Security Warnings — Vendor: microsoft

netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD

2026-04-02 CVE-2026-31428

mediumMicrosoft MSRC 2026-W14

netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP

2026-04-02 CVE-2026-31424

mediumMicrosoft MSRC 2026-W14

NULL Pointer Dereference When Processing a Delta CRL

2026-04-02 CVE-2026-28388

mediumMicrosoft MSRC 2026-W14

ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load

2026-04-02 CVE-2026-34446

mediumMicrosoft MSRC 2026-W14

ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.

2026-04-02 CVE-2026-34445

highMicrosoft MSRC 2026-W14

OpenPrinting CUPS: Heap overflow in `get_options()`

2026-04-02 CVE-2026-34979

mediumMicrosoft MSRC 2026-W14

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

2026-04-02 CVE-2026-29181

highMicrosoft MSRC 2026-W14

OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies

2026-04-02 CVE-2026-39882

mediumMicrosoft MSRC 2026-W14

osslsigncode has a Stack Buffer Overflow via Unbounded Digest Copy During Signature Verification

2026-04-02 CVE-2026-39853

highMicrosoft MSRC 2026-W14

osslsigncode has an Integer Underflow in PE Page Hash Calculation Can Cause Out-of-Bounds Read

2026-04-02 CVE-2026-39855

mediumMicrosoft MSRC 2026-W14

osslsigncode has an Out-of-Bounds Read via Unvalidated Section Bounds in PE Page Hash Calculation

2026-04-02 CVE-2026-39856

mediumMicrosoft MSRC 2026-W14

Path traversal issue with zip.vim in Vim

2026-04-02 CVE-2026-35177

mediumMicrosoft MSRC 2026-W14

Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo

2026-04-02 CVE-2026-28389

highMicrosoft MSRC 2026-W14

Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

2026-04-02 CVE-2026-28390

highMicrosoft MSRC 2026-W14

Potential Use-after-free in DANE Client Code

2026-04-02 CVE-2026-28387

lowMicrosoft MSRC 2026-W14

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

2026-04-02 CVE-2026-23472

mediumMicrosoft MSRC 2026-W14

Sleuth Kit APFS Keybag Parser Out-of-Bounds Read

2026-04-02 CVE-2026-40025

mediumMicrosoft MSRC 2026-W14

Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Read

2026-04-02 CVE-2026-40026

mediumMicrosoft MSRC 2026-W14

Sleuth Kit tsk_recover Path Traversal

2026-04-02 CVE-2026-40024

highMicrosoft MSRC 2026-W14

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

2026-04-02 CVE-2026-32282

mediumMicrosoft MSRC 2026-W14

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

2026-04-02 CVE-2026-32283

mediumMicrosoft MSRC 2026-W14

Unbounded allocation for old GNU sparse in archive/tar

2026-04-02 CVE-2026-32288

mediumMicrosoft MSRC 2026-W14

Unexpected work during chain building in crypto/x509

2026-04-02 CVE-2026-32280

highMicrosoft MSRC 2026-W14

util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup

2026-04-02 CVE-2026-27456

mediumMicrosoft MSRC 2026-W14

Util-linux: util-linux: access control bypass due to improper hostname canonicalization

2026-04-02 CVE-2026-3184

lowMicrosoft MSRC 2026-W14

Vim Ex command injection in Vims NetBeans integration

2026-04-02 CVE-2026-39881

mediumMicrosoft MSRC 2026-W14

Vim modeline bypass via various options affects Vim < 9.2.0276

2026-04-02 CVE-2026-34982

highMicrosoft MSRC 2026-W14

wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure

2026-04-02 CVE-2026-23444

highMicrosoft MSRC 2026-W14

xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

2026-04-02 CVE-2026-34601

highMicrosoft MSRC 2026-W14

.NET and Visual Studio Denial of Service Vulnerability

2026-04-01 CVE-2024-30105

highMicrosoft MSRC 2026-W14

.NET and Visual Studio Denial of Service Vulnerability

2026-04-01 CVE-2024-38095

highMicrosoft MSRC 2026-W14

.NET and Visual Studio Remote Code Execution Vulnerability

2026-04-01 CVE-2024-30045

mediumMicrosoft MSRC 2026-W14

.NET and Visual Studio Remote Code Execution Vulnerability

2026-04-01 CVE-2024-35264

highMicrosoft MSRC 2026-W14

.NET and Visual Studio Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21172

highMicrosoft MSRC 2026-W14

.NET Elevation of Privilege Vulnerability

2026-04-01 CVE-2025-21173

highMicrosoft MSRC 2026-W14

.NET Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21171

highMicrosoft MSRC 2026-W14

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-38081

highMicrosoft MSRC 2026-W14

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21176

highMicrosoft MSRC 2026-W14

A flood of DNS messages over TCP may make the server unstable

2026-04-01 CVE-2024-0760

highMicrosoft MSRC 2026-W14

A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of service via the "was

2026-04-01 CVE-2024-34250

mediumMicrosoft MSRC 2026-W14

A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.

2026-04-01 CVE-2024-6611

criticalMicrosoft MSRC 2026-W14

A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunder

2026-04-01 CVE-2024-6601

mediumMicrosoft MSRC 2026-W14

ACPI: CPPC: Use access_width over bit_width for system memory accesses

2026-04-01 CVE-2024-35995

mediumMicrosoft MSRC 2026-W14

Active Directory Domain Services Elevation of Privilege Vulnerability

2026-04-01 CVE-2025-21293

highMicrosoft MSRC 2026-W14

Active Directory Federation Server Spoofing Vulnerability

2026-04-01 CVE-2025-21193

mediumMicrosoft MSRC 2026-W14

ALSA: usb-audio: Stop parsing channels bits when all channels are found.

2026-04-01 CVE-2024-27436

mediumMicrosoft MSRC 2026-W14

amd/amdkfd: sync all devices to wait all processes being evicted

2026-04-01 CVE-2024-36949

mediumMicrosoft MSRC 2026-W14

An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vulnerability affects Firefox < 126.

2026-04-01 CVE-2024-4772

mediumMicrosoft MSRC 2026-W14

An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted Pdelay_Req message to the time synchronization function

2026-04-01 CVE-2024-42861

highMicrosoft MSRC 2026-W14

An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.

2026-04-01 CVE-2024-33394

mediumMicrosoft MSRC 2026-W14

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as Netw

2026-04-01 CVE-2024-34397

mediumMicrosoft MSRC 2026-W14

An issue was discovered in HTTP2 in Qt before 5.15.18 6.x before 6.2.13 6.3.x through 6.5.x before 6.5.7 and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisi

2026-04-01 CVE-2024-39936

mediumMicrosoft MSRC 2026-W14

An issue was discovered in RDoc 6.3.3 through 6.6.2 as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file object inje

2026-04-01 CVE-2024-27281

mediumMicrosoft MSRC 2026-W14

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler it is possible to extract arbitrary heap data relative to the st

2026-04-01 CVE-2024-27282

mediumMicrosoft MSRC 2026-W14

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

2026-04-01 CVE-2024-34402

highMicrosoft MSRC 2026-W14

An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.

2026-04-01 CVE-2024-34403

mediumMicrosoft MSRC 2026-W14

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHT

2026-04-01 CVE-2024-34459

highMicrosoft MSRC 2026-W14

An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and undefined behavior. Note: This issue onl

2026-04-01 CVE-2024-4775

mediumMicrosoft MSRC 2026-W14

Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

2026-04-01 CVE-2024-8775

mediumMicrosoft MSRC 2026-W14

Apache HTTP Server proxy encoding problem

2026-04-01 CVE-2024-38473

highMicrosoft MSRC 2026-W14