Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,977 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 4 hours ago Checked every 6 hours
All vendor sources Official source

15,977 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2025-4565
HighCVSS 5.3

Unbounded recursion in Python Protobuf

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscm2 protobuf 3.17.3-4 on CBL Mariner 2.0, azl3 protobuf 25.3-5 on Azure Linux 3.0, cbl2 protobuf 3.17.3-4 on CBL-Mariner 2.0, cbl2 protobuf 3.17.3-4 on CBL Mariner 2.0
Fixed versions3.17.3-4, 25.3-5
Vendor guidance

CBL-Mariner Releases

CVE-2025-4565
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-1795
Low

Mishandling of comma during folding and unicode-encoding of email headers

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 python3 3.9.19-13 on CBL-Mariner 2.0, cbl2 python3 3.9.19-12 on CBL Mariner 2.0, cbl2 python3 3.9.19-13 on CBL Mariner 2.0
Fixed versions3.9.19-12
Vendor guidance

CBL-Mariner Releases

CVE-2025-1795
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-0686
MediumCVSS 6.4

Grub2: romfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading dat

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 grub2 2.06-24 on Azure Linux 3.0, cbl2 grub2 2.06-15 on CBL-Mariner 2.0, cbl2 grub2 2.06-14 on CBL Mariner 2.0, cbl2 grub2 2.06-15 on CBL Mariner 2.0
Fixed versions2.06-25, 2.06-15
Vendor guidance

CBL-Mariner Releases

CVE-2025-0686
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-0678
MediumCVSS 6.4

Grub2: squash4: integer overflow may lead to heap based out-of-bounds write when reading data

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 grub2 2.06-24 on Azure Linux 3.0, cbl2 grub2 2.06-15 on CBL Mariner 2.0, azl3 grub2 2.06-25 on Azure Linux 3.0, cbl2 grub2 2.06-15 on CBL-Mariner 2.0
Fixed versions2.06-25, 2.06-15
Vendor guidance

CBL-Mariner Releases

CVE-2025-0678
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-45782
MediumCVSS 6.7

Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382)

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 grub2 2.06-14 on CBL Mariner 2.0, azl3 grub2 2.06-24 on Azure Linux 3.0, cbl2 grub2 2.06-15 on CBL Mariner 2.0, azl3 grub2 2.06-25 on Azure Linux 3.0
Fixed versions2.06-15, 2.06-25
Vendor guidance

CBL-Mariner Releases

CVE-2024-45782
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-6199
LowCVSS 3.3

Gdk-pixbuf: uninitialized memory disclosure in gdkpixbuf gif lzw decoder

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscm2 gdk-pixbuf2 2.40.0-7 on CBL Mariner 2.0, azl3 gdk-pixbuf2 2.42.10-3 on Azure Linux 3.0, azl3 gdk-pixbuf2 2.42.10-2 on Azure Linux 3.0, cbl2 gdk-pixbuf2 2.40.0-6 on CBL-Mariner 2.0
Fixed versions2.40.0-7, 2.42.10-3
Vendor guidance

CBL-Mariner Releases

CVE-2025-6199
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-57901
Medium

af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-3 on CBL Mariner 2.0, azl3 kernel 6.6.78.1-3 on Azure Linux 3.0, azl3 kernel 6.6.64.2-9 on Azure Linux 3.0, cbl2 kernel 5.15.173.1-2 on CBL Mariner 2.0
Fixed versions5.15.176.3-3, 6.6.78.1-3
Vendor guidance

CBL-Mariner Releases

CVE-2024-57901
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-56703
MediumCVSS 7.5

ipv6: Fix soft lockups in fib6_select_path under high next hop churn

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.78.1-3 on Azure Linux 3.0, azl3 kernel 6.6.64.2-9 on Azure Linux 3.0
Fixed versions6.6.78.1-3
Vendor guidance

CBL-Mariner Releases

CVE-2024-56703
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-4748
Medium

Absolute path traversal in zip:unzip/1,2

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 erlang 25.3.2.21-2 on CBL Mariner 2.0, azl3 erlang 26.2.5.13-1 on Azure Linux 3.0, cbl2 erlang 25.3.2.21-2 on CBL-Mariner 2.0, azl3 erlang 26.2.5.15-1 on Azure Linux 3.0
Fixed versions25.3.2.21-2, 26.2.5.13-1
Vendor guidance

CBL-Mariner Releases

CVE-2025-4748
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-21521
HighCVSS 7.5

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 mysql 8.0.41-1 on Azure Linux 3.0
Fixed versions8.0.40-1
Vendor guidance

CBL-Mariner Releases

CVE-2025-21521
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-54411
MediumCVSS 5.9

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.

Mariner

Affected productsazl3 pam 1.5.3-5 on Azure Linux 3.0
CVE-2026-54411
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-57902
MediumCVSS 5.5

af_packet: fix vlan_get_tci() vs MSG_PEEK

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-3 on CBL Mariner 2.0, azl3 kernel 6.6.78.1-3 on Azure Linux 3.0, azl3 kernel 6.6.64.2-9 on Azure Linux 3.0, cbl2 kernel 5.15.173.1-2 on CBL Mariner 2.0
Fixed versions5.15.176.3-3, 6.6.78.1-3
Vendor guidance

CBL-Mariner Releases

CVE-2024-57902
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources