Vendor advisories

Microsoft Security Response Center

Browse 15,859 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 3 hours ago Checked every 6 hours

15,859 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results

Microsoft Security Response CenterCVE-2026-80230

Updated Oct 17, 2026

LowCVSS 3.7

OpenSSL pinning bypass

Mariner

Affected productsazl3 curl 8.11.1-11 on Azure Linux 3.0

Fixed versions8.11.1-12

Vendor guidance

Release Notes

CVE-2026-80230

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-18924

Updated Oct 17, 2026

MediumCVSS 5.9

HTTP/2 server push UAF

Mariner

Affected productsazl3 curl 8.11.1-11 on Azure Linux 3.0

Fixed versions8.11.1-12

Vendor guidance

Release Notes

CVE-2026-18924

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-13608

Updated Oct 17, 2026

LowCVSS 3.7

OpenLDAP SASL authentication bypass

Mariner

Affected productsazl3 curl 8.11.1-11 on Azure Linux 3.0

Fixed versions8.11.1-12

Vendor guidance

Release Notes

CVE-2026-13608

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-19931

Updated Oct 17, 2026

MediumCVSS 6.5

Negotiate ambient user conn reuse

Mariner

Affected productsazl3 curl 8.11.1-11 on Azure Linux 3.0

Fixed versions8.11.1-12

Vendor guidance

Release Notes

CVE-2026-19931

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-93323

Updated Oct 17, 2026

Medium

Oversized Dockerfile or .dockerignore can exhaust buildkitd memory

Mariner

Affected productsazl3 moby-engine 25.0.3-20 on Azure Linux 3.0

Fixed versions25.0.18-1

Vendor guidance

Release Notes

CVE-2026-93323

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-94283

Updated Oct 17, 2026

MediumCVSS 6.5

Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser

Mariner

Affected productsazl3 libX11 1.8.7-1 on Azure Linux 3.0

Fixed versions1.8.7-2

Vendor guidance

Release Notes

CVE-2026-94283

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-94284

Updated Oct 17, 2026

MediumCVSS 5.5

Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser

Mariner

Affected productsazl3 libX11 1.8.7-1 on Azure Linux 3.0

Fixed versions1.8.7-2

Vendor guidance

Release Notes

CVE-2026-94284

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-87875

Updated Oct 17, 2026

MediumCVSS 4.3

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

Mariner

Affected productsazl3 cups 2.4.19-1 on Azure Linux 3.0

Fixed versions2.4.19-2

Vendor guidance

Release Notes

CVE-2026-87875

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-94285

Updated Oct 17, 2026

MediumCVSS 5.1

Out-of-bounds read in libX11's byte-oriented codeset parser

Mariner

Affected productsazl3 libX11 1.8.7-1 on Azure Linux 3.0

Fixed versions1.8.7-2

Vendor guidance

Release Notes

CVE-2026-94285

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-53612

Published Oct 17, 2026

MediumCVSS 7.0

util-linux mount hook_owner TOCTOU allows local privilege escalation

Mariner

Affected productsazl3 util-linux 2.40.2-6 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-53612

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-53613

Published Oct 17, 2026

HighCVSS 7.0

util-linux mount target TOCTOU allows local privilege escalation

Mariner

Affected productsazl3 util-linux 2.40.2-6 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-53613

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-110816

Published Oct 17, 2026

MediumCVSS 5.3

qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

Mariner

Affected productsazl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-110816

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-101025

Published Oct 17, 2026

MediumCVSS 5.3

NGINX ngx_http_js_module vulnerability

Mariner

Affected productsazl3 nginx 1.30.4-1 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-101025

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-110923

Published Oct 17, 2026

MediumCVSS 6.5

Openssh: openssh: sftp can write outside the destination directory from a server-supplied path

Mariner

Affected productsazl3 openssh 9.8p1-10 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-110923

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-95117

Published Oct 17, 2026

MediumCVSS 5.3

Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a denial of service via the jsmn.h, jsmn_parse(), example/jsondump.c, dump() components

Mariner

Affected productsazl3 ntp 4.2.8p17-3 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-95117

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-92392

Published Oct 17, 2026

HighCVSS 8.1

HTTP/2 upload Use-After-Free

Mariner

Affected productsazl3 mysql 8.0.46-2 on Azure Linux 3.0, azl3 rust 1.75.0-31 on Azure Linux 3.0, azl3 rust 1.96.1-2 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-92392

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-94603

Published Oct 17, 2026

CriticalCVSS 10.0

Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

Mariner

Affected productsazl3 libcontainers-common 20240213-3 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-94603

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-95124

Published Oct 17, 2026

HighCVSS 7.5

Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()

Mariner

Affected productsazl3 libconfini 1.16.4-1 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-95124

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-110602

Published Oct 17, 2026

MediumCVSS 6.3

libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path

Mariner

Affected productsazl3 clamav 1.5.4-2 on Azure Linux 3.0, azl3 libmspack 0.11alpha-1 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-110602

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-86847

Published Oct 17, 2026

MediumCVSS 6.5

Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup

Mariner

Affected productsazl3 ceph 18.2.2-13 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-86847

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-111137

Published Oct 17, 2026

MediumCVSS 6.1

libsmi through 0.5.0 Out-of-Bounds Write via smiValueAsString OCTET STRING DEFVAL

Mariner

Affected productsazl3 libsmi 0.4.8-29 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-111137

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-104150

Published Oct 17, 2026

High

AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

Mariner

Affected productsazl3 httpd 2.4.68-1 on Azure Linux 3.0

Vendor guidance

Release Notes

CVE-2026-104150

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-83654

Updated Oct 16, 2026

HighCVSS 7.8

Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2022, Windows Server 2022 (Server Core installation), Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems

Fixed versions10.0.20348.5761, 10.0.19044.7807, 10.0.19045.7807, 10.0.26100.33650

Vendor guidance

Install KB5126655. Install KB5126657. Install KB5126646. Install KB5127648. Install KB5126653. Install KB5127646.

CVE-2026-83654

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-110165

Published Oct 16, 2026

CriticalCVSS 9.6

Chromium CVE-2026-110165: Use after free

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions155.0.4283.60

Vendor guidance

Release Notes

CVE-2026-110165

Read the vendor advisory Watch this product

Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources