Microsoft Security Response Center
Monthly Patch Tuesday advisories covering Windows, Azure, Office, and the wider Microsoft platform.
33,402 advisories tracked · showing 100
- Oct 31, 2026CVE-2026-91732MediumCVSS 3.1CVE-2026-91732
Chromium CVE-2026-91732: Missing authorization
- Oct 31, 2026CVE-2026-118359HighCVE-2026-118359
Chromium: CVE-2026-118359 Memory corruption in V8
- Oct 31, 2026CVE-2026-118358HighCVE-2026-118358
Chromium: CVE-2026-118358 Memory corruption in WebAudio
- Oct 31, 2026CVE-2026-118357HighCVE-2026-118357
Chromium: CVE-2026-118357 Use after free in FileSystem
- Oct 31, 2026CVE-2026-118356HighCVE-2026-118356
Chromium: CVE-2026-118356 Use after free in WTF
- Oct 31, 2026CVE-2026-118355HighCVE-2026-118355
Chromium: CVE-2026-118355 Improper input validation in Command
- Oct 31, 2026CVE-2026-118354HighCVE-2026-118354
Chromium: CVE-2026-118354 Improper input validation in Skia
- Oct 31, 2026CVE-2026-118353HighCVE-2026-118353
Chromium: CVE-2026-118353 Use after free in Paint
- Oct 31, 2026CVE-2026-118352HighCVE-2026-118352
Chromium: CVE-2026-118352 Memory corruption in Cache
- Oct 31, 2026CVE-2026-118351HighCVE-2026-118351
Chromium: CVE-2026-118351 Memory corruption in Skia
- Oct 31, 2026CVE-2026-118350HighCVE-2026-118350
Chromium: CVE-2026-118350 Use after free in Turbolev
- Oct 31, 2026CVE-2026-118349HighCVE-2026-118349
Chromium: CVE-2026-118349 Memory corruption in Payments
- Oct 31, 2026CVE-2026-118348CriticalCVE-2026-118348
Chromium: CVE-2026-118348 Improper input validation in Skia
- Oct 31, 2026CVE-2026-118347HighCVE-2026-118347
Chromium: CVE-2026-118347 Use after free in FileSystem
- Oct 31, 2026CVE-2026-118346HighCVE-2026-118346
Chromium: CVE-2026-118346 Use after free in Compositing
- Oct 31, 2026CVE-2026-118345HighCVE-2026-118345
Chromium: CVE-2026-118345 Use after free in PDFium
- Oct 31, 2026CVE-2026-118344CriticalCVE-2026-118344
Chromium: CVE-2026-118344 Use after free in Layout
- Oct 31, 2026CVE-2026-118343HighCVE-2026-118343
Chromium: CVE-2026-118343 Improper input validation in ReadingList
- Oct 31, 2026CVE-2026-118342HighCVE-2026-118342
Chromium: CVE-2026-118342 Out of bounds write in Editing
- Oct 31, 2026CVE-2026-118341HighCVE-2026-118341
Chromium: CVE-2026-118341 Use after free in Modularization
- Oct 31, 2026CVE-2026-118340HighCVE-2026-118340
Chromium: CVE-2026-118340 Memory corruption in Skia
- Oct 31, 2026CVE-2026-118339HighCVE-2026-118339
Chromium: CVE-2026-118339 Use after free in Animation
- Oct 31, 2026CVE-2026-118338MediumCVE-2026-118338
Chromium: CVE-2026-118338 Use after free in Animation
- Oct 31, 2026CVE-2026-118337HighCVE-2026-118337
Chromium: CVE-2026-118337 Improper access control in Forms
- Oct 31, 2026CVE-2026-118336HighCVE-2026-118336
Chromium: CVE-2026-118336 Improper input validation in Headless
- Oct 31, 2026CVE-2026-118335HighCVE-2026-118335
Chromium: CVE-2026-118335 Improper input validation in Metrics
- Oct 31, 2026CVE-2026-118334HighCVE-2026-118334
Chromium: CVE-2026-118334 Use after free in ImageCapture
- Oct 31, 2026CVE-2026-118333HighCVE-2026-118333
Chromium: CVE-2026-118333 Missing authorization in Video
- Oct 31, 2026CVE-2026-118332HighCVE-2026-118332
Chromium: CVE-2026-118332 Improper input validation in Compositing
- Oct 31, 2026CVE-2026-118331CriticalCVE-2026-118331
Chromium: CVE-2026-118331 Improper input validation in FileAPI
- Oct 31, 2026CVE-2026-118330HighCVE-2026-118330
Chromium: CVE-2026-118330 Use after free in Browser
- Oct 31, 2026CVE-2026-118329HighCVE-2026-118329
Chromium: CVE-2026-118329 Improper input validation in ANGLE
- Oct 31, 2026CVE-2026-118328HighCVE-2026-118328
Chromium: CVE-2026-118328 Improper input validation in WebRTC
- Oct 31, 2026CVE-2026-118327HighCVE-2026-118327
Chromium: CVE-2026-118327 Memory corruption in Media
- Oct 31, 2026CVE-2026-118322HighCVE-2026-118322
Chromium: CVE-2026-118322 Memory corruption in ANGLE
- Oct 31, 2026CVE-2026-118320HighCVE-2026-118320
Chromium: CVE-2026-118320 Memory corruption in V8
- Oct 31, 2026CVE-2026-118319HighCVE-2026-118319
Chromium: CVE-2026-118319 Memory corruption in Skia
- Oct 31, 2026CVE-2026-118318HighCVE-2026-118318
Chromium: CVE-2026-118318 Improper access control in V8
- Oct 31, 2026CVE-2026-118317HighCVE-2026-118317
Chromium: CVE-2026-118317 Memory corruption in HTML
- Oct 31, 2026CVE-2026-118316HighCVE-2026-118316
Chromium: CVE-2026-118316 Improper input validation in V8
- Oct 31, 2026CVE-2026-118315HighCVE-2026-118315
Chromium: CVE-2026-118315 Improper input validation in SVG
- Oct 31, 2026CVE-2026-118313HighCVE-2026-118313
Chromium: CVE-2026-118313 Use after free in Video
- Oct 31, 2026CVE-2026-118312MediumCVE-2026-118312
Chromium: CVE-2026-118312 Memory corruption in Paint
- Oct 31, 2026CVE-2026-118311HighCVE-2026-118311
Chromium: CVE-2026-118311 Memory corruption in Media
- Oct 31, 2026CVE-2026-118310HighCVE-2026-118310
Chromium: CVE-2026-118310 Improper input validation in Views
- Oct 31, 2026CVE-2026-118308HighCVE-2026-118308
Chromium: CVE-2026-118308 Use after free in SVG
- Oct 31, 2026CVE-2026-118307HighCVE-2026-118307
Chromium: CVE-2026-118307 Use after free in Paint
- Oct 31, 2026CVE-2026-118306CriticalCVE-2026-118306
Chromium: CVE-2026-118306 Memory corruption in FileSystem
- Oct 31, 2026CVE-2026-118305HighCVE-2026-118305
Chromium: CVE-2026-118305 Memory corruption in Turbolev
- Oct 31, 2026CVE-2026-118304HighCVE-2026-118304
Chromium: CVE-2026-118304 Improper input validation in SVG
- Oct 31, 2026CVE-2026-115905CriticalCVE-2026-115905
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
- Oct 31, 2026CVE-2026-115909HighCVSS 7.5CVE-2026-115909
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
- Oct 31, 2026CVE-2026-65629MediumCVE-2026-65629
Weak PBKDF2 parameters for password-encrypted private-key export in jose
- Oct 31, 2026CVE-2026-119025HighCVSS 7.5CVE-2026-119025
open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows
- Oct 31, 2026CVE-2026-118669HighCVE-2026-118669
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
- Oct 31, 2026CVE-2026-110259MediumCVSS 5.5CVE-2026-110259
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()
- Oct 31, 2026CVE-2026-118131MediumCVSS 5.3CVE-2026-118131
CVE-2026-118131
- Oct 31, 2026CVE-2026-97631HighCVE-2026-97631
Pre-boot RCE in EDK II PXE driver
- Oct 31, 2026CVE-2026-116591MediumCVE-2026-116591
compress zstd: Panic on two-block frames
- Oct 31, 2026CVE-2026-116585MediumCVE-2026-116585
Go JOSE: Panic during CBC-HMAC processing
- Oct 31, 2026CVE-2026-116587MediumCVSS 7.5CVE-2026-116587
Go JOSE: DoS when parsing JWKs that contain RSA keys
- Oct 31, 2026CVE-2026-116586MediumCVE-2026-116586
Go JOSE: Panics in JSON parsing
- Oct 31, 2026CVE-2026-119568CriticalCVSS 7.4CVE-2026-119568
vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking
- Oct 31, 2026CVE-2026-119591MediumCVSS 5.5CVE-2026-119591
SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
- Oct 31, 2026CVE-2026-119586HighCVSS 7.8CVE-2026-119586
SQLite CLI through 3.54.1 Command Injection via .recover Output
- Oct 31, 2026CVE-2026-119379HighCVSS 7.8CVE-2026-119379
SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
- Oct 31, 2026CVE-2026-119378MediumCVSS 5.5CVE-2026-119378
SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
- Oct 31, 2026CVE-2026-119376MediumCVSS 5.5CVE-2026-119376
SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
- Oct 31, 2026CVE-2026-119375MediumCVSS 5.5CVE-2026-119375
SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
- Oct 31, 2026CVE-2026-119374HighCVSS 7.8CVE-2026-119374
SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()
- Oct 31, 2026CVE-2026-119373HighCVSS 7.8CVE-2026-119373
SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
- Oct 31, 2026CVE-2026-119372MediumCVSS 5.5CVE-2026-119372
SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
- Oct 31, 2026CVE-2026-119371MediumCVSS 5.5CVE-2026-119371
SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()
- Oct 31, 2026CVE-2026-93522HighCVSS 7.8CVE-2026-93522
X.Org Server Glamor CopyArea Heap Buffer Overflow
- Oct 31, 2026CVE-2026-119197HighCVSS 7.5CVE-2026-119197
pyasn1: Quadratic-complexity denial of service in binary REAL decoding
- Oct 31, 2026CVE-2026-119196HighCVSS 7.5CVE-2026-119196
pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding
- Oct 31, 2026CVE-2026-119195HighCVSS 7.5CVE-2026-119195
pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding
- Oct 31, 2026CVE-2026-116566MediumCVE-2026-116566
socket.getaddrinfo() accepts embedded null bytes in host and port
- Oct 31, 2026CVE-2026-114538MediumCVSS 6.1CVE-2026-114538
Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236
- Oct 30, 2026CVE-2026-118147HighCVSS 7.4CVE-2026-118147
Visual Studio Spoofing Vulnerability
- Oct 30, 2026CVE-2026-113724MediumCVSS 4.5CVE-2026-113724
virtualenv: Deletion recovery can change a symlink target's mode
- Oct 30, 2026CVE-2026-97313HighCVSS 7.5CVE-2026-97313
Specific RPZ configurations and query patterns may result in an unexpected exit
- Oct 30, 2026CVE-2026-96888HighCVSS 7.5CVE-2026-96888
Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization
- Oct 30, 2026CVE-2026-94300HighCVSS 8.1CVE-2026-94300
Concurrent GSS-TSIG messages corrupt memory
- Oct 30, 2026CVE-2026-19630HighCVSS 7.5CVE-2026-19630
Amplified resource exhaustion in inbound message processing
- Oct 30, 2026CVE-2026-93536MediumCVSS 5.3CVE-2026-93536
X.Org Server GestureBuildSprite Use-After-Free
- Oct 30, 2026CVE-2026-93524MediumCVE-2026-93524
X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
- Oct 30, 2026CVE-2026-93523HighCVSS 7.8CVE-2026-93523
X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write
- Oct 30, 2026CVE-2026-93521HighCVSS 7.8CVE-2026-93521
X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow
- Oct 30, 2026CVE-2026-93520HighCVSS 7.8CVE-2026-93520
X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write
- Oct 30, 2026CVE-2026-93519HighCVSS 7.8CVE-2026-93519
X.Org Server XFixes Pointer Barrier Event List Buffer Overflow
- Oct 30, 2026CVE-2026-93518HighCVSS 7.8CVE-2026-93518
X.Org Server XKB ResizeKeyType Numeric Truncation
- Oct 30, 2026CVE-2026-93517HighCVE-2026-93517
X.Org Server GLX RenderLarge Heap Buffer Overflow
- Oct 30, 2026CVE-2026-93516MediumCVSS 5.5CVE-2026-93516
.Org Server XInput Passive Grab Use-After-Free
- Oct 30, 2026CVE-2026-93515MediumCVE-2026-93515
.Org Server Present Extension Use-After-Free
- Oct 30, 2026CVE-2026-92709HighCVSS 7.7CVE-2026-92709
Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE
- Oct 29, 2026CVE-2026-115889CriticalCVSS 9.9CVE-2026-115889
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
- Oct 29, 2026CVE-2026-115893CriticalCVSS 9.9CVE-2026-115893
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
- Oct 29, 2026CVE-2026-16762MediumCVE-2026-16762
Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
- Oct 29, 2026CVE-2026-115775MediumCVE-2026-115775
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree