Security Warnings — Week: 2026-W14

.NET and Visual Studio Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21172

highMicrosoft MSRC 2026-W14

.NET Elevation of Privilege Vulnerability

2026-04-01 CVE-2025-21173

highMicrosoft MSRC 2026-W14

.NET Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21171

highMicrosoft MSRC 2026-W14

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-38081

highMicrosoft MSRC 2026-W14

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21176

highMicrosoft MSRC 2026-W14

A flood of DNS messages over TCP may make the server unstable

2026-04-01 CVE-2024-0760

highMicrosoft MSRC 2026-W14

A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of service via the "was

2026-04-01 CVE-2024-34250

mediumMicrosoft MSRC 2026-W14

A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.

2026-04-01 CVE-2024-6611

criticalMicrosoft MSRC 2026-W14

A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunder

2026-04-01 CVE-2024-6601

mediumMicrosoft MSRC 2026-W14

ACPI: CPPC: Use access_width over bit_width for system memory accesses

2026-04-01 CVE-2024-35995

mediumMicrosoft MSRC 2026-W14

Active Directory Domain Services Elevation of Privilege Vulnerability

2026-04-01 CVE-2025-21293

highMicrosoft MSRC 2026-W14

Active Directory Federation Server Spoofing Vulnerability

2026-04-01 CVE-2025-21193

mediumMicrosoft MSRC 2026-W14

ALSA: usb-audio: Stop parsing channels bits when all channels are found.

2026-04-01 CVE-2024-27436

mediumMicrosoft MSRC 2026-W14

amd/amdkfd: sync all devices to wait all processes being evicted

2026-04-01 CVE-2024-36949

mediumMicrosoft MSRC 2026-W14

An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vulnerability affects Firefox < 126.

2026-04-01 CVE-2024-4772

mediumMicrosoft MSRC 2026-W14

An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted Pdelay_Req message to the time synchronization function

2026-04-01 CVE-2024-42861

highMicrosoft MSRC 2026-W14

An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.

2026-04-01 CVE-2024-33394

mediumMicrosoft MSRC 2026-W14

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as Netw

2026-04-01 CVE-2024-34397

mediumMicrosoft MSRC 2026-W14

An issue was discovered in HTTP2 in Qt before 5.15.18 6.x before 6.2.13 6.3.x through 6.5.x before 6.5.7 and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisi

2026-04-01 CVE-2024-39936

mediumMicrosoft MSRC 2026-W14

An issue was discovered in RDoc 6.3.3 through 6.6.2 as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file object inje

2026-04-01 CVE-2024-27281

mediumMicrosoft MSRC 2026-W14

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler it is possible to extract arbitrary heap data relative to the st

2026-04-01 CVE-2024-27282

mediumMicrosoft MSRC 2026-W14

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

2026-04-01 CVE-2024-34402

highMicrosoft MSRC 2026-W14

An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.

2026-04-01 CVE-2024-34403

mediumMicrosoft MSRC 2026-W14

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHT

2026-04-01 CVE-2024-34459

highMicrosoft MSRC 2026-W14

An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and undefined behavior. Note: This issue onl

2026-04-01 CVE-2024-4775

mediumMicrosoft MSRC 2026-W14

Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

2026-04-01 CVE-2024-8775

mediumMicrosoft MSRC 2026-W14

Apache HTTP Server proxy encoding problem

2026-04-01 CVE-2024-38473

highMicrosoft MSRC 2026-W14

Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2

2026-04-01 CVE-2024-36387

mediumMicrosoft MSRC 2026-W14

Apache HTTP Server: source code disclosure with handlers configured via AddType

2026-04-01 CVE-2024-39884

mediumMicrosoft MSRC 2026-W14

Apache HTTP Server: source code disclosure with handlers configured via AddType

2026-04-01 CVE-2024-40725

mediumMicrosoft MSRC 2026-W14

Arbitrary code execution during build on Darwin in cmd/go

2026-04-01 CVE-2024-24787

mediumMicrosoft MSRC 2026-W14

ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses

2026-04-01 CVE-2024-26947

mediumMicrosoft MSRC 2026-W14

arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry

2026-04-01 CVE-2024-46822

mediumMicrosoft MSRC 2026-W14

ASN.1 date parser overread

2026-04-01 CVE-2024-7264

mediumMicrosoft MSRC 2026-W14

ASoC: amd: acp: add a null check for chip_pdev structure

2026-04-01 CVE-2024-42074

mediumMicrosoft MSRC 2026-W14

ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item

2026-04-01 CVE-2024-46863

mediumMicrosoft MSRC 2026-W14

ASoC: SOF: Intel: hda: fix null deref on system suspend entry

2026-04-01 CVE-2024-41037

mediumMicrosoft MSRC 2026-W14

ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension

2026-04-01 CVE-2024-39473

mediumMicrosoft MSRC 2026-W14

ASoC: topology: Fix references to freed memory

2026-04-01 CVE-2024-41069

highMicrosoft MSRC 2026-W14

Assertion failure when serving both stale cache data and authoritative zone content

2026-04-01 CVE-2024-4076

highMicrosoft MSRC 2026-W14

ata: libata-core: Fix double free on error

2026-04-01 CVE-2024-41087

highMicrosoft MSRC 2026-W14

ata: libata-core: Fix null pointer dereference on error

2026-04-01 CVE-2024-41098

mediumMicrosoft MSRC 2026-W14

ax25: Fix netdev refcount issue

2026-04-01 CVE-2024-36009

mediumMicrosoft MSRC 2026-W14

ax25: fix use-after-free bugs caused by ax25_ds_del_timer

2026-04-01 CVE-2024-35887

mediumMicrosoft MSRC 2026-W14

Azure AI Face Service Elevation of Privilege Vulnerability

2026-04-01 CVE-2025-21415

criticalMicrosoft MSRC 2026-W14

Azure CycleCloud Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-38092

highMicrosoft MSRC 2026-W14

Azure CycleCloud Remote Code Execution Vulnerability

2026-04-01 CVE-2024-43469

highMicrosoft MSRC 2026-W14

Azure DevOps Server Spoofing Vulnerability

2026-04-01 CVE-2024-35266

highMicrosoft MSRC 2026-W14

Azure DevOps Server Spoofing Vulnerability

2026-04-01 CVE-2024-35267

highMicrosoft MSRC 2026-W14

Azure Kinect SDK Remote Code Execution Vulnerability

2026-04-01 CVE-2024-38086

mediumMicrosoft MSRC 2026-W14

Azure Marketplace SaaS Resources Information Disclosure Vulnerability

2026-04-01 CVE-2025-21380

highMicrosoft MSRC 2026-W14

Azure Migrate Cross-Site Scripting Vulnerability

2026-04-01 CVE-2024-30053

mediumMicrosoft MSRC 2026-W14

Azure Monitor Agent Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-30060

highMicrosoft MSRC 2026-W14

Azure Network Watcher VM Agent Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-38188

highMicrosoft MSRC 2026-W14

Azure Network Watcher VM Agent Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-43470

highMicrosoft MSRC 2026-W14

Azure Network Watcher VM Extension Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-35261

highMicrosoft MSRC 2026-W14

Azure Stack Hub Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-38216

highMicrosoft MSRC 2026-W14

Azure Stack Hub Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-38220

criticalMicrosoft MSRC 2026-W14

Azure Web Apps Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-38194

highMicrosoft MSRC 2026-W14

bcache: fix variable length array abuse in btree_iter

2026-04-01 CVE-2024-39482

mediumMicrosoft MSRC 2026-W14