BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Microsoft

May 2026 Security Updates

2026-May May 12, 2026 Source: Vendor

Imported by the Microsoft release catcher from the MSRC CVRF API (2026-May, revision 2026-07-27T01:44:00Z). 1128 vulnerabilities, 159 of them carrying an acknowledgement. Draft — review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://msrc.microsoft.com/update-guide/releaseNote/2026-May
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

211 lines
All 211 CVEs 211 Additional recognition 0 Unclaimed only
Showing 1–50 of 211 , page 1 of 5
CVE-2026-40379 BR2026-0000-002514 unclaimed
Azure Entra ID Spoofing Vulnerability
Credited as Sridhar Periyasamy
CVE-2026-40379 BR2026-0000-002515 unclaimed
Azure Entra ID Spoofing Vulnerability
Credited as Thomas Knudson
CVE-2026-32207 BR2026-0000-002516 unclaimed
Azure Machine Learning Notebook Spoofing Vulnerability
Credited as Jianyang Song
CVE-2026-33109 BR2026-0000-002517 unclaimed
Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability
Credited as Sharath Unni
CVE-2026-40412 BR2026-0000-002518 unclaimed
Azure Orbital Spatio Remote Code Execution Vulnerability
Credited as Michal Kamensky with Microsoft
CVE-2026-23652 BR2026-0000-002519 unclaimed
Microsoft Power Pages Remote Code Execution Vulnerability
Credited as Erik Donker with Microsoft
CVE-2026-35430 BR2026-0000-002520 unclaimed
Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability
Credited as Sridhar Periyasamy with Microsoft
CVE-2026-40411 BR2026-0000-002521 unclaimed
Azure Virtual Network Gateway Remote Code Execution Vulnerability
Credited as Shay Shavit with Microsoft
CVE-2026-47280 BR2026-0000-002522 unclaimed
Azure Resource Manager Elevation of Privilege Vulnerability
Credited as Sridhar Periyasamy
CVE-2026-42827 BR2026-0000-002523 unclaimed
M365 Copilot Information Disclosure Vulnerability
Credited as Microsoft Office Security Team
CVE-2026-41090 BR2026-0000-002524 unclaimed
Microsoft Copilot Tampering Vulnerability
Credited as Ofek Levin Enclave with Enclave
CVE-2026-26147 BR2026-0000-002525 unclaimed
Azure Stack HCI Information Disclosure Vulnerability
Credited as Michal Kamensky with Microsoft
CVE-2026-33843 BR2026-0000-002526 unclaimed
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Credited as Alexander Tan with SecureSAML
CVE-2026-32204 BR2026-0000-002527 unclaimed
Azure Monitor Agent Elevation of Privilege Vulnerability
Credited as P1hcn
CVE-2026-33117 BR2026-0000-002528 unclaimed
Azure SDK for Java Security Feature Bypass Vulnerability
Credited as sho odagiri with GMO CyberSecurity by ierae inc
CVE-2026-33834 BR2026-0000-002529 unclaimed
Windows Event Logging Service Elevation of Privilege Vulnerability
Credited as George Hughey with MSRC Vulnerabilities
CVE-2026-33834 BR2026-0000-002530 unclaimed
Windows Event Logging Service Elevation of Privilege Vulnerability
Credited as Mitigations
CVE-2026-34329 BR2026-0000-002531 unclaimed
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Credited as Azure Yang with Kunlun Lab
CVE-2026-34330 BR2026-0000-002532 unclaimed
Win32k Elevation of Privilege Vulnerability
Credited as wenqunwang with China Telecom Research Institute
CVE-2026-34331 BR2026-0000-002533 unclaimed
Win32k Elevation of Privilege Vulnerability
Credited as wenqunwang with China Telecom Research Institute
CVE-2026-34333 BR2026-0000-002534 unclaimed
Windows Win32k Elevation of Privilege Vulnerability
Credited as wenqunwang with China Telecom Research Institute
CVE-2026-34342 BR2026-0000-002535 unclaimed
Windows Print Spooler Elevation of Privilege Vulnerability
Credited as Marcin Wiazowski working with TrendAI Zero Day Initiative
CVE-2026-34343 BR2026-0000-002536 unclaimed
Windows Application Identity (AppID) Subsystem Elevation of Privilege Vulnerability
Credited as Erik Egsgard with Field Effect
CVE-2026-34344 BR2026-0000-002537 unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Angelboy (@scwuaptx) with DEVCORE
CVE-2026-34344 BR2026-0000-002538 unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Puponia
CVE-2026-34345 BR2026-0000-002539 unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Angelboy (@scwuaptx) with DEVCORE
CVE-2026-34347 BR2026-0000-002540 unclaimed
Windows Win32k Elevation of Privilege Vulnerability
Credited as wenqunwang with China Telecom Research Institute
CVE-2026-34350 BR2026-0000-002541 unclaimed
Windows Storport Miniport Driver Denial of Service Vulnerability
Credited as Microsoft Offensive Research
CVE-2026-34350 BR2026-0000-002542 unclaimed
Windows Storport Miniport Driver Denial of Service Vulnerability
Credited as Security Engineering
CVE-2026-34351 BR2026-0000-002543 unclaimed
Windows TCP/IP Elevation of Privilege Vulnerability
Credited as hazard
CVE-2026-35415 BR2026-0000-002544 unclaimed
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Credited as Jan Vojtesek with SentinelOne
CVE-2026-35416 BR2026-0000-002545 unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Angelboy (@scwuaptx) with DEVCORE
CVE-2026-35417 BR2026-0000-002546 unclaimed
Windows Win32k Elevation of Privilege Vulnerability
Credited as Owen McCullough
CVE-2026-35419 BR2026-0000-002547 unclaimed
Windows DWM Core Library Information Disclosure Vulnerability
Credited as Sergey immortalp0ny Tarasov with Positive Technologies
CVE-2026-35419 BR2026-0000-002548 unclaimed
Windows DWM Core Library Information Disclosure Vulnerability
Credited as namnp with Viettel Cyber Security
CVE-2026-35420 BR2026-0000-002549 unclaimed
Windows Kernel Elevation of Privilege Vulnerability
Credited as Jongseong Kim (nevul37), SEC-agent team
CVE-2026-35420 BR2026-0000-002550 unclaimed
Windows Kernel Elevation of Privilege Vulnerability
Credited as Hwiwon Lee (hwiwonl), SEC-agent team
CVE-2026-35420 BR2026-0000-002551 unclaimed
Windows Kernel Elevation of Privilege Vulnerability
Credited as Younggi Park (grill66), SEC-agent team
CVE-2026-35421 BR2026-0000-002552 unclaimed
Windows GDI Remote Code Execution Vulnerability
Credited as pwn2addr
CVE-2026-35422 BR2026-0000-002553 unclaimed
Windows TCP/IP Driver Security Feature Bypass Vulnerability
Credited as Microsoft
CVE-2026-35423 BR2026-0000-002554 unclaimed
Windows 11 Telnet Client Information Disclosure Vulnerability
Credited as Microsoft
CVE-2026-35424 BR2026-0000-002555 unclaimed
Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
Credited as Microsoft
CVE-2026-35438 BR2026-0000-002556 unclaimed
Windows Admin Center Elevation of Privilege Vulnerability
Credited as sho odagiri with GMO Cybersecurity by Ierae inc
CVE-2026-35439 BR2026-0000-002557 unclaimed
Microsoft SharePoint Server Remote Code Execution Vulnerability
Credited as f7d8c52bec79e42795cf15888b85cbad
CVE-2026-35440 BR2026-0000-002558 unclaimed
Microsoft Word Information Disclosure Vulnerability
Credited as tiebuchen
CVE-2026-40360 BR2026-0000-002559 unclaimed
Microsoft Excel Information Disclosure Vulnerability
Credited as f4
CVE-2026-40360 BR2026-0000-002560 unclaimed
Microsoft Excel Information Disclosure Vulnerability
Credited as Zhiniang Peng with HUST
CVE-2026-40363 BR2026-0000-002561 unclaimed
Microsoft Office Remote Code Execution Vulnerability
Credited as Jeongmin Choi with S2W
CVE-2026-40364 BR2026-0000-002562 unclaimed
Microsoft Word Remote Code Execution Vulnerability
Credited as tiebuchen
CVE-2026-40366 BR2026-0000-002563 unclaimed
Microsoft Word Remote Code Execution Vulnerability
Credited as tiebuchen