Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,972 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 6 hours ago Checked every 6 hours
All vendor sources Official source

15,972 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2025-38717
MediumCVSS 5.5

net: kcm: Fix race condition in kcm_unattach()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.112.1-2 on Azure Linux 3.0, azl3 kernel 6.6.117.1-1 on Azure Linux 3.0, azl3 kernel 6.6.119.3-1 on Azure Linux 3.0, cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0
Vendor guidance

Release Notes

CVE-2025-38717
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-37555
HighCVSS 7.5

An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.

Mariner

Affected productscbl2 libsndfile 1.0.31-4 on CBL Mariner 2.0, cbl2 libsndfile 1.0.31-4 on CBL-Mariner 2.0, azl3 libsndfile 1.2.2-4 on Azure Linux 3.0
Fixed versions1.2.2-5
Vendor guidance

Release Notes CBL-Mariner Releases

CVE-2022-33065CVE-2026-37555
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-38705
MediumCVSS 5.5

drm/amd/pm: fix null pointer access

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.96.2-1 on Azure Linux 3.0, azl3 kernel 6.6.96.2-2 on Azure Linux 3.0, azl3 kernel 6.6.104.2-4 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2025-38705
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-29181
MediumCVSS 7.5

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Mariner

Affected productsazl3 containerd2 2.1.6-1 on Azure Linux 3.0, azl3 containerized-data-importer 1.62.0-3 on Azure Linux 3.0, azl3 gh 2.62.0-15 on Azure Linux 3.0, azl3 telegraf 1.31.0-19 on Azure Linux 3.0
Fixed versions2.22.0-5, 1.3.0-1, 3.5.30-2, 2.22.0-3
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-29181
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-30656
HighCVSS 7.5

A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. The callback function str_fdp_pli_cb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash.

Mariner

Affected productsazl3 fio 3.37-3 on Azure Linux 3.0, cbl2 fio 3.30-3, cbl2 fio 3.30-3 on CBL-Mariner 2.0, cbl2 fio 3.30-3 on CBL Mariner 2.0
Fixed versions3.37-4
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-30656
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-7425
HighCVSS 7.8

Libxslt: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 libxslt 1.1.34-8 on CBL Mariner 2.0, azl3 libxslt 1.1.43-1 on Azure Linux 3.0, azl3 libxslt 1.1.43-3 on Azure Linux 3.0, cbl2 libxslt 1.1.34-10 on CBL Mariner 2.0
Fixed versions2.11.5-8
Vendor guidance

Release Notes CBL-Mariner Releases

CVE-2025-7425
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-6497
LowCVSS 3.3

HTACG tidy-html5 parser.c prvTidyParseNamespace assertion

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 tidy 5.8.0-6 on CBL Mariner 2.0, azl3 tidy 5.8.0-6 on Azure Linux 3.0, cbl2 tidy 5.8.0-6 on CBL-Mariner 2.0
Vendor guidance

Release Notes

CVE-2025-6497
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-31628
MediumCVSS 7.0

x86/CPU: Fix FPDSS on Zen1

Mariner

Affected productscbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.130.1-3 on Azure Linux 3.0, azl3 kernel 6.6.134.1-2 on Azure Linux 3.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0
Fixed versions6.6.137.1-1
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-31628
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-6498
LowCVSS 3.3

HTACG tidy-html5 alloc.c defaultAlloc memory leak

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 tidy 5.8.0-6 on CBL Mariner 2.0, azl3 tidy 5.8.0-6 on Azure Linux 3.0, cbl2 tidy 5.8.0-6 on CBL-Mariner 2.0
Vendor guidance

Release Notes

CVE-2025-6498
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-38064
MediumCVSS 6.7

virtio: break and reset virtio devices on device_shutdown()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.96.2-1 on Azure Linux 3.0, azl3 kernel 6.6.104.2-4 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0, azl3 kernel 6.6.121.1-1 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2025-38064
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-31578
MediumCVSS 7.8

media: as102: fix to not free memory after the device is registered in as102_usb_probe()

Mariner

Affected productscbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0, azl3 kernel 6.6.130.1-3 on Azure Linux 3.0, azl3 kernel 6.6.134.1-2 on Azure Linux 3.0
Fixed versions6.6.137.1-1
Vendor guidance

Release Notes CBL-Mariner Releases

CVE-2026-31578
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources