Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,985 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 hours ago Checked every 6 hours
All vendor sources Official source

15,985 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2024-21125
MediumCVSS 4.9

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 mysql 8.0.40-1 on CBL Mariner 2.0, azl3 mysql 8.0.40-1 on Azure Linux 3.0, cbl2 mysql 8.0.36-1 on CBL Mariner 2.0, cbl2 mysql 8.0.36-1 on CBL-Mariner 2.0
Fixed versions8.0.40-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-21125
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-35790
Medium

usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 hyperv-daemons 6.6.35.1-1 on Azure Linux 3.0, cbl2 kernel 5.15.182.1-1 on CBL Mariner 2.0, azl3 hyperv-daemons 6.6.22.1-2 on Azure Linux 3.0, cbl2 kernel 5.15.182.1-1 on CBL-Mariner 2.0
Fixed versions6.6.35.1-1, 5.15.184.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-35790
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-40725
MediumCVSS 5.3

Apache HTTP Server: source code disclosure with handlers configured via AddType

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 httpd 2.4.62-1 on CBL Mariner 2.0, azl3 httpd 2.4.62-1 on Azure Linux 3.0, azl3 httpd 2.4.61-1 on Azure Linux 3.0, cbl2 httpd 2.4.59-1 on CBL Mariner 2.0
Fixed versions2.4.62-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-40725
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-38588
HighCVSS 7.8

ftrace: Fix possible use-after-free issue in ftrace_location()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, cbl2 kernel 5.15.180.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.180.1-1 on CBL-Mariner 2.0
Fixed versions5.15.162.2-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-38588
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-31755
HighCVSS 7.6

cJSON v1.7.17 was discovered to contain a segmentation violation which can trigger through the second parameter of function cJSON_SetValuestring at cJSON.c.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 apparmor 3.0.4-4 on CBL Mariner 2.0, azl3 apparmor 3.1.7-1 on Azure Linux 3.0, cbl2 apparmor 3.0.4-4 on CBL-Mariner 2.0
Fixed versions3.0.4-4, 3.1.7-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-31755
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-21157
MediumCVSS 4.9

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 mysql 8.0.40-1 on CBL Mariner 2.0, azl3 mysql 8.0.40-1 on Azure Linux 3.0, cbl2 mysql 8.0.36-1 on CBL Mariner 2.0, azl3 mysql 8.0.36-1 on Azure Linux 3.0
Fixed versions8.0.40-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-21157
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-21134
MediumCVSS 4.3

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 mysql 8.0.40-1 on CBL Mariner 2.0, azl3 mysql 8.0.40-1 on Azure Linux 3.0, cbl2 mysql 8.0.36-1 on CBL Mariner 2.0, azl3 mysql 8.0.36-1 on Azure Linux 3.0
Fixed versions8.0.40-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-21134
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-41009
MediumCVSS 5.5

bpf: Fix overrunning reservations in ringbuf

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.164.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, azl3 kernel 6.6.35.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.182.1-1 on CBL Mariner 2.0
Fixed versions5.15.164.1-1, 6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

CVE-2024-41009
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2023-38709
HighCVSS 7.3

Apache HTTP Server: HTTP response splitting

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 httpd 2.4.58-4 on Azure Linux 3.0, cbl2 httpd 2.4.58-1 on CBL Mariner 2.0, cbl2 httpd 2.4.59-1 on CBL Mariner 2.0, azl3 httpd 2.4.61-1 on Azure Linux 3.0
Fixed versions2.4.61-1, 2.4.59-1
Vendor guidance

CBL-Mariner Releases

CVE-2023-38709
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-21173
MediumCVSS 4.9

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 mysql 8.0.40-1 on CBL Mariner 2.0, azl3 mysql 8.0.40-1 on Azure Linux 3.0, cbl2 mysql 8.0.36-1 on CBL-Mariner 2.0, cbl2 mysql 8.0.36-1 on CBL Mariner 2.0
Fixed versions8.0.40-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-21173
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-42144
MediumCVSS 5.5

thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0, cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0
CVE-2024-42144
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-41007
LowCVSS 3.3

tcp: avoid too many retransmit packets

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.164.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, cbl2 kernel 5.15.162.2-1 on CBL-Mariner 2.0
Fixed versions5.15.164.1-1, 6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

CVE-2024-41007
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-26913
HighCVSS 7.8

drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.160.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.35.1-4 on Azure Linux 3.0, cbl2 kernel 5.15.176.3-3 on CBL Mariner 2.0, cbl2 kernel 5.15.176.3-3 on CBL-Mariner 2.0
Fixed versions5.15.160.1-1, 6.6.35.1-4
Vendor guidance

CBL-Mariner Releases

CVE-2024-26913
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2022-28805
CriticalCVSS 9.1

singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 ntopng 5.2.1-5 on Azure Linux 3.0, cm1 lua 5.3.5-9 on CBL Mariner 1.0, cbl2 lua 5.4.3-2 on CBL Mariner 2.0, azl3 ntopng 5.2.1-3 on Azure Linux 3.0
Fixed versions5.2.1-3, 5.3.5-9, 5.4.3-2
Vendor guidance

CBL-Mariner Releases

CVE-2022-28805
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2020-22217
MediumCVSS 5.9

Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 python-gevent 21.1.2-1 on CBL Mariner 2.0
Fixed versions21.1.2-1
Vendor guidance

CBL-Mariner Releases

CVE-2020-22217
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-42976
HighCVSS 7.8

Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for x64-based Systems, Windows Server 2022, Windows Server 2022 (Server Core installation), Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9121, 10.0.20348.5499, 10.0.20348.5440, 10.0.19044.7663
Vendor guidance

Install KB5120238. Install KB5120242. Install KB5120229. Install KB5120249. Install KB5120233. Install KB5120228. Install KB5121003. Install KB5120994. Install KB5121000. Install KB5120418. Install KB5120386. Install ...

CVE-2026-42976
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-50655
CriticalCVSS 7.8

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9020, 10.0.20348.5386, 10.0.19044.7548, 10.0.19045.7548
Vendor guidance

Install KB5099538. Install KB5099540. Install KB5099539. Install KB5099536. Install KB5101650. Install KB5101649. Install KB5099535.

CVE-2026-50655
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-58538
HighCVSS 7.8

Windows Bluetooth Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9020, 10.0.20348.5386, 10.0.19044.7548, 10.0.19045.7548
Vendor guidance

Install KB5099538. Install KB5099540. Install KB5099539. Install KB5099536. Install KB5101650. Install KB5101649.

CVE-2026-58538
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-50687
HighCVSS 8.8

Windows Win32k Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems
Fixed versions10.0.26100.33158, 10.0.26200.8875, 10.0.26100.8875, 10.0.28000.2525
Vendor guidance

Install KB5099536. Install KB5101650. Install KB5101649.

CVE-2026-50687
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-50476
HighCVSS 7.8

Windows Network Connections Service Elevation of Privilege Vulnerability

Use after free in Microsoft Windows allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9020, 10.0.20348.5386, 10.0.19044.7548, 10.0.19045.7548
Vendor guidance

Install KB5099538. Install KB5099540. Install KB5099539. Install KB5099536. Install KB5101650. Install KB5101649. Install KB5099535. Install KB5099445. Install KB5099444.

CVE-2026-50476
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-70348
HighCVSS 5.5

Windows Management Services Denial of Service Vulnerability

Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally.

Affected productsWindows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems
Fixed versions10.0.26200.9168, 10.0.26200.9106, 10.0.26100.9168, 10.0.26100.9106
Vendor guidance

Install KB5121003. Install KB5120994. Install KB5121000.

CVE-2026-70348
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-68815
HighCVSS 7.8

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Affected productsOffice Online Server, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems
Fixed versions16.0.10417.20175, https://aka.ms/OfficeSecurityReleases, 16.112.26081010, 16.0.5565.1001
Vendor guidance

Click to Run Release Notes Install KB5002884. Install KB5002903.

CVE-2026-68815
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources