CYBERSECURITYTRACKER
TRACKING7,194 stories in this site build1,511 vulnerability news stories in this site build
Vulnerabilities

February 2026 vulnerabilities

Browse this month's returned vendor patches and exploitation signals, with filtering and stable pages for browsing without JavaScript.

Microsoft reports 6 vulnerabilities with exploitation detected in the wild this month. This defender-focused view covers 194 vulnerabilities across 194 returned patch records from 3 vendors. Filter the complete month, or browse the static page trail without JavaScript.

194all patch recordsClear filters15criticalShow these records6Microsoft exploitation detectedShow these records7Microsoft in the Known Exploited Vulnerabilities catalogShow these records84tracked hereShow these records
Patch records
Returned Microsoft and cross-vendor release records. One Common Vulnerabilities and Exposures (CVE) identifier can appear in more than one record.
Tracked here
Records joined to a vulnerability record in this tracker.
Defender priority
Sorts Microsoft exploitation status, Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog status, severity, and tracker coverage first.
More likely
Microsoft's Exploitability Index rating that exploitation is more likely. It is not a claim that exploitation was detected.
Microsoft 173Cisco 20Android 1

Narrow the complete month

Filters use every patch record in this month, including records on later static pages.

Clear all

Microsoft-only signal filters exclude records without Microsoft signal data as unknown, report them separately, and never count them as absent. “Tracked here” covers both Microsoft and cross-vendor records.

Loading the complete-month filter index…

An Exploit Prediction Scoring System (EPSS) percentage is the global 30-day exploitation probability in the wild, not specific to you. Do not read it as a complete risk score or as evidence about your environment or impact.

Page 1 of 1 · records 1 to 194 of 194

Microsoft Security Response Center

CVEDateProductMSRC severityOut-of-bandEPSSTitle
CVE-2026-21510 ↗Windows 10 Version 1809 for 32-bit SystemsImportant26%Microsoft rates: Exploitation DetectedPublicly disclosedCISA KEVVulnCheckENISAKB5075897KB5075899
and 12 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075971KB5075999KB5077179KB5077181KB5077212
Windows Shell Security Feature Bypass Vulnerability
CVE-2026-21513 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant16%Microsoft rates: Exploitation DetectedPublicly disclosedCISA KEVVulnCheckENISAKB5075897KB5075899
and 12 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075971KB5075999KB5077179KB5077181KB5077212
MSHTML Framework Security Feature Bypass Vulnerability
CVE-2026-21514 ↗Microsoft 365 Apps for Enterprise for 32-bit SystemsImportant2%Microsoft rates: Exploitation DetectedPublicly disclosedCISA KEVVulnCheckENISAMicrosoft Word Security Feature Bypass Vulnerability
CVE-2026-21519 ↗Windows 10 Version 1809 for 32-bit SystemsImportant2%Microsoft rates: Exploitation DetectedCISA KEVVulnCheckENISAKB5075897KB5075899
and 10 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075999KB5077179KB5077181KB5077212
Desktop Window Manager Elevation of Privilege Vulnerability
CVE-2026-21533 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant4%Microsoft rates: Exploitation DetectedCISA KEVVulnCheckENISAKB5075897KB5075899
and 12 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075971KB5075999KB5077179KB5077181KB5077212
Windows Remote Desktop Services Elevation of Privilege Vulnerability
CVE-2026-21525 ↗Windows 10 Version 1809 for 32-bit SystemsModerate5%Microsoft rates: Exploitation DetectedCISA KEVVulnCheckENISAKB5075897KB5075899
and 12 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075971KB5075999KB5077179KB5077181KB5077212
Windows Remote Access Connection Manager Denial of Service Vulnerability
CVE-2026-2441 ↗Microsoft Edge (Chromium-based)N/AOut-of-band22%Microsoft rating unavailableCISA KEVVulnCheckENISAChromium: CVE-2026-2441 Use after free in CSS
CVE-2026-21535 ↗Microsoft TeamsCriticalOut-of-band1%Microsoft rates: Exploitation UnlikelyMicrosoft Teams Information Disclosure Vulnerability
CVE-2026-26119 ↗Windows Admin CenterCriticalOut-of-band1%Microsoft rates: Exploitation More LikelyWindows Admin Center Elevation of Privilege Vulnerability
CVE-2026-21522 ↗Microsoft ACI Confidential ContainersCritical0%Microsoft rates: Exploitation Less LikelyMicrosoft ACI Confidential Containers Elevation of Privilege Vulnerability
CVE-2026-23655 ↗Microsoft ACI Confidential ContainersCritical1%Microsoft rates: Exploitation Less LikelyMicrosoft ACI Confidential Containers Information Disclosure Vulnerability
CVE-2026-21532 ↗Azure FunctionsCriticalOut-of-band1%Microsoft rates: N/AAzure Function Information Disclosure Vulnerability
CVE-2026-24300 ↗Azure Front DoorCriticalOut-of-band1%Microsoft rates: N/AAzure Front Door Elevation of Privilege Vulnerability
CVE-2026-24302 ↗Azure ARCCriticalOut-of-band2%Microsoft rates: N/AAzure Arc Elevation of Privilege Vulnerability
CVE-2025-68121 ↗azl3 golang 1.27.0-1 on Azure Linux 3.0CriticalOut-of-bandNot availableMicrosoft rating unavailableUnexpected session resumption in crypto/tls
CVE-2026-27969 ↗cbl2 vitess 17.0.7-12 on CBL Mariner 2.0CriticalOut-of-bandNot availableMicrosoft rating unavailableVitess users with backup storage access can write to arbitrary file paths on restore
CVE-2025-62878 ↗cbl2 local-path-provisioner 0.0.21-20 on CBL Mariner 2.0CriticalOut-of-bandNot availableMicrosoft rating unavailableLocal Path Provisioner vulnerable to Path Traversal via parameters.pathPattern
CVE-2025-61144 ↗azl3 libtiff 4.6.0-11 on Azure Linux 3.0CriticalOut-of-bandNot availableMicrosoft rating unavailablelibtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.
CVE-2026-27211 ↗azl3 cloud-hypervisor 48.0.246-1 on Azure Linux 3.0CriticalOut-of-bandNot availableMicrosoft rating unavailableCloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse
CVE-2026-24834 ↗cbl2 kata-containers 3.2.0.azl2-7 on CBL Mariner 2.0CriticalOut-of-bandNot availableMicrosoft rating unavailableKata Container to Guest micro VM privilege escalation
CVE-2023-2804 ↗Windows Server 2022, 23H2 Edition (Server Core installation)Important1%Microsoft rates: Exploitation Less LikelyKB5075897Red Hat, Inc. CVE-2023-2804: Heap Based Overflow libjpeg-turbo
CVE-2026-20841 ↗Windows NotepadImportant12%Microsoft rates: Exploitation Less Likely1 mentionsWindows Notepad App Remote Code Execution Vulnerability
CVE-2026-20846 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant1%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 12 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075971KB5075999KB5077179KB5077181KB5077212
GDI+ Denial of Service Vulnerability
CVE-2026-21218 ↗.NET 10.0 installed on Mac OSImportant1%Microsoft rates: Exploitation UnlikelyKB5077862KB5077863
and 1 moreKB5077864
.NET Spoofing Vulnerability
CVE-2026-21222 ↗Windows 10 Version 1809 for 32-bit SystemsImportant1%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 10 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075999KB5077181KB5077212
Windows Kernel Information Disclosure Vulnerability
CVE-2026-21228 ↗Azure LocalImportant1%Microsoft rates: Exploitation Less LikelyAzure Local Remote Code Execution Vulnerability
CVE-2026-21229 ↗Power BI Report ServerImportant1%Microsoft rates: Exploitation UnlikelyPower BI Remote Code Execution Vulnerability
CVE-2026-21231 ↗Windows 10 Version 1809 for 32-bit SystemsImportant3%Microsoft rates: Exploitation More LikelyKB5075897KB5075899
and 12 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075971KB5075999KB5077179KB5077181KB5077212
Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-21232 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant0%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 5 moreKB5075941KB5075942KB5077179KB5077181KB5077212
Windows HTTP.sys Elevation of Privilege Vulnerability
CVE-2026-21234 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant0%Microsoft rates: Exploitation UnlikelyKB5075897KB5075899
and 9 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5077179KB5077181KB5077212
Windows Connected Devices Platform Service Elevation of Privilege Vulnerability
CVE-2026-21235 ↗Windows 10 Version 1809 for 32-bit SystemsImportant1%Microsoft rates: Exploitation Less LikelyKB5075904KB5075906
and 7 moreKB5075912KB5075941KB5075943KB5075970KB5075971KB5075999KB5077179
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2026-21236 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant0%Microsoft rates: Exploitation UnlikelyKB5075897KB5075899
and 12 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075971KB5075999KB5077179KB5077181KB5077212
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-21237 ↗Windows Server 2022Important0%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 8 moreKB5075906KB5075912KB5075941KB5075942KB5075943KB5077179KB5077181KB5077212
Windows Subsystem for Linux Elevation of Privilege Vulnerability
CVE-2026-21238 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant3%Microsoft rates: Exploitation More LikelyKB5075897KB5075899
and 12 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075971KB5075999KB5077179KB5077181KB5077212
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-21239 ↗Windows 10 Version 1809 for 32-bit SystemsImportant0%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 11 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075971KB5075999KB5077181KB5077212
Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-21240 ↗Windows 10 Version 1809 for 32-bit SystemsImportant0%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 9 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5077179KB5077181KB5077212
Windows HTTP.sys Elevation of Privilege Vulnerability
CVE-2026-21241 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant3%Microsoft rates: Exploitation More LikelyKB5075897KB5075899
and 7 moreKB5075906KB5075941KB5075942KB5075943KB5077179KB5077181KB5077212
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-21242 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant0%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 8 moreKB5075906KB5075912KB5075941KB5075942KB5075943KB5077179KB5077181KB5077212
Windows Subsystem for Linux Elevation of Privilege Vulnerability
CVE-2026-21243 ↗Windows Server 2019Important1%Microsoft rates: Exploitation UnlikelyKB5075897KB5075899
and 4 moreKB5075904KB5075906KB5075942KB5075943
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
CVE-2026-21244 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant1%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 10 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075999KB5077179KB5077181KB5077212
Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-21245 ↗Windows Server 2025 (Server Core installation)Important0%Microsoft rates: Exploitation Less LikelyKB5075899KB5075942
and 3 moreKB5077179KB5077181KB5077212
Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-21246 ↗Windows 10 Version 1809 for 32-bit SystemsImportant0%Microsoft rates: Exploitation UnlikelyKB5075897KB5075899
and 11 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075971KB5075999KB5077181KB5077212
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2026-21247 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant1%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 10 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075999KB5077179KB5077181KB5077212
Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-21248 ↗Windows 10 Version 1809 for x64-based SystemsImportant1%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 10 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075999KB5077179KB5077181KB5077212
Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-21249 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant11%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 11 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075999KB5077179KB5077181KB5077212
Windows NTLM Spoofing Vulnerability
CVE-2026-21250 ↗Windows Server 2025 (Server Core installation)Important1%Microsoft rates: Exploitation UnlikelyKB5075897KB5075899
and 4 moreKB5075942KB5077179KB5077181KB5077212
Windows HTTP.sys Elevation of Privilege Vulnerability
CVE-2026-21251 ↗Windows Server 2019Important0%Microsoft rates: Exploitation UnlikelyKB5075897KB5075899
and 5 moreKB5075904KB5075906KB5075942KB5075943KB5075999
Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
CVE-2026-21253 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant1%Microsoft rates: Exploitation More LikelyKB5075897KB5075899
and 12 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075971KB5075999KB5077179KB5077181KB5077212
Mailslot File System Elevation of Privilege Vulnerability
CVE-2026-21255 ↗Windows 11 Version 26H1 for ARM64-based SystemsImportant0%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 10 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075999KB5077179KB5077181KB5077212
Windows Hyper-V Security Feature Bypass Vulnerability
CVE-2026-21256 ↗Microsoft Visual Studio 2022 version 17.14Important1%Microsoft rates: Exploitation Less LikelyGitHub Copilot and Visual Studio Remote Code Execution Vulnerability
CVE-2026-21257 ↗Microsoft Visual Studio 2022 version 17.14Important1%Microsoft rates: Exploitation Less LikelyGitHub Copilot and Visual Studio Elevation of Privilege Vulnerability
CVE-2026-21258 ↗Office Online ServerImportant1%Microsoft rates: Exploitation Less LikelyKB5002835KB5002837Microsoft Excel Information Disclosure Vulnerability
CVE-2026-21259 ↗Office Online ServerImportant1%Microsoft rates: Exploitation Less LikelyKB5002835KB5002837Microsoft Excel Elevation of Privilege Vulnerability
CVE-2026-21260 ↗Microsoft SharePoint Enterprise Server 2016Important1%Microsoft rates: Exploitation UnlikelyKB5002833KB5002834
and 4 moreKB5002836KB5002839KB5002840KB5002841
Microsoft Outlook Spoofing Vulnerability
CVE-2026-21261 ↗Office Online ServerImportant1%Microsoft rates: Exploitation Less LikelyKB5002835KB5002837Microsoft Excel Information Disclosure Vulnerability
CVE-2026-21508 ↗Windows 10 Version 1809 for 32-bit SystemsImportant0%Microsoft rates: Exploitation Less LikelyKB5075897KB5075899
and 12 moreKB5075904KB5075906KB5075912KB5075941KB5075942KB5075943KB5075970KB5075971KB5075999KB5077179KB5077181KB5077212
Windows Storage Elevation of Privilege Vulnerability
CVE-2026-21511 ↗Microsoft SharePoint Enterprise Server 2016Important4%Microsoft rates: Exploitation More LikelyKB5002833KB5002834
and 4 moreKB5002836KB5002839KB5002840KB5002841
Microsoft Outlook Spoofing Vulnerability
CVE-2026-21512 ↗Azure DevOps Server 2022Important1%Microsoft rates: Exploitation Less LikelyAzure DevOps Server Cross-Site Scripting Vulnerability
CVE-2026-21516 ↗GitHub Copilot Plugin for JetBrains IDEsImportant1%Microsoft rates: Exploitation Less LikelyGitHub Copilot for Jetbrains Remote Code Execution Vulnerability
CVE-2026-21517 ↗Windows App for MacImportant0%Microsoft rates: Exploitation Less LikelyWindows App for Mac Installer Elevation of Privilege Vulnerability
CVE-2026-21518 ↗Visual Studio CodeImportant1%Microsoft rates: Exploitation Less LikelyGitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-21523 ↗Microsoft Visual Studio Code CoPilot Chat ExtensionImportant1%Microsoft rates: Exploitation Less LikelyGitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-21527 ↗Microsoft Exchange Server Subscription Edition RTMImportant8%Microsoft rates: Exploitation Less LikelyKB5074992KB5074993
and 2 moreKB5074994KB5074995
Microsoft Exchange Server Spoofing Vulnerability
CVE-2026-21528 ↗Azure IoT ExplorerImportant1%Microsoft rates: Exploitation UnlikelyAzure IoT Explorer Information Disclosure Vulnerability
CVE-2026-21529 ↗Azure HDInsightImportant1%Microsoft rates: Exploitation UnlikelyAzure HDInsight Spoofing Vulnerability
CVE-2026-21531 ↗Azure AI Language AuthoringImportant2%Microsoft rates: Exploitation Less LikelyAzure SDK for Python Remote Code Execution Vulnerability
CVE-2026-21537 ↗Microsoft Defender for Endpoint for LinuxImportant1%Microsoft rates: Exploitation Less LikelyMicrosoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability
CVE-2026-27903 ↗azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailableminimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
CVE-2025-61732 ↗azl3 golang 1.27.0-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailablePotential code smuggling via doc comments in cmd/cgo
CVE-2026-27623 ↗azl3 valkey 8.0.7-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailableValkey has Pre-Authentication DOS from malformed RESP request
CVE-2026-23204 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ImportantOut-of-bandNot availableMicrosoft rating unavailablenet/sched: cls_u32: use skb_header_pointer_careful()
CVE-2026-23208 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ImportantOut-of-bandNot availableMicrosoft rating unavailableALSA: usb-audio: Prevent excessive number of frames
CVE-2026-23191 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ImportantOut-of-bandNot availableMicrosoft rating unavailableALSA: aloop: Fix racy access at PCM trigger
CVE-2025-71221 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ImportantOut-of-bandNot availableMicrosoft rating unavailabledmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
CVE-2026-23068 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ImportantOut-of-bandNot availableMicrosoft rating unavailablespi: spi-sprd-adi: Fix double free in probe error path
CVE-2026-23066 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ImportantOut-of-bandNot availableMicrosoft rating unavailablerxrpc: Fix recvmsg() unconditional requeue
CVE-2026-27141 ↗cbl2 azcopy 10.25.1-6 on CBL Mariner 2.0ImportantOut-of-bandNot availableMicrosoft rating unavailableSending certain HTTP/2 frames can cause a server to panic in golang.org/x/net
CVE-2026-28364 ↗azl3 ocaml 5.1.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailableIn OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
CVE-2026-27965 ↗cbl2 vitess 17.0.7-14 on CBL Mariner 2.0ImportantOut-of-bandNot availableMicrosoft rating unavailableVitess users with backup storage access can gain unauthorized access to production deployment environments
CVE-2026-21863 ↗azl3 valkey 8.0.6-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailableMalformed Valkey Cluster bus message can lead to Remote DoS
CVE-2025-67733 ↗azl3 valkey 8.0.6-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailableValkey Affected by RESP Protocol Injection via Lua error_reply
CVE-2026-2492 ↗azl3 tensorflow 2.16.1-10 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailableTensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
CVE-2026-26960 ↗azl3 tar 1.35-2 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailablenode-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction
CVE-2025-69299 ↗azl3 doxygen 1.9.8-2 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailableWordPress Oxygen theme <= 6.0.8 - Server Side Request Forgery (SSRF) vulnerability
CVE-2026-23227 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailabledrm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free
CVE-2025-71233 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailablePCI: endpoint: Avoid creating sub-groups asynchronously
CVE-2025-71229 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailablewifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
CVE-2025-71234 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailablewifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
CVE-2026-23226 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailableksmbd: add chann_lock to protect ksmbd_chann_list xarray
CVE-2025-71231 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailablecrypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode
CVE-2026-23221 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailablebus: fsl-mc: fix use-after-free in driver_override_show()
CVE-2026-23230 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailablesmb: client: split cached_fid bitfields to avoid shared-byte RMW races
CVE-2025-71226 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailablewifi: iwlwifi: Implement settime64 as stub for MVM/MLD PTP
CVE-2026-23214 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailablebtrfs: reject new transactions if the fs is fully read-only
CVE-2025-71225 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ImportantOut-of-bandNot availableMicrosoft rating unavailablemd: suspend array while updating raid_disks via sysfs
CVE-2026-23215 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailablex86/vmware: Fix hypercall clobbers
CVE-2026-23216 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailablescsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
CVE-2026-23213 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailabledrm/amd/pm: Disable MMIO access during SMU Mode 1 reset
CVE-2025-71228 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ImportantOut-of-bandNot availableMicrosoft rating unavailableLoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED
CVE-2026-0391 ↗Microsoft Edge (Chromium-based)ModerateOut-of-band1%Microsoft rates: Exploitation Less LikelyMicrosoft Edge (Chromium-based) for Android Spoofing Vulnerability
CVE-2026-0665 ↗azl3 qemu 10.1.0-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableQemu-kvm: heap off-by-one in kvm xen physdevop_map_pirq
CVE-2026-25727 ↗azl3 rust-afterburn 5.8.2-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailabletime affected by a stack exhaustion denial of service attack
CVE-2026-24051 ↗azl3 ignition-flatcar 2.22.0-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableOpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking
CVE-2026-23100 ↗cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablemm/hugetlb: fix hugetlb_pmd_shared()
CVE-2026-23171 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablebonding: fix use-after-free due to enslave fail after slave array update
CVE-2026-23169 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablemptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
CVE-2026-23157 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablebtrfs: do not strictly require dirty metadata threshold for metadata writepages
CVE-2026-23154 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablenet: fix segmentation of forwarding fraglist GRO
CVE-2026-23126 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablenetdevsim: fix a race issue related to the operation on bpf_bound_progs list
CVE-2026-23118 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablerxrpc: Fix data-race warning and potential load/store tearing
CVE-2026-23113 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailableio_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
CVE-2026-23110 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablescsi: core: Wake up the error handler when final completions race against each other
CVE-2026-23207 ↗azl3 kernel 6.6.126.1-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailablespi: tegra210-quad: Protect curr_xfer check in IRQ handler
CVE-2026-23141 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablebtrfs: send: check for inline extents in range_is_hole_in_parent()
CVE-2026-23138 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailabletracing: Add recursion protection in kernel stack trace recording
CVE-2026-23137 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailableof: unittest: Fix memory leak in unittest_data_add()
CVE-2026-23088 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailabletracing: Fix crash on synthetic stacktrace field usage
CVE-2026-23086 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablevsock/virtio: cap TX credit to local buffer size
CVE-2025-71202 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailableiommu/sva: invalidate stale IOTLB entries for kernel address space
CVE-2026-23069 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablevsock/virtio: fix potential underflow in virtio_transport_get_credit()
CVE-2026-25541 ↗azl3 trident 0.21.0-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableBytes is vulnerable to integer overflow in BytesMut::reserve
CVE-2026-28419 ↗azl3 vim 9.1.1616-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableVim has Heap-based Buffer Underflow in Emacs tags parsing
CVE-2026-28418 ↗azl3 vim 9.1.1616-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableVim has Heap-based Buffer Overflow in Emacs tags parsing
CVE-2026-28420 ↗azl3 vim 9.1.1616-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableVim has Heap-based Buffer Overflow and OOB Read in :terminal
CVE-2026-28421 ↗azl3 vim 9.1.1616-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableVim has a heap-buffer-overflow and a segmentation fault
CVE-2026-28417 ↗azl3 vim 9.1.1616-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableVim has OS Command Injection in netrw
CVE-2026-27571 ↗cbl2 telegraf 1.29.4-18 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablenats-server websockets are vulnerable to pre-auth memory DoS
CVE-2025-61143 ↗azl3 libtiff 4.6.0-11 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailablelibtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.
CVE-2026-2739 ↗cbl2 reaper 3.1.1-22 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailableThis affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
CVE-2026-27199 ↗azl3 python-werkzeug 3.0.3-2 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableWerkzeug safe_join() allows Windows special device names
CVE-2026-2243 ↗azl3 qemu 8.2.0-27 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableQemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing
CVE-2026-23225 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailablesched/mmcid: Don't assume CID is CPU owned on mode switch
CVE-2026-23224 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableerofs: fix UAF issue for file-backed mounts w/ directio option
CVE-2025-71232 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailablescsi: qla2xxx: Free sp in error path to fix system crash
CVE-2025-71237 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablenilfs2: Fix potential block overflow that cause system hang
CVE-2026-23220 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailableksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths
CVE-2025-71236 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablescsi: qla2xxx: Validate sp before freeing associated memory
CVE-2025-71235 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailablescsi: qla2xxx: Delay module unload while fabric scan in progress
CVE-2026-23223 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailablexfs: fix UAF in xchk_btree_check_block_owner
CVE-2026-23228 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablesmb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
CVE-2025-71230 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailablehfs: ensure sb->s_fs_info is always cleaned up
CVE-2026-23222 ↗cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0ModerateOut-of-bandNot availableMicrosoft rating unavailablecrypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
CVE-2026-23229 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailablecrypto: virtio - Add spinlock protection with virtqueue notification
CVE-2026-1979 ↗azl3 nghttp2 1.61.0-2 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailablemruby JMPNOT-to-JMPIF Optimization vm.c mrb_vm_exec use after free
CVE-2026-2443 ↗azl3 libsoup 3.4.4-11 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableLibsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure
CVE-2025-71227 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailablewifi: mac80211: don't WARN for connections on invalid channels
CVE-2026-23217 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailableriscv: trace: fix snapshot deadlock with sbi ecall
CVE-2026-23212 ↗azl3 kernel 6.6.121.1-1 on Azure Linux 3.0ModerateOut-of-bandNot availableMicrosoft rating unavailablebonding: annotate data-races around slave->last_rx
CVE-2026-0102 ↗Microsoft Edge (Chromium-based)LowOut-of-band0%Microsoft rates: Exploitation UnlikelyMicrosoft Edge (Chromium-based) Defense in Depth Vulnerability
CVE-2026-28422 ↗azl3 vim 9.1.1616-1 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailableVim has stack-buffer-overflow in build_stl_str_hl()
CVE-2025-69873 ↗cbl2 python-tensorboard 2.11.0-3 on CBL Mariner 2.0LowOut-of-bandNot availableMicrosoft rating unavailableajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.
CVE-2026-21620 ↗azl3 erlang 26.2.5.15-1 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailableTFTP Path Traversal
CVE-2026-1703 ↗azl3 python-virtualenv 20.36.1-1 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailableLimited path traversal when installing wheel archives
CVE-2026-27171 ↗azl3 zlib 1.3.1-1 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailablezlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
CVE-2026-3063 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-3063 Inappropriate implementation in DevTools
CVE-2026-3062 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-3062 Out of bounds read and write in Tint
CVE-2026-3061 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-3061 Out of bounds read in Media
CVE-2026-2650 ↗Microsoft Edge (Chromium-based)N/AOut-of-band1%Microsoft rating unavailableChromium: CVE-2026-2650 Heap buffer overflow in Media
CVE-2026-2649 ↗Microsoft Edge (Chromium-based)N/AOut-of-band1%Microsoft rating unavailableChromium: CVE-2026-2649 Integer overflow in V8
CVE-2026-2648 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-2648 Heap buffer overflow in PDFium
CVE-2026-2322 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-2322 Heap buffer overflow in Codecs
CVE-2026-2319 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-2319 Race in DevTools
CVE-2026-2316 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-2316 Insufficient policy enforcement in Frames
CVE-2026-2314 ↗Microsoft Edge (Chromium-based)N/AOut-of-band4%Microsoft rating unavailableChromium: CVE-2026-2314 Heap buffer overflow in Codecs
CVE-2026-2320 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-2320 Inappropriate implementation in File input
CVE-2026-2323 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-2323 Inappropriate implementation in Downloads
CVE-2026-2317 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-2317 Inappropriate implementation in Animation
CVE-2026-2318 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableCVE-2026-2318
CVE-2026-2313 ↗Microsoft Edge (Chromium-based)N/AOut-of-band4%Microsoft rating unavailableChromium: CVE-2026-2313 Use after free in CSS
CVE-2026-1862 ↗Microsoft Edge (Chromium-based)N/AOut-of-band1%Microsoft rating unavailableChromium: CVE-2026-1862 Type Confusion in V8
CVE-2026-1861 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-1861 Heap buffer overflow in libvpx
CVE-2025-11563 ↗azl3 mysql 8.0.45-1 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailablewcurl path traversal with percent-encoded slashes
CVE-2025-61145 ↗azl3 libtiff 4.6.0-11 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailablelibtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Cross-vendor patches

VendorCVESeverityProductFixed versionPatchAdvisory
CiscoCVE-2026-20127trackedCVSS 10.0Not reportedNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20129CVSS 9.8Not reportedNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20128trackedCVSS 7.5Not reportedNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20010CVSS 7.4Cisco Nexus 3000 Series SwitchesNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20033CVSS 7.4Cisco Nexus 9000 Series SwitchesNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20048CVSS 7.7Cisco Nexus 9000 Series SwitchesNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20051CVSS 7.4Cisco Nexus 3000 Series SwitchesNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20126CVSS 8.8Not reportedNot reportedPatch ↗Advisory ↗
AndroidCVE-2026-0106High (Android rating)Not reportedNot reportedno patch linkAdvisory ↗
CiscoCVE-2026-20098CVSS 8.8Not reportedNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20119CVSS 7.5Not reportedNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20122trackedCVSS 5.4Not reportedNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20133trackedCVSS 6.5Not reportedNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20036CVSS 6.5Not reportedNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20037CVSS 4.4Not reportedNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20091CVSS 4.8Cisco Firepower 2100 SeriesNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20099CVSS 6.7Cisco Firepower 2100 SeriesNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20107CVSS 5.5Not reportedNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20056CVSS 4.0Not reportedNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20111CVSS 4.8Not reportedNot reportedPatch ↗Advisory ↗
CiscoCVE-2026-20123CVSS 4.3Not reportedNot reportedPatch ↗Advisory ↗

Glossary

Open in glossary