Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,972 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 33 minutes ago Checked every 6 hours
All vendor sources Official source

15,972 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-3184
LowCVSS 3.7

Util-linux: util-linux: access control bypass due to improper hostname canonicalization

Mariner

Affected productscbl2 util-linux 2.37.4-10 on CBL-Mariner 2.0, cbl2 util-linux 2.37.4-10 on CBL Mariner 2.0, azl3 util-linux 2.40.2-3 on Azure Linux 3.0, azl3 util-linux 2.40.2-4 on Azure Linux 3.0
Fixed versions2.37.4-11, 2.40.2-4
Vendor guidance

Release Notes CBL-Mariner Releases

CVE-2026-3184
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-27456
MediumCVSS 4.7

util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup

Mariner

Affected productsazl3 util-linux 2.40.2-3 on Azure Linux 3.0, cbl2 util-linux 2.37.4-10 on CBL Mariner 2.0, cbl2 util-linux 2.37.4-10 on CBL-Mariner 2.0, azl3 util-linux 2.40.2-4 on Azure Linux 3.0
Fixed versions2.40.2-4, 2.37.4-11
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-27456
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-35386
LowCVSS 3.6

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.

Mariner

Affected productsazl3 openssh 9.8p1-5 on Azure Linux 3.0, cbl2 openssh 8.9p1-9 on CBL Mariner 2.0, cbl2 openssh 8.9p1-9 on CBL-Mariner 2.0
Fixed versions9.8p1-6
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-35386
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-35385
MediumCVSS 7.5

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

Mariner

Affected productscbl2 openssh 8.9p1-9 on CBL Mariner 2.0, azl3 openssh 9.8p1-5 on Azure Linux 3.0, cbl2 openssh 8.9p1-9 on CBL-Mariner 2.0
Fixed versions9.8p1-6
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-35385
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-35387
LowCVSS 3.1

OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.

Mariner

Affected productsazl3 openssh 9.8p1-6 on Azure Linux 3.0, cbl2 openssh 8.9p1-9 on CBL-Mariner 2.0, azl3 openssh 9.8p1-5 on Azure Linux 3.0, cbl2 openssh 8.9p1-9 on CBL Mariner 2.0
Fixed versions9.8p1-8
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-35387
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-31609
HighCVSS 7.8

smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()

Mariner

Affected productsazl3 kernel 6.6.130.1-3 on Azure Linux 3.0, azl3 kernel 6.6.134.1-2 on Azure Linux 3.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0
Fixed versions6.6.134.1-2
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-31609
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources