Updates installed on this PC

# Updates installed on this device (Component Based Servicing updates only), newest first. Read-only.
param(
    [string]$Id
)

$updates = if ($Id) { Get-HotFix -Id $Id -ErrorAction SilentlyContinue } else { Get-HotFix }

if ($Id -and -not $updates) {
    Write-Output "$Id is not listed by Get-HotFix on this device."
}
$updates |
    Sort-Object InstalledOn -Descending |
    Select-Object HotFixID, Description, InstalledOn, InstalledBy

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

The Windows device you want to check.

Reading the output

• Uses Get-HotFix, which reads the Win32_QuickFixEngineering class. Per Microsoft, that class returns only updates supplied by Component Based Servicing (CBS); updates installed by Windows Installer (MSI) or from the Windows Update site aren't listed, so a missing KB here doesn't prove it isn't installed.
• Pass -Id KB5000000 to check for one update. Newest first.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.