Microsoft Security Center Center News

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.

Protection mechanism failure in Windows UEFI allows an authorized attacker to bypass a security feature locally.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Information published. This CVE was addressed by updates that were released in May 2026, but the CVE was inadvertently omitted from the May 2026 Security Updates. This is an informational change only. Customers who have already installed the May 2026 updates do not need to take any further action.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Advisory updated to announce new versions of Servicing Stack Updates are available. Please see the FAQ for details.

Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally.