE-2026-47280

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-42901

Published May 21, 2026

CriticalCVSS 10.0

Microsoft Entra ID Elevation of Privilege Vulnerability

Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.

Affected productsMicrosoft Entra ID

CVE-2026-42901

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-42827

Published May 21, 2026

CriticalCVSS 6.5

M365 Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Affected productsMicrosoft 365 Copilot

CVE-2026-42827

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41104

Published May 21, 2026

CriticalCVSS 10.0

Microsoft Planetary Computer Pro Information Disclosure Vulnerability

Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network.

Affected productsMicrosoft Planetary Computer Pro (GeoCatalog)

CVE-2026-41104

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41090

Published May 21, 2026

CriticalCVSS 9.3

Microsoft Copilot Tampering Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

Affected productsMicrosoft 365 Copilot for iOS

CVE-2026-41090

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-40412

Published May 21, 2026

CriticalCVSS 10.0

Azure Orbital Spatio Remote Code Execution Vulnerability

Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network.

Affected productsAzure Orbital Spatio

CVE-2026-40412

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-40411

Published May 21, 2026

CriticalCVSS 9.9

Azure Virtual Network Gateway Remote Code Execution Vulnerability

Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network.

Affected productsAzure Virtual Network Gateway

CVE-2026-40411

Read the vendor advisory Watch this product

Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources