Vendor advisories

Microsoft Security Response Center

Browse 17,705 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 hours ago Checked every 6 hours

17,705 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results

Microsoft Security Response CenterCVE-2026-52909

Updated Jul 8, 2026

HighCVSS 7.8

ip6_vti: set netns_immutable on the fallback device.

Mariner

Affected productsazl3 kernel 6.6.143.1-1 on Azure Linux 3.0

Fixed versions6.6.144.1-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-52909

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-53163

Updated Jul 8, 2026

MediumCVSS 5.5

locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

Mariner

Affected productsazl3 kernel 6.6.143.1-1 on Azure Linux 3.0, azl3 kernel 6.6.141.1-1 on Azure Linux 3.0

Fixed versions6.6.144.1-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-53163

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-53138

Updated Jul 8, 2026

MediumCVSS 5.5

drm/amd/display: Bound VBIOS record-chain walk loops

Mariner

Affected productsazl3 kernel 6.6.141.1-1 on Azure Linux 3.0, azl3 kernel 6.6.143.1-1 on Azure Linux 3.0

Fixed versions6.6.144.1-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-53138

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-53157

Updated Jul 8, 2026

MediumCVSS 5.5

net: phonet: free phonet_device after RCU grace period

Mariner

Affected productsazl3 kernel 6.6.143.1-1 on Azure Linux 3.0

Fixed versions6.6.144.1-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-53157

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-52928

Updated Jul 8, 2026

MediumCVSS 5.5

af_unix: Reject SIOCATMARK on non-stream sockets

Mariner

Affected productsazl3 kernel 6.6.141.1-1 on Azure Linux 3.0, azl3 kernel 6.6.143.1-1 on Azure Linux 3.0

Fixed versions6.6.144.1-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-52928

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-53151

Updated Jul 8, 2026

MediumCVSS 5.5

rxrpc: Fix the ACK parser to extract the SACK table for parsing

Mariner

Affected productsazl3 kernel 6.6.143.1-1 on Azure Linux 3.0, azl3 kernel 6.6.141.1-1 on Azure Linux 3.0

Fixed versions6.6.144.1-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-53151

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-50656

Updated Jul 8, 2026

HighCVSS 7.8

Microsoft Defender Elevation of Privilege Vulnerability

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".

Affected productsMicrosoft Malware Protection Engine

Fixed versions1.1.26060.3008

Vendor guidance

Release Notes

CVE-2026-50656

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-42980

Updated Jul 8, 2026

HighCVSS 7.8

NT OS Kernel Elevation of Privilege Vulnerability

Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)

Fixed versions10.0.17763.8880, 10.0.20348.5256, 10.0.19044.7417, 10.0.19045.7417

Vendor guidance

Install KB5094123. Install KB5094128. Install KB5094127. Install KB5094125. Install KB5094126. Install KB5093998. Install KB5094122. Install KB5094042. Install KB5094041. Install KB5095051.

CVE-2026-42980

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-58525

Published Jul 8, 2026

HighCVSS 8.2

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.50

Vendor guidance

Release Notes

CVE-2026-58525

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-14258

Updated Jul 6, 2026

MediumCVSS 6.5

Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling

Mariner

Affected productsazl3 dhcpcd 10.0.8-2 on Azure Linux 3.0, azl3 dhcpcd 10.0.8-4 on Azure Linux 3.0

Fixed versions10.0.8-4

Vendor guidance

CBL-Mariner Releases

CVE-2026-14258

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-13595

Updated Jul 6, 2026

MediumCVSS 6.8

Util-linux: util-linux: heap use-after-free in libblkid nested partition probing

Mariner

Affected productsazl3 util-linux 2.40.2-4 on Azure Linux 3.0, azl3 util-linux 2.40.2-5 on Azure Linux 3.0

Fixed versions2.40.2-5

Vendor guidance

CBL-Mariner Releases

CVE-2026-13595

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-11625

Updated Jul 6, 2026

MediumCVSS 7.5

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes

Mariner

Affected productsazl3 perl-Bytes-Random-Secure 0.29-22 on Azure Linux 3.0, azl3 perl-Bytes-Random-Secure 0.29-21 on Azure Linux 3.0

Fixed versions0.29-22

Vendor guidance

CBL-Mariner Releases

CVE-2026-11625

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-3196

Updated Jul 6, 2026

MediumCVSS 5.5

Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation

Mariner

Affected productsazl3 qemu 9.1.0-8 on Azure Linux 3.0, azl3 qemu 9.1.0-10 on Azure Linux 3.0, azl3 qemu 9.1.0-7 on Azure Linux 3.0, azl3 qemu 9.1.0-9 on Azure Linux 3.0

Fixed versions9.1.0-10

Vendor guidance

CBL-Mariner Releases

CVE-2026-3196

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2025-15661

Updated Jul 6, 2026

MediumCVSS 6.5

libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c

Mariner

Affected productsazl3 libssh2 1.11.1-2 on Azure Linux 3.0, azl3 libssh2 1.11.1-4 on Azure Linux 3.0, azl3 libssh 0.10.6-8 on Azure Linux 3.0, azl3 libssh2 1.11.1-3 on Azure Linux 3.0

Fixed versions1.11.1-4

Vendor guidance

CBL-Mariner Releases

CVE-2025-15661

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-55199

Updated Jul 6, 2026

MediumCVSS 5.9

libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler

Mariner

Affected productsazl3 libssh 0.10.6-8 on Azure Linux 3.0, azl3 libssh2 1.11.1-3 on Azure Linux 3.0, azl3 libssh2 1.11.1-4 on Azure Linux 3.0, azl3 libssh2 1.11.1-2 on Azure Linux 3.0

Fixed versions1.11.1-4

Vendor guidance

CBL-Mariner Releases

CVE-2026-55199

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-56116

Updated Jul 6, 2026

MediumCVSS 6.5

dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling

Mariner

Affected productsazl3 dhcpcd 10.0.8-4 on Azure Linux 3.0, azl3 dhcpcd 10.0.8-1 on Azure Linux 3.0, azl3 dhcpcd 10.0.8-2 on Azure Linux 3.0

Fixed versions10.0.8-2

Vendor guidance

CBL-Mariner Releases

CVE-2026-56116

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-11623

Updated Jul 6, 2026

LowCVSS 4.5

tmux image.c image_free use after free

Mariner

Affected productsazl3 tmux 3.4-2 on Azure Linux 3.0, azl3 tmux 3.4-1 on Azure Linux 3.0

Fixed versions3.4-2

Vendor guidance

CBL-Mariner Releases

CVE-2026-11623

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-10028

Updated Jul 6, 2026

MediumCVSS 4.3

Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chain

Mariner

Affected productsazl3 glib-networking 2.78.0-2 on Azure Linux 3.0, azl3 glib-networking 2.78.0-1 on Azure Linux 3.0

Fixed versions2.78.0-2

Vendor guidance

CBL-Mariner Releases

CVE-2026-10028

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-45803

Updated Jul 6, 2026

LowCVSS 3.5

gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

Mariner

Affected productsazl3 gh 2.62.0-15 on Azure Linux 3.0, azl3 gh 2.62.0-18 on Azure Linux 3.0, azl3 gh 2.62.0-16 on Azure Linux 3.0, azl3 gh 2.62.0-17 on Azure Linux 3.0

Fixed versions2.62.0-18

Vendor guidance

CBL-Mariner Releases

CVE-2026-45803

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41889

Updated Jul 6, 2026

Low

pgx: SQL Injection via placeholder confusion with dollar quoted string literals

Mariner

Affected productsazl3 keda 2.14.1-11 on Azure Linux 3.0, azl3 telegraf 1.31.0-19 on Azure Linux 3.0, azl3 keda 2.14.1-13 on Azure Linux 3.0, azl3 keda 2.14.1-15 on Azure Linux 3.0

Fixed versions2.14.1-15, 1.31.0-22

Vendor guidance

CBL-Mariner Releases

CVE-2026-41889

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2025-58160

Updated Jul 6, 2026

Low

Tracing logging user input may result in poisoning logs with ANSI escape sequences

Mariner

Affected productsazl3 kata-containers 3.19.1.kata2-2 on Azure Linux 3.0, azl3 rpm-ostree 2024.4-5 on Azure Linux 3.0, azl3 rust 1.75.0-22 on Azure Linux 3.0, azl3 rust 1.86.0-10 on Azure Linux 3.0

Fixed versions1.75.0-25, 1.90.0-4, 2022.1-8, 1.72.0-15

Vendor guidance

CBL-Mariner Releases

CVE-2025-58160

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41579

Updated Jul 5, 2026

LowCVSS 3.3

runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

Mariner

Affected productsazl3 runc 1.3.3-2 on Azure Linux 3.0

Fixed versions1.3.6-1

Vendor guidance

CBL-Mariner Releases

CVE-2026-41579

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-14142

Published Jul 3, 2026

Severity not listed

Chromium: CVE-2026-14142 Inappropriate implementation in Extensions

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Vendor guidance

Release Notes

CVE-2026-14142

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-14131

Published Jul 3, 2026

Severity not listed

Chromium: CVE-2026-14131 Insufficient validation of untrusted input in WebAppInstalls

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)

Fixed versions150.0.4078.48

Vendor guidance

Release Notes

CVE-2026-14131

Read the vendor advisory Watch this product

Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources