Patch Day month
August 2026 vulnerabilities
A defender-focused view of 1,917 vulnerabilities across 2,636 returned patch records from 4 vendors. Filter the month to date, or browse the static page trail without JavaScript.
Narrow the complete month
Filters use every patch record in this month, including records on later static pages.
Microsoft-only signal filters exclude records without Microsoft signal data as unknown, report them separately, and never count them as “no.” “Tracked here” covers both Microsoft and cross-vendor records.
Loading the complete-month filter index…
The complete-month filter index could not be loaded, so filters are unavailable. The static records and page links below remain complete and usable.
An EPSS percentage is the global 30-day exploitation probability in the wild, not specific to you.
Microsoft Security Response Center
CVEDateProductMSRC severityOut-of-bandEPSSTitle
Cross-vendor patches
VendorCVESeverityProductFixed versionPatchAdvisory
Page 13 of 14 · records 2,401–2,600 of 2,636
Microsoft Security Response Center
CVEDateProductMSRC severityOut-of-bandEPSSTitle
CVE-2025-21969 ↗2025-05-05cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0ModerateOut-of-band—Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
CVE-2025-21792 ↗2025-04-09cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0ModerateOut-of-band—ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt
CVE-2025-21667 ↗2025-03-14cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0ModerateOut-of-band—iomap: avoid avoid truncating 64-bit offset to 32 bits
CVE-2025-21673 ↗2025-03-14azl3 kernel 6.6.64.2-9 on Azure Linux 3.0ModerateOut-of-band—smb: client: fix double free of TCP_Server_Info::hostname
CVE-2024-47141 ↗2025-03-13azl3 kernel 6.6.76.1-1 on Azure Linux 3.0ModerateOut-of-band—pinmux: Use sequential access to access desc->pinmux data
CVE-2024-47809 ↗2025-03-13azl3 kernel 6.6.76.1-1 on Azure Linux 3.0ModerateOut-of-band—dlm: fix possible lkb_resource null dereference
CVE-2024-48875 ↗2025-03-13azl3 kernel 6.6.76.1-1 on Azure Linux 3.0ModerateOut-of-band—btrfs: don't take dev_replace rwsem on task already holding it
CVE-2024-56665 ↗2025-03-13azl3 kernel 6.6.76.1-1 on Azure Linux 3.0ModerateOut-of-band—bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
CVE-2024-56703 ↗2025-03-13azl3 kernel 6.6.78.1-3 on Azure Linux 3.0ModerateOut-of-band—ipv6: Fix soft lockups in fib6_select_path under high next hop churn
CVE-2024-56719 ↗2025-03-13azl3 kernel 6.6.76.1-1 on Azure Linux 3.0ModerateOut-of-band—net: stmmac: fix TSO DMA API usage causing oops
CVE-2024-50248 ↗2025-01-29azl3 kernel 6.6.64.2-1 on Azure Linux 3.0ModerateOut-of-band—ntfs3: Add bounds checking to mi_enum_attr()
CVE-2024-50256 ↗2025-01-29azl3 kernel 6.6.64.2-1 on Azure Linux 3.0ModerateOut-of-band—netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
CVE-2024-50284 ↗2025-01-29azl3 kernel 6.6.64.2-1 on Azure Linux 3.0ModerateOut-of-band—ksmbd: Fix the missing xa_store error check
CVE-2024-50285 ↗2025-01-29azl3 kernel 6.6.64.2-1 on Azure Linux 3.0ModerateOut-of-band—ksmbd: check outstanding simultaneous SMB operations
CVE-2024-53079 ↗2025-01-29azl3 kernel 6.6.64.2-1 on Azure Linux 3.0ModerateOut-of-band—mm/thp: fix deferred split unqueue naming and locking
CVE-2024-53091 ↗2025-01-29azl3 kernel 6.6.64.2-1 on Azure Linux 3.0ModerateOut-of-band—bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx
CVE-2024-53093 ↗2025-01-29azl3 kernel 6.6.64.2-1 on Azure Linux 3.0ModerateOut-of-band—nvme-multipath: defer partition scanning
CVE-2024-53094 ↗2025-01-29azl3 kernel 6.6.64.2-1 on Azure Linux 3.0ModerateOut-of-band—RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES
CVE-2024-53100 ↗2025-01-29azl3 kernel 6.6.64.2-1 on Azure Linux 3.0ModerateOut-of-band—nvme: tcp: avoid race between queue_lock lock and destroy
CVE-2024-1543 ↗2024-12-07azl3 mariadb 10.11.6-3 on Azure Linux 3.0ModerateOut-of-band—AES T-Table sub-cache-line leakage
CVE-2024-1544 ↗2024-12-07azl3 mariadb 10.11.6-3 on Azure Linux 3.0ModerateOut-of-band—ECDSA nonce bias caused by truncation
CVE-2024-5288 ↗2024-12-07azl3 mariadb 10.11.6-3 on Azure Linux 3.0ModerateOut-of-band—Safe-error attack on TLS 1.3 Protocol
CVE-2024-49978 ↗2024-11-12azl3 kernel 6.6.57.1-2 on Azure Linux 3.0ModerateOut-of-band—gso: fix udp gso fraglist segmentation after pull from frag_list
CVE-2024-49987 ↗2024-11-12azl3 kernel 6.6.57.1-2 on Azure Linux 3.0ModerateOut-of-band—bpftool: Fix undefined behavior in qsort(NULL 0 ...)
CVE-2024-49988 ↗2024-11-12azl3 kernel 6.6.57.1-2 on Azure Linux 3.0ModerateOut-of-band—ksmbd: add refcnt to ksmbd_conn struct
CVE-2024-47678 ↗2024-11-09azl3 kernel 6.6.56.1-5 on Azure Linux 3.0ModerateOut-of-band—icmp: change the order of rate limits
CVE-2024-47683 ↗2024-11-09azl3 kernel 6.6.56.1-5 on Azure Linux 3.0ModerateOut-of-band—drm/amd/display: Skip Recompute DSC Params if no Stream on Link
CVE-2024-47704 ↗2024-11-09azl3 kernel 6.6.56.1-5 on Azure Linux 3.0ModerateOut-of-band—drm/amd/display: Check link_res->hpo_dp_link_enc before using it
CVE-2024-47728 ↗2024-11-09azl3 kernel 6.6.56.1-5 on Azure Linux 3.0ModerateOut-of-band—bpf: Zero former ARG_PTR_TO_{LONGINT} args in case of error
CVE-2024-49859 ↗2024-11-09azl3 kernel 6.6.56.1-5 on Azure Linux 3.0ModerateOut-of-band—f2fs: fix to check atomic_file in f2fs ioctl interfaces
CVE-2024-49905 ↗2024-11-09azl3 kernel 6.6.56.1-5 on Azure Linux 3.0ModerateOut-of-band—drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2)
CVE-2024-49912 ↗2024-11-09azl3 kernel 6.6.56.1-5 on Azure Linux 3.0ModerateOut-of-band—drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'
CVE-2024-46678 ↗2024-10-16azl3 kernel 6.6.51.1-5 on Azure Linux 3.0ModerateOut-of-band—bonding: change ipsec_lock from spin lock to mutex
CVE-2024-46762 ↗2024-10-16azl3 kernel 6.6.51.1-5 on Azure Linux 3.0ModerateOut-of-band—xen: privcmd: Fix possible access to a freed kirqfd instance
CVE-2024-46765 ↗2024-10-16azl3 kernel 6.6.51.1-5 on Azure Linux 3.0ModerateOut-of-band—ice: protect XDP configuration with a mutex
CVE-2024-46803 ↗2024-10-16azl3 kernel 6.6.51.1-5 on Azure Linux 3.0ModerateOut-of-band—drm/amdkfd: Check debug trap enable before write dbg_ev_file
CVE-2024-27005 ↗2024-09-11azl3 hyperv-daemons 6.6.35.1-1 on Azure Linux 3.0ModerateOut-of-band—interconnect: Don't access req_list while it's being manipulated
CVE-2024-35794 ↗2024-09-11azl3 hyperv-daemons 6.6.35.1-1 on Azure Linux 3.0ModerateOut-of-band—dm-raid: really frozen sync_thread during suspend
CVE-2024-35808 ↗2024-09-11azl3 hyperv-daemons 6.6.35.1-1 on Azure Linux 3.0ModerateOut-of-band—md/dm-raid: don't call md_reap_sync_thread() directly
CVE-2024-42067 ↗2024-08-16azl3 kernel 6.6.43.1-7 on Azure Linux 3.0ModerateOut-of-band—bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
CVE-2024-1151 ↗2024-06-30azl3 hyperv-daemons 6.6.22.1-2 on Azure Linux 3.0ModerateOut-of-band—Kernel: stack overflow problem in open vswitch kernel module leading to dos
CVE-2024-36009 ↗2024-05-23azl3 hyperv-daemons 6.6.35.1-1 on Azure Linux 3.0ModerateOut-of-band—ax25: Fix netdev refcount issue
CVE-2020-29509 ↗2021-12-16azl3 golang 1.24.3-1 on Azure Linux 3.0ModerateOut-of-band—The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
CVE-2020-29511 ↗2021-12-16azl3 golang 1.24.3-1 on Azure Linux 3.0ModerateOut-of-band—The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
CVE-2021-20227 ↗2021-03-27sqlite-3.34.1-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64ModerateOut-of-band—A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
CVE-2020-15358 ↗2021-02-11cm1 mysql 8.0.26-1 on CBL Mariner 1.0ModerateOut-of-band—In SQLite before 3.32.3 select.c mishandles query-flattener optimization leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
CVE-2025-46686 ↗2026-08-07cbl2 redis 6.2.18-3LowOut-of-band0%Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
CVE-2026-40556 ↗2026-04-29cbl2 nano 6.0-3LowOut-of-band—Insecure Directory Permissions in GNU nano Leading to Privilege Abuse
CVE-2025-11840 ↗2025-10-29cbl2 binutils 2.37-19LowOut-of-band0%GNU Binutils ldmisc.c vfinfo out-of-bounds
CVE-2025-2913 ↗2025-09-03cbl2 hdf5 1.14.4-1LowOut-of-band0%HDF5 H5FL.c H5FL__blk_gc_list use after free
CVE-2026-68304 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
CVE-2026-68229 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—media: cedrus: skip invalid H.264 reference list entries
CVE-2026-68209 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—media: sun4i-csi: Return queued buffers on start_streaming() failure
CVE-2026-68117 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
CVE-2026-68376 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—sctp: fix auth_hmacs array size in struct sctp_cookie
CVE-2026-68269 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—drm/i915/gem: Add missing nospec on parallel submit slot
CVE-2026-68301 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—net: hsr: fix memory leak on slave unregistration by removing synced VLANs
CVE-2026-68107 ↗2026-08-11azl3 kernel 6.6.150.1-1 on Azure Linux 3.0Low—drm/amdgpu/vcn4: avoid rereading IB param length
CVE-2026-68248 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—drm/i915: Return NULL on error in active_instance
CVE-2026-68309 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()
CVE-2026-68226 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—media: cx23885: add ioremap return check and cleanup
CVE-2026-68279 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
CVE-2026-68417 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—RDMA/siw: publish QP after initialization
CVE-2026-68422 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
CVE-2026-68280 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
CVE-2026-68277 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
CVE-2026-68220 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
CVE-2026-68234 ↗2026-08-11azl3 kernel 6.6.150.1-1 on Azure Linux 3.0Low—drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
CVE-2026-68403 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—wifi: brcmfmac: initialize SDIO data work before cleanup
CVE-2026-68355 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
CVE-2026-68312 ↗2026-08-11azl3 kernel 6.6.150.1-1 on Azure Linux 3.0Low—cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
CVE-2026-68238 ↗2026-08-11azl3 kernel 6.6.150.1-1 on Azure Linux 3.0Low—drm/amdgpu: Release VFCT ACPI table reference
CVE-2026-68302 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—amt: re-read skb header pointers after every pull
CVE-2026-68256 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
CVE-2026-68288 ↗2026-08-11azl3 kernel 6.6.150.1-1 on Azure Linux 3.0Low—net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
CVE-2026-68171 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
CVE-2026-68363 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
CVE-2026-68244 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0Low—drm/i915/gem: Do not leak siblings[] on proto context error
CVE-2024-21243 ↗2026-08-07azl3 mysql 8.0.41-1 on Azure Linux 3.0LowOut-of-band—Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are affected are 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).
CVE-2025-21546 ↗2026-08-07azl3 mysql 8.0.41-1 on Azure Linux 3.0LowOut-of-band—Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).
CVE-2026-64571 ↗2026-08-07azl3 kernel 6.6.145.2-1 on Azure Linux 3.0LowOut-of-band—wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
CVE-2024-21000 ↗2026-08-07azl3 mysql 8.0.41-1 on Azure Linux 3.0LowOut-of-band—Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).
CVE-2026-18839 ↗2026-08-07azl3 rsync 3.4.3-1 on Azure Linux 3.0LowOut-of-band—Popt-devel: popt-static: size_t underflow in singleoptionhelp
CVE-2026-18739 ↗2026-08-07azl3 popt 1.19-1 on Azure Linux 3.0LowOut-of-band—Popt-devel: popt-static: off-by-one in poptstuffargs
CVE-2026-19023 ↗2026-08-07azl3 hdf5 1.14.6-4 on Azure Linux 3.0LowOut-of-band—HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets
CVE-2026-15037 ↗2026-08-07azl3 qtbase 6.6.3-5 on Azure Linux 3.0LowOut-of-band—XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization
CVE-2026-64549 ↗2026-08-07azl3 kernel 6.6.144.1-1 on Azure Linux 3.0LowOut-of-band—Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
CVE-2026-64546 ↗2026-08-07azl3 kernel 6.6.144.1-1 on Azure Linux 3.0LowOut-of-band—drm/edid: fix OOB read in drm_parse_tiled_block()
CVE-2026-64512 ↗2026-07-26azl3 kernel 6.6.144.1-1 on Azure Linux 3.0LowOut-of-band—ACPI: CPPC: Suppress UBSAN warning caused by field misuse
CVE-2026-47059 ↗2026-07-25azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0LowOut-of-band—Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java san
CVE-2026-59846 ↗2026-07-25azl3 libssh 0.10.6-8 on Azure Linux 3.0LowOut-of-band—Libssh: libssh: information disclosure via proxycommand %r username expansion
CVE-2026-16517 ↗2026-07-25azl3 libarchive 3.7.7-6 on Azure Linux 3.0LowOut-of-band—Libarchive: libarchive: signed integer overflow in archive_write_zip_header
CVE-2026-56392 ↗2026-07-25azl3 coreutils 9.4-7 on Azure Linux 3.0LowOut-of-band—Heap-based Buffer Overflow in GNU coreutils
CVE-2026-42770 ↗2026-07-21azl3 openssl 3.3.7-3 on Azure Linux 3.0LowOut-of-band—FFC-DH Peer Validation Uses Attacker-Supplied q
CVE-2026-42768 ↗2026-06-13azl3 openssl 3.3.7-1 on Azure Linux 3.0LowOut-of-band—Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()
CVE-2026-46044 ↗2026-05-28azl3 kernel 6.6.139.1-1 on Azure Linux 3.0LowOut-of-band—ipmi:ssif: Clean up kthread on errors
CVE-2026-45893 ↗2026-05-28azl3 kernel 6.6.143.1-1 on Azure Linux 3.0LowOut-of-band—apparmor: Fix & Optimize table creation from possibly unaligned memory
CVE-2026-43969 ↗2026-05-15azl3 rabbitmq-server 3.13.7-3 on Azure Linux 3.0LowOut-of-band—Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
CVE-2026-3832 ↗2026-05-07cbl2 gnutls 3.7.11-6 on CBL Mariner 2.0LowOut-of-band—Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response
CVE-2026-34743 ↗2026-04-04azl3 xz 5.4.4-2 on Azure Linux 3.0LowOut-of-band—XZ Utils: Buffer overflow in lzma_index_append()
CVE-2026-35388 ↗2026-04-04cbl2 openssh 8.9p1-9 on CBL Mariner 2.0LowOut-of-band—OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
CVE-2026-3633 ↗2026-03-21azl3 libsoup 3.4.4-12 on Azure Linux 3.0LowOut-of-band—Libsoup: libsoup: header and http request injection via crlf injection
CVE-2026-3632 ↗2026-03-21azl3 libsoup 3.4.4-12 on Azure Linux 3.0LowOut-of-band—Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames
CVE-2026-3634 ↗2026-03-21cbl2 libsoup 3.0.4-12 on CBL Mariner 2.0LowOut-of-band—Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header
CVE-2026-0989 ↗2026-01-19cbl2 libxml2 2.10.4-9 on CBL Mariner 2.0LowOut-of-band—Libxml2: unbounded relaxng include recursion leading to stack overflow
CVE-2025-13837 ↗2025-12-05cbl2 python3 3.9.19-16 on CBL Mariner 2.0LowOut-of-band—Out-of-memory when loading Plist
CVE-2023-53012 ↗2025-11-01cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0LowOut-of-band—thermal: core: call put_device() only after device_register() fails
CVE-2024-36920 ↗2025-10-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0LowOut-of-band—scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
CVE-2025-46394 ↗2025-09-04azl3 busybox 1.36.1-14 on Azure Linux 3.0LowOut-of-band—In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.
CVE-2024-58251 ↗2025-09-04azl3 busybox 1.36.1-17 on Azure Linux 3.0LowOut-of-band—In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
CVE-2024-7598 ↗2025-09-04azl3 kubernetes 1.30.10-9 on Azure Linux 3.0LowOut-of-band—Network restriction bypass via race condition during namespace termination
CVE-2025-7069 ↗2025-09-04cbl2 hdf5 1.14.4-1 on CBL Mariner 2.0LowOut-of-band—HDF5 H5FSsection.c H5FS__sect_link_size heap-based overflow
CVE-2025-1180 ↗2025-09-04cbl2 gdb 11.2-6 on CBL Mariner 2.0LowOut-of-band—GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruption
CVE-2025-1150 ↗2025-09-04azl3 binutils 2.41-7 on Azure Linux 3.0LowOut-of-band—GNU Binutils ld libbfd.c bfd_malloc memory leak
CVE-2025-29477 ↗2025-09-03cbl2 fluent-bit 3.0.6-2 on CBL Mariner 2.0LowOut-of-band—An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.
CVE-2025-29478 ↗2025-09-03cbl2 fluent-bit 3.0.6-2 on CBL Mariner 2.0LowOut-of-band—An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165.
CVE-2025-2912 ↗2025-09-03cbl2 hdf5 1.14.4-1 on CBL Mariner 2.0LowOut-of-band—HDF5 H5Omessage.c H5O_msg_flush heap-based overflow
CVE-2025-2923 ↗2025-09-03azl3 hdf5 1.14.4.3-1 on Azure Linux 3.0LowOut-of-band—HDF5 H5Fint.c H5F_addr_encode_len heap-based overflow
CVE-2024-42155 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0LowOut-of-band—s390/pkey: Wipe copies of protected- and secure-keys
CVE-2025-29923 ↗2025-04-01azl3 telegraf 1.31.0-10 on Azure Linux 3.0LowOut-of-band—go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment
CVE-2024-50211 ↗2025-01-29azl3 kernel 6.6.64.2-1 on Azure Linux 3.0LowOut-of-band—udf: refactor inode_bmap() to handle error
CVE-2024-47738 ↗2024-11-09azl3 kernel 6.6.56.1-5 on Azure Linux 3.0LowOut-of-band—wifi: mac80211: don't use rate mask for offchannel TX either
CVE-2024-5814 ↗2024-12-07cbl2 mariadb 10.6.9-6N/AOut-of-band0%Unverifed Ciphersuite used on a client-side TLS1.3 Downgrade
CVE-2026-68398 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0N/A—ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
CVE-2026-68413 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0N/A—wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
CVE-2026-68428 ↗2026-08-11azl3 kernel 6.6.143.1-1 on Azure Linux 3.0N/A—KVM: x86/mmu: Fix use-after-free on vendor module reload
CVE-2026-61477 ↗2026-08-11azl3 libvirt 10.10.0-2 on Azure Linux 3.0N/A—Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
CVE-2026-64655 ↗2026-08-11azl3 gh 2.62.0-20 on Azure Linux 3.0N/A—GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching
CVE-2026-64652 ↗2026-08-11azl3 gh 2.62.0-20 on Azure Linux 3.0N/A—GitHub CLI: Partial token disclosure in `gh auth status` output
CVE-2026-54522 ↗2026-08-07azl3 rubygem-msgpack 1.7.2-1 on Azure Linux 3.0N/AOut-of-band—MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
CVE-2026-54787 ↗2026-08-07azl3 gh 2.62.0-20 on Azure Linux 3.0N/AOut-of-band—sigstore-go fails to check signature timestamps against a signing key's validity period
CVE-2024-3205 ↗2026-08-07azl3 libyaml 0.2.5-3 on Azure Linux 3.0N/AOut-of-band—Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The maintainer identified an error in the libyaml fuzzers. It is not possible to reproduce nor exploit the issue.
CVE-2024-36022 ↗2026-08-07azl3 kernel 6.6.92.2-1 on Azure Linux 3.0N/AOut-of-band—Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2025-37753 ↗2026-08-07azl3 kernel 6.6.92.2-1 on Azure Linux 3.0N/AOut-of-band—Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-43022 ↗2026-05-02azl3 kernel 6.6.141.1-1 on Azure Linux 3.0N/AOut-of-band—Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
CVE-2024-38620 ↗2025-10-05cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—Bluetooth: HCI: Remove HCI_AMP support
CVE-2025-21635 ↗2025-09-04azl3 kernel 6.6.96.2-2 on Azure Linux 3.0N/AOut-of-band—rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
CVE-2024-38628 ↗2025-09-04cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0N/AOut-of-band—usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.
CVE-2025-21949 ↗2025-09-04azl3 kernel 6.6.96.2-2 on Azure Linux 3.0N/AOut-of-band—LoongArch: Set hugetlb mmap base address aligned with pmd size
CVE-2024-24856 ↗2025-09-04azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—NULL pointer deference in acpi_db_convert_to_package of Linux acpi module
CVE-2023-52939 ↗2025-09-04cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()
CVE-2025-21891 ↗2025-09-03cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0N/AOut-of-band—ipvlan: ensure network headers are in skb linear part
CVE-2022-49750 ↗2025-09-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—cpufreq: CPPC: Add u64 casts to avoid overflowing
CVE-2023-53002 ↗2025-09-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—drm/i915: Fix a memory leak with reused mmap_offset
CVE-2023-53008 ↗2025-09-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—cifs: fix potential memory leaks in session setup
CVE-2022-49742 ↗2025-09-03cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0N/AOut-of-band—f2fs: initialize locks earlier in f2fs_fill_super()
CVE-2025-21961 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—eth: bnxt: fix truesize for mb-xdp-pass case
CVE-2024-39478 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—crypto: starfive - Do not free stack buffer
CVE-2024-56712 ↗2025-09-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—udmabuf: fix memory leak on last export_udmabuf() error path
CVE-2024-49937 ↗2025-09-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—wifi: cfg80211: Set correct chandef when starting CAC
CVE-2024-49939 ↗2025-09-03cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0N/AOut-of-band—wifi: rtw89: avoid to add interface to list twice when SER
CVE-2024-53114 ↗2025-09-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
CVE-2024-42134 ↗2025-09-03azl3 kernel 6.6.112.1-2 on Azure Linux 3.0N/AOut-of-band—virtio-pci: Check if is_avq is NULL
CVE-2024-49920 ↗2025-09-03azl3 kernel 6.6.96.2-2 on Azure Linux 3.0N/AOut-of-band—drm/amd/display: Check null pointers before multiple uses
CVE-2024-49925 ↗2025-09-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—fbdev: efifb: Register sysfs groups through driver core
CVE-2024-49971 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—drm/amd/display: Increase array size of dummy_boolean
CVE-2024-49945 ↗2025-09-03azl3 kernel 6.6.96.2-2 on Azure Linux 3.0N/AOut-of-band—net/ncsi: Disable the ncsi work before freeing the associated structure
CVE-2024-46870 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—drm/amd/display: Disable DMCUB timeout for DCN35
CVE-2024-49972 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—drm/amd/display: Deallocate DML memory if allocation fails
CVE-2024-49885 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—mm, slub: avoid zeroing kmalloc redzone
CVE-2024-53201 ↗2025-09-03azl3 kernel 6.6.96.2-2 on Azure Linux 3.0N/AOut-of-band—drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
CVE-2024-49932 ↗2025-09-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—btrfs: don't readahead the relocation inode on RST
CVE-2023-52485 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—drm/amd/display: Wake DMCUB before sending a command
CVE-2024-49940 ↗2025-09-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—l2tp: prevent possible tunnel refcount underflow
CVE-2024-53089 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—LoongArch: KVM: Mark hrtimer to expire in hard interrupt context
CVE-2024-47662 ↗2025-09-03azl3 kernel 6.6.104.2-4 on Azure Linux 3.0N/AOut-of-band—drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection
CVE-2024-53090 ↗2025-09-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—afs: Fix lock recursion
CVE-2024-49888 ↗2025-09-03azl3 kernel 6.6.104.2-4 on Azure Linux 3.0N/AOut-of-band—bpf: Fix a sdiv overflow issue
CVE-2025-21682 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—eth: bnxt: always recalculate features after XDP clearing, fix null-deref
CVE-2024-47702 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—bpf: Fail verification for sign-extension of packet data/data_end/data_meta
CVE-2024-57872 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()
CVE-2024-53050 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—drm/i915/hdcp: Add encoder check in hdcp2_get_capability
CVE-2024-42107 ↗2025-09-03azl3 kernel 6.6.96.2-1 on Azure Linux 3.0N/AOut-of-band—ice: Don't process extts if PTP is disabled
CVE-2024-50090 ↗2025-09-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—drm/xe/oa: Fix overflow in oa batch buffer
CVE-2024-50091 ↗2025-09-03cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0N/AOut-of-band—dm vdo: don't refer to dedupe_context after releasing it
CVE-2024-26962 ↗2025-09-03azl3 kernel 6.6.104.2-4 on Azure Linux 3.0N/AOut-of-band—dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape
Cross-vendor patches
VendorCVESeverityProductFixed versionPatchAdvisory
Red HatCVE-2025-6170CVSS 2.5Red Hat Insights proxy 1.5registry.redhat.io/insights-proxy/insights-proxy-container-rhel9@sha256:296963717d1d077fc4a37a323ab0a34843b0b5d3eeaa15af0a5ca07b83dcd2c1_arm64Patch ↗Advisory ↗
Red HatCVE-2026-47010CVSS 3.7Red Hat Enterprise Linux Supplementary EUS (v. 10.0)java-21-ibm-semeru-certified-jdk-1:21.0.12.0.8-1.el10_0.aarch64Patch ↗Advisory ↗
Red HatCVE-2026-47010CVSS 3.7Red Hat Enterprise Linux Supplementary (v. 8)java-1.8.0-ibm-1:1.8.0.8.70-1.el8_10.ppc64lePatch ↗Advisory ↗
Red HatCVE-2026-47059CVSS 3.7Red Hat Enterprise Linux Supplementary EUS (v. 10.0)java-21-ibm-semeru-certified-jdk-1:21.0.12.0.8-1.el10_0.aarch64Patch ↗Advisory ↗
Red HatCVE-2026-47059CVSS 3.7Red Hat Enterprise Linux Supplementary (v. 8)java-1.8.0-ibm-1:1.8.0.8.70-1.el8_10.ppc64lePatch ↗Advisory ↗
Red HatCVE-2026-16405CVSS 3.4Red Hat Enterprise Linux AppStream (v. 8)thunderbird-0:140.13.0-1.el8_10.aarch64Patch ↗Advisory ↗
Red HatCVE-2026-47010CVSS 3.7Red Hat Hardened Imagesjava-21-openjdk-portable-main@aarch64Patch ↗Advisory ↗
Red HatCVE-2026-47059CVSS 3.7Red Hat Hardened Imagesjava-21-openjdk-portable-main@aarch64Patch ↗Advisory ↗
Red HatCVE-2026-16405CVSS 3.4Red Hat Enterprise Linux AppStream (v. 9)firefox-0:140.13.0-1.el9_8.aarch64Patch ↗Advisory ↗
Red HatCVE-2026-16405CVSS 3.4Red Hat Enterprise Linux AppStream (v. 10)thunderbird-0:140.13.0-1.el10_2.aarch64Patch ↗Advisory ↗
The next page could not be added in place. The ordinary page link remains available; try it again to navigate normally.