Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,985 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked about an hour ago Checked every 6 hours
All vendor sources Official source

15,985 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2024-56406
HighCVSS 8.6

Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 perl 5.38.2-507 on Azure Linux 3.0, cbl2 perl 5.34.1-490 on CBL Mariner 2.0, azl3 perl 5.38.2-508 on Azure Linux 3.0, cbl2 perl 5.34.1-490 on CBL-Mariner 2.0
Fixed versions5.38.2-507, 5.34.1-490
Vendor guidance

CBL-Mariner Releases

CVE-2024-56406
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-21789
HighCVSS 7.1

LoongArch: csum: Fix OoB access in IP checksum code for negative lengths

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.78.1-3 on Azure Linux 3.0, azl3 kernel 6.6.79.1-1 on Azure Linux 3.0
Fixed versions6.6.79.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2025-21789
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-56614
HighCVSS 7.8

xsk: fix OOB map writes when deleting elements

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-1 on CBL Mariner 2.0, azl3 kernel 6.6.76.1-1 on Azure Linux 3.0, azl3 kernel 6.6.64.2-9 on Azure Linux 3.0, cbl2 kernel 5.15.173.1-2 on CBL-Mariner 2.0
Fixed versions5.15.176.3-1, 6.6.76.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-56614
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-49949
Medium

net: avoid potential underflow in qdisc_pkt_len_init() with UFO

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.173.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0, cbl2 kernel 5.15.167.1-2 on CBL-Mariner 2.0
Fixed versions5.15.173.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-49949
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-53180
MediumCVSS 5.5

ALSA: pcm: Add sanity NULL check for the default mmap fault handler

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-1 on CBL Mariner 2.0, azl3 kernel 6.6.64.2-1 on Azure Linux 3.0, azl3 kernel 6.6.57.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.173.1-2 on CBL Mariner 2.0
Fixed versions5.15.176.3-1, 6.6.64.2-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-53180
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-23337
MediumCVSS 4.3

jq has signed integer overflow in jv.c:jvp_array_write

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 jq 1.7.1-3 on Azure Linux 3.0, cm2 jq 1.6-3 on CBL Mariner 2.0, cbl2 jq 1.6-3 on CBL Mariner 2.0, cbl2 jq 1.6-3 on CBL-Mariner 2.0
Fixed versions1.7.1-3, 1.6-3
Vendor guidance

CBL-Mariner Releases

CVE-2024-23337
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-57910
HighCVSS 7.1

iio: light: vcnl4035: fix information leak in triggered buffer

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.64.2-9 on Azure Linux 3.0, cbl2 kernel 5.15.176.3-3 on CBL Mariner 2.0, cbl2 kernel 5.15.176.3-3 on CBL-Mariner 2.0
Fixed versions6.6.76.1-1, 5.15.180.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-57910
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-1217
MediumCVSS 3.1

Header parser of http stream wrapper does not handle folded headers

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 php 8.3.14-1 on Azure Linux 3.0, cbl2 php 8.1.31-1 on CBL Mariner 2.0, cbl2 php 8.1.31-1 on CBL-Mariner 2.0, cbl2 php 8.1.32-1 on CBL Mariner 2.0
Fixed versions8.3.19-1, 8.1.32-1
Vendor guidance

CBL-Mariner Releases

CVE-2025-1217
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2022-49484
MediumCVSS 5.5

mt76: mt7915: fix possible NULL pointer dereference in mt7915_mac_fill_rx_vector

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.182.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.182.1-1 on CBL-Mariner 2.0
CVE-2022-49484
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-53099
HighCVSS 7.1

bpf: Check validity of link->type in bpf_link_show_fdinfo()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-1 on CBL Mariner 2.0, azl3 kernel 6.6.64.2-1 on Azure Linux 3.0, cbl2 kernel 5.15.180.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.57.1-7 on Azure Linux 3.0
Fixed versions5.15.176.3-1, 6.6.64.2-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-53099
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-32613
HighCVSS 7.4

HDF5 Library through 1.14.3 contains a heap-based buffer over-read in the function H5HL__fl_deserialize in H5HLcache.c a different vulnerability than CVE-2024-32612.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 hdf5 1.14.4-1 on CBL Mariner 2.0, azl3 hdf5 1.14.4.3-1 on Azure Linux 3.0, azl3 hdf5 1.14.3-1 on Azure Linux 3.0, cbl2 hdf5 1.12.1-13 on CBL Mariner 2.0
Fixed versions1.14.4-1, 1.14.4.3-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-32612CVE-2024-32613
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-21198
MediumCVSS 4.9

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 mysql 8.0.40-1 on CBL Mariner 2.0, azl3 mysql 8.0.40-1 on Azure Linux 3.0, cbl2 mysql 8.0.36-1 on CBL Mariner 2.0, azl3 mysql 8.0.36-1 on Azure Linux 3.0
Fixed versions8.0.40-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-21198
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-21775
MediumCVSS 5.5

can: ctucanfd: handle skb allocation failure

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.79.1-1 on Azure Linux 3.0, azl3 kernel 6.6.78.1-3 on Azure Linux 3.0
Fixed versions6.6.79.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2025-21775
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-50608
HighCVSS 7.5

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_metrics_ng() at prom_rw_prot.c.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 fluent-bit 3.1.9-3 on Azure Linux 3.0, cbl2 fluent-bit 3.0.6-2 on CBL-Mariner 2.0, azl3 fluent-bit 3.1.9-4 on Azure Linux 3.0, cbl2 fluent-bit 3.0.6-2 on CBL Mariner 2.0
Fixed versions3.1.9-3, 3.0.6-2
Vendor guidance

CBL-Mariner Releases

CVE-2024-50608
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-50045
Medium

netfilter: br_netfilter: fix panic with metadata_dst skb

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.173.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.57.1-1 on Azure Linux 3.0, cbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0, azl3 kernel 6.6.56.1-5 on Azure Linux 3.0
Fixed versions5.15.173.1-1, 6.6.57.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-50045
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-49866
Medium

tracing/timerlat: Fix a race during cpuhp processing

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.173.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0, cbl2 kernel 5.15.167.1-2 on CBL-Mariner 2.0
Fixed versions5.15.173.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-49866
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2023-39804
MediumCVSS 6.2

In GNU tar before 1.35 mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 tar 1.34-3 on CBL Mariner 2.0, cbl2 tar 1.34-3 on CBL-Mariner 2.0
Fixed versions1.34-3
Vendor guidance

CBL-Mariner Releases

CVE-2023-39804
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-32906
HighCVSS 7.5

Libsoup: out of bounds reads in soup_headers_parse_request()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 libsoup 3.4.4-6 on Azure Linux 3.0, cbl2 libsoup 3.0.4-3 on CBL Mariner 2.0, azl3 libsoup 3.4.4-3 on Azure Linux 3.0, cbl2 libsoup 3.0.4-6 on CBL Mariner 2.0
Fixed versions3.4.4-3, 3.0.4-3
Vendor guidance

CBL-Mariner Releases

CVE-2025-32906
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-56688
Medium

sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-1 on CBL Mariner 2.0, azl3 kernel 6.6.64.2-1 on Azure Linux 3.0, azl3 kernel 6.6.57.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.173.1-2 on CBL Mariner 2.0
Fixed versions5.15.176.3-1, 6.6.64.2-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-56688
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-21741
HighCVSS 7.1

usbnet: ipheth: fix DPE OoB read

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.78.1-1 on Azure Linux 3.0, azl3 kernel 6.6.64.2-9 on Azure Linux 3.0
Fixed versions6.6.78.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2025-21741
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-26904
Medium

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.158.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.29.1-3 on Azure Linux 3.0, azl3 kernel 6.6.22.1-2 on Azure Linux 3.0, cbl2 kernel 5.15.153.1-2 on CBL Mariner 2.0
Fixed versions5.15.158.2-1, 6.6.29.1-3
Vendor guidance

CBL-Mariner Releases

CVE-2024-26904
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-53068
HighCVSS 7.8

firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.64.2-1 on Azure Linux 3.0, cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.57.1-7 on Azure Linux 3.0
Fixed versions6.6.64.2-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-53068
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-30219
MediumCVSS 6.1

RabbitMQ has XSS Vulnerability in an Error Message in Management UI

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 rabbitmq-server 3.11.24-3 on CBL Mariner 2.0, azl3 rabbitmq-server 3.13.7-2 on Azure Linux 3.0, cbl2 rabbitmq-server 3.11.24-3 on CBL-Mariner 2.0
Fixed versions3.11.24-3, 3.13.7-2
Vendor guidance

CBL-Mariner Releases

CVE-2025-30219
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-27011
Medium

netfilter: nf_tables: fix memleak in map from abort path

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.64.2-9 on Azure Linux 3.0, azl3 kernel 6.6.92.2-1 on Azure Linux 3.0
Fixed versions6.6.64.2-9
Vendor guidance

CBL-Mariner Releases

CVE-2024-27011
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources