Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,972 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 hours ago Checked every 6 hours
All vendor sources Official source

15,972 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2024-57893
MediumCVSS 6.3

ALSA: seq: oss: Fix races at processing SysEx messages

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0
Vendor guidance

Release Notes

CVE-2024-57893
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-37877
MediumCVSS 5.5

iommu: Clear iommu-dma ops on cleanup

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.112.1-2 on Azure Linux 3.0, cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.117.1-1 on Azure Linux 3.0, azl3 kernel 6.6.119.3-3 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2025-37877
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-37861
MediumCVSS 6.3

scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.96.2-1 on Azure Linux 3.0, azl3 kernel 6.6.96.2-2 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0, azl3 kernel 6.6.117.1-1 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2025-37861
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-58089
MediumCVSS 5.5

btrfs: fix double accounting race when btrfs_run_delalloc_range() failed

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.96.2-1 on Azure Linux 3.0, cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.96.2-2 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2024-58089
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2022-48628
MediumCVSS 5.5

ceph: drop messages from MDS when unmounting

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0
Vendor guidance

Release Notes

CVE-2022-48628
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-50614
MediumCVSS 6.5

TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 tinyxml2 9.0.0-2 on CBL Mariner 2.0, cbl2 blobfuse 1.4.5-17, cbl2 blobfuse 1.4.5-16 on CBL Mariner 2.0, azl3 tinyxml2 9.0.0-2 on Azure Linux 3.0
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2024-50614
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-50615
MediumCVSS 6.5

TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 tinyxml2 9.0.0-2 on Azure Linux 3.0, cbl2 blobfuse 1.4.5-16 on CBL Mariner 2.0, cbl2 tinyxml2 9.0.0-2 on CBL Mariner 2.0, cbl2 blobfuse 1.4.5-17
Fixed versions9.0.0-2
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2024-50615
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-68804
CriticalCVSS 7.8

Microsoft Excel Remote Code Execution Vulnerability

Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Affected productsOffice Online Server, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems
Fixed versions16.0.10417.20175, https://aka.ms/OfficeSecurityReleases, 16.112.26081010, 16.0.5565.1001
Vendor guidance

Click to Run Release Notes Install KB5002884. Install KB5002903.

CVE-2026-68804
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-78446
HighCVSS 7.5

Windows Distributed File System (DFS) Remote Code Execution Vulnerability

Use after free in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9245, 10.0.20348.5622, 10.0.19044.7725, 10.0.19045.7725
Vendor guidance

Install KB5122876. Install KB5122882. Install KB5122878. Install KB5122871. Install KB5124008. Install KB5122880. Install KB5124012. Install KB5123099. Install KB5123065. Install KB5123066.

CVE-2026-78446
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-72936
HighCVSS 8.1

Windows SMB Client Remote Code Execution Vulnerability

Use after free in Windows SMB Client allows an unauthorized attacker to execute code over a network.

Affected productsWindows Server 2022, Windows Server 2022 (Server Core installation), Windows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems
Fixed versions10.0.20348.5622, 10.0.26100.33438, 10.0.26200.9445, 10.0.22631.7582
Vendor guidance

Install KB5122882. Install KB5122871. Install KB5124008. Install KB5122880. Install KB5124012.

CVE-2026-72936
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-69267
HighCVSS 6.5

Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability

Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9245, 10.0.20348.5622, 10.0.19044.7725, 10.0.19045.7725
Vendor guidance

Install KB5122876. Install KB5122882. Install KB5122878. Install KB5122871. Install KB5124008. Install KB5122880. Install KB5124012.

CVE-2026-69267
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-37882
MediumCVSS 7.8

usb: xhci: Fix isochronous Ring Underrun/Overrun event handling

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.138.1-1 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2025-37882
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-37807
MediumCVSS 7.0

bpf: Fix kmemleak warning for percpu hashmap

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.112.1-2 on Azure Linux 3.0, cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.117.1-1 on Azure Linux 3.0, azl3 kernel 6.6.119.3-3 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2025-37807
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-41082
MediumCVSS 5.5

nvme-fabrics: use reserved tag for reg read/write command

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.96.2-1 on Azure Linux 3.0, azl3 kernel 6.6.96.2-2 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0, azl3 kernel 6.6.117.1-1 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2024-41082
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-41045
MediumCVSS 6.4

bpf: Defer work in bpf_timer_cancel_and_free

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.96.2-2 on Azure Linux 3.0, azl3 kernel 6.6.104.2-4 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0, azl3 kernel 6.6.117.1-1 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2024-41045
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-21759
HighCVSS 7.8

ipv6: mcast: extend RCU protection in igmp6_send()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.78.1-3 on Azure Linux 3.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0, azl3 kernel 6.6.82.1-1 on Azure Linux 3.0
Fixed versions6.6.82.1-1
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2025-21759
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-50217
MediumCVSS 7.8

btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.96.2-1 on Azure Linux 3.0, azl3 kernel 6.6.104.2-4 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2024-50217
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-37822
HighCVSS 7.8

riscv: uprobes: Add missing fence.i after building the XOL buffer

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.112.1-2 on Azure Linux 3.0, cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.117.1-1 on Azure Linux 3.0, azl3 kernel 6.6.119.3-1 on Azure Linux 3.0
Fixed versions6.6.121.1-1
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2025-37822
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-21872
MediumCVSS 5.5

efi: Don't map the entire mokvar table to determine its size

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1, cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0
Vendor guidance

Release Notes

CVE-2025-21872
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-11083
LowCVSS 5.5

GNU Binutils Linker elfcode.h elf_swap_shdr heap-based overflow

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 binutils 2.41-7 on Azure Linux 3.0, cbl2 crash 8.0.1-5 on CBL Mariner 2.0, azl3 crash 9.0.0-2 on Azure Linux 3.0, azl3 gdb 13.2-7 on Azure Linux 3.0
Fixed versions2.41-9, 9.0.0-3, 13.2-10, 2.37-19
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2025-11083
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-21710
HighCVSS 7.5

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

Mariner

Affected productscbl2 nodejs18 18.20.3-12, cbl2 nodejs18 18.20.3-12 on CBL Mariner 2.0, azl3 nodejs 20.14.0-14 on Azure Linux 3.0, azl3 nodejs24 24.13.0-3 on Azure Linux 3.0
Fixed versions20.14.0-15, 24.14.1-1, 16.11.59, 17.14.38
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-21710
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources