Vulnerabilities
May 2026 vulnerabilities
Browse this month's returned vendor patches and exploitation signals, with filtering and stable pages for browsing without JavaScript.
Microsoft reports 3 vulnerabilities with exploitation detected in the wild this month. This defender-focused view covers 1,840 vulnerabilities across 5,089 returned patch records from 5 vendors. Filter the complete month, or browse the static page trail without JavaScript.
- Patch records
- Returned Microsoft and cross-vendor release records. One Common Vulnerabilities and Exposures (CVE) identifier can appear in more than one record.
- Tracked here
- Records joined to a vulnerability record in this tracker.
- Defender priority
- Sorts Microsoft exploitation status, Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog status, severity, and tracker coverage first.
- More likely
- Microsoft's Exploitability Index rating that exploitation is more likely. It is not a claim that exploitation was detected.
Narrow the complete month
Filters use every patch record in this month, including records on later static pages.
My Stack only keeps records whose vendor you have pinned. Pins are the vendors you added to My Stack on the home page. Your pin list is saved only in this browser. Shared view and feed requests include the selected vendor names in their URLs. Pins never change what the tracker collects or scores.
Microsoft-only signal filters exclude records without Microsoft signal data as unknown, report them separately, and never count them as absent. “Tracked here” covers both Microsoft and cross-vendor records.
Loading the complete-month filter index…
The complete-month filter index could not be loaded, so filters are unavailable. The static records and page links below remain complete and usable.
An Exploit Prediction Scoring System (EPSS) percentage is the global 30-day exploitation probability in the wild, not specific to you. Do not read it as a complete risk score or as evidence about your environment or impact.
Microsoft Security Response Center
CVEDateProductMSRC severityOut-of-bandEPSSTitle
Cross-vendor patches
VendorCVESeverityProductFixed versionPatchAdvisory
Page 26 of 26 · records 5,001 to 5,089 of 5,089
Microsoft Security Response Center
CVEDateProductMSRC severityOut-of-bandEPSSTitle
CVE-2026-7944 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7944 Insufficient validation of untrusted input in Persistent Cache
CVE-2026-7945 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7945 Insufficient validation of untrusted input in COOP
CVE-2026-7946 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7946 Insufficient policy enforcement in WebUI
CVE-2026-7947 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7947 Insufficient validation of untrusted input in Network
CVE-2026-7948 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7948 Race in Chromoting
CVE-2026-7949 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7949 Out of bounds read in Skia
CVE-2026-7950 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7950 Out of bounds read and write in GFX
CVE-2026-7951 ↗Microsoft Edge (Chromium-based)N/AOut-of-band1%Microsoft rating unavailableChromium: CVE-2026-7951 Out of bounds write in WebRTC
CVE-2026-7952 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7952 Insufficient policy enforcement in Extensions
CVE-2026-7953 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7953 Insufficient validation of untrusted input in Omnibox
CVE-2026-7954 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7954 Race in Shared Storage
CVE-2026-7955 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7955 Uninitialized Use in GPU
CVE-2026-7956 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7956 Use after free in Navigation
CVE-2026-7957 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7957 Out of bounds write in Media
CVE-2026-7958 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7958 Inappropriate implementation in ServiceWorker
CVE-2026-7959 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7959 Inappropriate implementation in Navigation
CVE-2026-7960 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7960 Race in Speech
CVE-2026-7961 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7961 Insufficient validation of untrusted input in Permissions
CVE-2026-7962 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7962 Insufficient policy enforcement in DirectSockets
CVE-2026-7963 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7963 Inappropriate implementation in ServiceWorker
CVE-2026-7964 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7964 Insufficient validation of untrusted input in FileSystem
CVE-2026-7965 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7965 Insufficient validation of untrusted input in DevTools
CVE-2026-7966 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7966 Insufficient validation of untrusted input in SiteIsolation
CVE-2026-7967 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7967 Insufficient validation of untrusted input in Navigation
CVE-2026-7968 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7968 Insufficient validation of untrusted input in CORS
CVE-2026-7969 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7969 Integer overflow in Network
CVE-2026-7970 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7970 Use after free in TopChrome
CVE-2026-7971 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7971 Inappropriate implementation in ORB
CVE-2026-7972 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7972 Uninitialized Use in GPU
CVE-2026-7973 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7973 Integer overflow in Dawn
CVE-2026-7974 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7974 Use after free in Blink
CVE-2026-7975 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7975 Use after free in DevTools
CVE-2026-7976 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7976 Use after free in Views
CVE-2026-7977 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7977 Inappropriate implementation in Canvas
CVE-2026-7978 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7978 Inappropriate implementation in Companion
CVE-2026-7979 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7979 Inappropriate implementation in Media
CVE-2026-7980 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7980 Use after free in WebAudio
CVE-2026-7981 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7981 Out of bounds read in Codecs
CVE-2026-7982 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7982 Uninitialized Use in WebCodecs
CVE-2026-7983 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7983 Out of bounds read in Dawn
CVE-2026-7984 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7984 Use after free in ReadingMode
CVE-2026-7985 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7985 Use after free in GPU
CVE-2026-7986 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7986 Insufficient policy enforcement in Autofill
CVE-2026-7987 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7987 Use after free in WebRTC
CVE-2026-7988 ↗Microsoft Edge (Chromium-based)N/AOut-of-band1%Microsoft rating unavailableChromium: CVE-2026-7988 Type Confusion in WebRTC
CVE-2026-7989 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7989 Insufficient data validation in DataTransfer
CVE-2026-7990 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7990 Insufficient validation of untrusted input in Updater
CVE-2026-7991 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7991 Use after free in UI
CVE-2026-7992 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7992 Insufficient validation of untrusted input in UI
CVE-2026-7994 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7994 Inappropriate implementation in Chromoting
CVE-2026-7995 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7995 Out of bounds read in AdFilter
CVE-2026-7996 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7996 Insufficient validation of untrusted input in SSL
CVE-2026-7997 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7997 Insufficient validation of untrusted input in Updater
CVE-2026-7998 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7998 Insufficient validation of untrusted input in Dialog
CVE-2026-7999 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-7999 Inappropriate implementation in V8
CVE-2026-8000 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8000 Insufficient validation of untrusted input in ChromeDriver
CVE-2026-8001 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8001 Use after free in Printing
CVE-2026-8002 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8002 Use after free in Audio
CVE-2026-8003 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8003 Insufficient validation of untrusted input in TabGroups
CVE-2026-8004 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8004 Insufficient policy enforcement in DevTools
CVE-2026-8005 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8005 Insufficient validation of untrusted input in Cast
CVE-2026-8006 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8006 Insufficient policy enforcement in DevTools
CVE-2026-8007 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8007 Insufficient validation of untrusted input in Cast
CVE-2026-8008 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8008 Inappropriate implementation in DevTools
CVE-2026-8009 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8009 Inappropriate implementation in Cast
CVE-2026-8010 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8010 Insufficient validation of untrusted input in SiteIsolation
CVE-2026-8011 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8011 Insufficient policy enforcement in Search
CVE-2026-8012 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8012 Inappropriate implementation in MHTML
CVE-2026-8013 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8013 Insufficient validation of untrusted input in FedCM
CVE-2026-8014 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8014 Inappropriate implementation in Preload
CVE-2026-8015 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8015 Inappropriate implementation in Media
CVE-2026-8016 ↗Microsoft Edge (Chromium-based)N/AOut-of-band1%Microsoft rating unavailableChromium: CVE-2026-8016 Use after free in WebRTC
CVE-2026-8017 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8017 Side-channel information leakage in Media
CVE-2026-8018 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8018 Insufficient policy enforcement in DevTools
CVE-2026-8019 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8019 Insufficient policy enforcement in WebApp
CVE-2026-8021 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8021 Script injection in UI
CVE-2026-8022 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-8022 Inappropriate implementation in MHTML
CVE-2026-31769 ↗azl3 kernel 6.6.134.1-2 on Azure Linux 3.0N/AOut-of-band0%Microsoft rating unavailablegpib: fix use-after-free in IO ioctl handlers
CVE-2026-43421 ↗azl3 kernel 6.6.137.1-2 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailableusb: gadget: f_ncm: Fix net_device lifecycle with device_move
CVE-2026-43398 ↗azl3 kernel 6.6.137.1-2 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailabledrm/amdgpu: add upper bound check on user inputs in wait ioctl
CVE-2026-43400 ↗azl3 kernel 6.6.137.1-2 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailabledrm/amdgpu: add upper bound check on user inputs in signal ioctl
CVE-2026-43317 ↗azl3 kernel 6.6.138.1-1 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailablemost: core: fix leak on early registration failure
CVE-2026-43443 ↗azl3 kernel 6.6.137.1-2 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailableASoC: amd: acp-mach-common: Add missing error check for clock acquisition
CVE-2026-43320 ↗azl3 kernel 6.6.137.1-2 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailabledrm/amd/display: Fix dsc eDP issue
CVE-2025-71302 ↗azl3 kernel 6.6.137.1-2 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailabledrm/panthor: fix for dma-fence safe access rules
CVE-2026-43474 ↗azl3 kernel 6.6.137.1-2 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailablefs: init flags_valid before calling vfs_fileattr_get
CVE-2026-43045 ↗azl3 kernel 6.6.134.1-2 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailablemshv: Fix error handling in mshv_region_pin
CVE-2026-43021 ↗azl3 kernel 6.6.134.1-2 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailableBluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails
CVE-2026-43022 ↗azl3 kernel 6.6.141.1-1 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailableBluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
The next page could not be added in place. The ordinary page link remains available; try it again to navigate normally.