Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 4,355 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 hours ago Checked every 6 hours
All vendor sources Official source

4,355 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-60589
LowCVSS 3.7

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vect

Mariner

Affected productsazl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0
CVE-2026-60589
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-64903
CriticalCVSS 7.8

Microsoft Office Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems
Fixed versionshttps://aka.ms/OfficeSecurityReleases, 16.112.26081010, 16.0.5565.1001
Vendor guidance

Click to Run Release Notes Install KB5002897.

CVE-2026-64903
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-68801
HighCVSS 7.8

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Office 365 for Mac, Office Online Server, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions
Fixed versions16.112.26081010, 16.0.10417.20175, https://aka.ms/OfficeSecurityReleases, 16.0.5565.1001
Vendor guidance

Release Notes Click to Run Install KB5002884. Install KB5002903.

CVE-2026-68801
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-54981
HighCVSS 7.8

Visual Studio Code Python Extension Security Feature Bypass Vulnerability

Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.

Affected productsPython extension for Visual Studio Code
Fixed versions2026.3.1
Vendor guidance

See the Microsoft Security Update Guide for the update that applies to your product.

CVE-2026-54981
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-76035
Severity not listed

Chromium: CVE-2026-76035 Inappropriate implementation in Media

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)
Fixed versions151.0.4129.101
Vendor guidance

Release Notes

CVE-2026-76035
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

Read how SecurityAlert collects and checks threat intelligence.