Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 17,903 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked about an hour ago Checked every 6 hours
All vendor sources Official source

17,903 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-26133
HighCVSS 7.1

M365 Copilot Information Disclosure Vulnerability

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Affected productsMicrosoft OneNote for iOS, Microsoft Outlook for Mac, Microsoft Outlook for Android, Microsoft 365 Copilot for iOS
Fixed versions2.106.26020617, 5.2605, 2.107.2, 145.3800.99
Vendor guidance

Release Notes Release Note

CVE-2026-26133
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-0385
LowCVSS 5.0

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L), integrity (I:L) and availability (A:L). What does that mean for this vulnerability? While we cannot rule out the impact to Confidentiality, Integrity,...

Affected productsMicrosoft Edge for Android
Fixed versions146.0.3856.59
Vendor guidance

Release Notes

CVE-2026-0385
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-21715
LowCVSS 3.3

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.

Mariner

Affected productsazl3 nodejs 20.14.0-14 on Azure Linux 3.0, azl3 nodejs24 24.13.0-3 on Azure Linux 3.0
Fixed versions20.14.0-15, 24.14.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2026-21715
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-21716
LowCVSS 3.3

An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.

Mariner

Affected productsazl3 nodejs24 24.13.0-3 on Azure Linux 3.0, azl3 nodejs 20.14.0-14 on Azure Linux 3.0
Fixed versions24.14.1-1, 20.14.0-15
Vendor guidance

CBL-Mariner Releases

CVE-2024-36137CVE-2026-21716
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-21714
MediumCVSS 5.3

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

Mariner

Affected productsazl3 nodejs24 24.13.0-3 on Azure Linux 3.0, azl3 nodejs 20.14.0-14 on Azure Linux 3.0
Fixed versions24.14.1-1, 20.14.0-15
Vendor guidance

CBL-Mariner Releases

CVE-2026-21714
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-21713
MediumCVSS 5.9

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

Mariner

Affected productsazl3 nodejs 20.14.0-14 on Azure Linux 3.0, azl3 nodejs24 24.13.0-3 on Azure Linux 3.0
Fixed versions20.14.0-15, 24.14.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2026-21713
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-4645
HighCVSS 7.5

Github.com/antchfx/xpath: xpath: denial of service via crafted boolean xpath expressions

Mariner

Affected productscbl2 telegraf 1.29.4-21 on CBL Mariner 2.0, cbl2 terraform 1.3.2-29 on CBL Mariner 2.0, azl3 telegraf 1.31.0-15 on Azure Linux 3.0, azl3 telegraf 1.31.0-17 on Azure Linux 3.0
Fixed versions1.29.4-22, 1.3.2-30, 1.31.0-17, 1.31.0-16
Vendor guidance

CBL-Mariner Releases

CVE-2026-4645
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources