Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,972 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 hours ago Checked every 6 hours
All vendor sources Official source

15,972 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2025-69647
MediumCVSS 6.2

GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis.

Mariner

Affected productscbl2 binutils 2.37-20 on CBL Mariner 2.0, azl3 binutils 2.41-10 on Azure Linux 3.0, azl3 binutils 2.41-11 on Azure Linux 3.0, cbl2 binutils 2.37-20
Fixed versions2.41-11
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2025-69647
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-22702
MediumCVSS 4.5

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Mariner

Affected productscbl2 python-virtualenv 20.26.6-3 on CBL Mariner 2.0, cbl2 python-virtualenv 20.26.6-2 on CBL Mariner 2.0, azl3 python-virtualenv 20.25.0-3 on Azure Linux 3.0, cbl2 python-virtualenv 20.26.6-3 on CBL-Mariner 2.0
Fixed versions20.36.1-1
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-22702
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-38063
MediumCVSS 7.0

dm: fix unconditional IO throttle caused by REQ_PREFLUSH

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.92.2-2 on Azure Linux 3.0, cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0
Fixed versions6.6.96.1-1
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2025-38063
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-39829
MediumCVSS 5.5

trace/fgraph: Fix the warning caused by missing unregister notifier

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0, cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0
Vendor guidance

Release Notes

CVE-2025-39829
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-39810
MediumCVSS 7.8

bnxt_en: Fix memory corruption when FW resources change during ifdown

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.96.2-2 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0, azl3 kernel 6.6.117.1-1 on Azure Linux 3.0, azl3 kernel 6.6.119.3-3 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2025-39810
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-39833
MediumCVSS 7.0

mISDN: hfcpci: Fix warning when deleting uninitialized timer

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.104.2-4 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0, azl3 kernel 6.6.117.1-1 on Azure Linux 3.0, azl3 kernel 6.6.119.3-1 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2025-39833
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-53605
MediumCVSS 5.9

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kata-containers 3.18.0.kata0-3 on Azure Linux 3.0, azl3 kata-containers-cc 3.15.0.aks0-4 on Azure Linux 3.0, azl3 rust 1.86.0-4 on Azure Linux 3.0, cbl2 kata-containers 3.2.0.azl2-6 on CBL Mariner 2.0
Fixed versions3.19.1.kata2-1, 1.86.0-4, 1.72.0-11, 1.75.0-17
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2025-53605
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-0612
HighCVSS 8.8

Chromium: CVE-2025-0611 Object corruption in V8

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based), cbl2 nodejs18 18.20.3-12 on CBL-Mariner 2.0
Fixed versions132.0.2957.127
Vendor guidance

Release Notes

CVE-2025-0611CVE-2025-0612
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-49861
HighCVSS 7.8

bpf: Fix helper writes to read-only maps

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.56.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0
Fixed versions6.6.56.1-5
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2024-49861
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-105712
LowCVSS 3.6

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Mariner

Affected productsazl3 gnupg2 2.4.9-3 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2026-105712
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources