Security Warnings — Vendor: microsoft

nexthop: Forbid FDB status change while nexthop is in a group

2025-10-14 CVE-2025-39980

highMicrosoft MSRC 2025-W42

ocfs2: fix double free in user_cluster_connect()

2025-10-14 CVE-2025-40055

highMicrosoft MSRC 2025-W42

octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()

2025-10-14 CVE-2025-39978

criticalMicrosoft MSRC 2025-W42

octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()

2025-10-14 CVE-2025-39944

highMicrosoft MSRC 2025-W42

Panic when validating certificates with DSA public keys in crypto/x509

2025-10-14 CVE-2025-58188

highMicrosoft MSRC 2025-W42

Parsing DER payload can cause memory exhaustion in encoding/asn1

2025-10-14 CVE-2025-58185

highMicrosoft MSRC 2025-W42

PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release

2025-10-14 CVE-2025-40032

mediumMicrosoft MSRC 2025-W42

pcmcia: Add error handling for add_interval() in do_validate_mem()

2025-10-14 CVE-2025-39920

mediumMicrosoft MSRC 2025-W42

perf: arm_spe: Prevent overflow in PERF_IDX2OFF()

2025-10-14 CVE-2025-40081

highMicrosoft MSRC 2025-W42

pinctrl: check the return value of pinmux_ops::get_function_name()

2025-10-14 CVE-2025-40030

mediumMicrosoft MSRC 2025-W42

qed: Don't collect too many protection override GRC elements

2025-10-14 CVE-2025-39949

mediumMicrosoft MSRC 2025-W42

Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode

2025-10-14 CVE-2025-12464

mediumMicrosoft MSRC 2025-W42

Qemu-kvm: vnc websocket handshake use-after-free

2025-10-14 CVE-2025-11234

highMicrosoft MSRC 2025-W42

quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame

2025-10-14 CVE-2025-59530

highMicrosoft MSRC 2025-W42

RDMA/rxe: Fix race in do_task() when draining

2025-10-14 CVE-2025-40061

mediumMicrosoft MSRC 2025-W42

Redis is vulnerable to DoS via specially crafted LUA scripts

2025-10-14 CVE-2025-46819

mediumMicrosoft MSRC 2025-W42

Redis Lua Use-After-Free may lead to remote code execution

2025-10-14 CVE-2025-49844

criticalMicrosoft MSRC 2025-W42

Redis: Authenticated users can execute LUA scripts as a different user

2025-10-14 CVE-2025-46818

mediumMicrosoft MSRC 2025-W42

remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()

2025-10-14 CVE-2025-40033

mediumMicrosoft MSRC 2025-W42

Resource exhaustion via malformed DNSKEY handling

2025-10-14 CVE-2025-8677

highMicrosoft MSRC 2025-W42

sched: Fix sched_numa_find_nth_cpu() if mask offline

2025-10-14 CVE-2025-39895

mediumMicrosoft MSRC 2025-W42

scsi: mvsas: Fix use-after-free bugs in mvs_work_queue

2025-10-14 CVE-2025-40001

highMicrosoft MSRC 2025-W42

scsi: target: target_core_configfs: Add length check to avoid buffer overflow

2025-10-14 CVE-2025-39998

highMicrosoft MSRC 2025-W42

smb: client: fix crypto buffers in non-linear memory

2025-10-14 CVE-2025-40052

highMicrosoft MSRC 2025-W42

smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path

2025-10-14 CVE-2025-39929

mediumMicrosoft MSRC 2025-W42

smb: client: let recv_done verify data_offset, data_length and remaining_data_length

2025-10-14 CVE-2025-39933

mediumMicrosoft MSRC 2025-W42

smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)

2025-10-14 CVE-2025-39932

mediumMicrosoft MSRC 2025-W42

smc: Fix use-after-free in __pnet_find_base_ndev().

2025-10-14 CVE-2025-40064

mediumMicrosoft MSRC 2025-W42

spi: cadence-quadspi: Implement refcount to handle unbind during busy

2025-10-14 CVE-2025-40005

mediumMicrosoft MSRC 2025-W42

Squid vulnerable to information disclosure via authentication credential leakage in error handling

2025-10-14 CVE-2025-62168

criticalMicrosoft MSRC 2025-W42

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand

2025-10-14 CVE-2025-61984

lowMicrosoft MSRC 2025-W42

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

2025-10-14 CVE-2025-61985

lowMicrosoft MSRC 2025-W42

tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.

2025-10-14 CVE-2025-39913

mediumMicrosoft MSRC 2025-W42

tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().

2025-10-14 CVE-2025-39955

highMicrosoft MSRC 2025-W42

tls: make sure to abort the stream if headers are bogus

2025-10-14 CVE-2025-39946

mediumMicrosoft MSRC 2025-W42

tracing: dynevent: Add a missing lockdown check on dynevent

2025-10-14 CVE-2025-40021

mediumMicrosoft MSRC 2025-W42

tracing: Fix race condition in kprobe initialization causing NULL pointer dereference

2025-10-14 CVE-2025-40042

mediumMicrosoft MSRC 2025-W42

tracing: Silence warning when chunk allocation fails in trace_pid_write

2025-10-14 CVE-2025-39914

mediumMicrosoft MSRC 2025-W42

uio_hv_generic: Let userspace take care of interrupt mask

2025-10-14 CVE-2025-40048

highMicrosoft MSRC 2025-W42

um: virtio_uml: Fix use-after-free after put_device in probe

2025-10-14 CVE-2025-39951

mediumMicrosoft MSRC 2025-W42

Use-after-free vulnerability in Qt SVG qsvghandler.cpp allows denial of service via crafted SVG

2025-10-14 CVE-2025-10729

criticalMicrosoft MSRC 2025-W42

vhost: Take a reference on the task in struct vhost_task.

2025-10-14 CVE-2025-40024

mediumMicrosoft MSRC 2025-W42

vhost: vringh: Fix copy_to_iter return value check

2025-10-14 CVE-2025-40056

mediumMicrosoft MSRC 2025-W42

vhost: vringh: Modify the return value check

2025-10-14 CVE-2025-40051

highMicrosoft MSRC 2025-W42

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitabl

2025-10-14 CVE-2025-53044

mediumMicrosoft MSRC 2025-W42

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitabl

2025-10-14 CVE-2025-53045

mediumMicrosoft MSRC 2025-W42

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitabl

2025-10-14 CVE-2025-53054

mediumMicrosoft MSRC 2025-W42

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitabl

2025-10-14 CVE-2025-53062

mediumMicrosoft MSRC 2025-W42

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4

2025-10-14 CVE-2025-53069

mediumMicrosoft MSRC 2025-W42

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily explo

2025-10-14 CVE-2025-53053

mediumMicrosoft MSRC 2025-W42

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily

2025-10-14 CVE-2025-53040

mediumMicrosoft MSRC 2025-W42

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily

2025-10-14 CVE-2025-53042

mediumMicrosoft MSRC 2025-W42

wifi: mac80211: increase scan_ies_len for S1G

2025-10-14 CVE-2025-39957

mediumMicrosoft MSRC 2025-W42

wifi: mwifiex: Initialize the chan_stats array to zero

2025-10-14 CVE-2025-39891

mediumMicrosoft MSRC 2025-W42

wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()

2025-10-14 CVE-2025-40000

criticalMicrosoft MSRC 2025-W42

wifi: wilc1000: avoid buffer overflow in WID string configuration

2025-10-14 CVE-2025-39952

highMicrosoft MSRC 2025-W42

x86: fix clear_user_rep_good() exception handling annotation

2025-10-14 CVE-2023-53642

mediumMicrosoft MSRC 2025-W42

xfrm: xfrm_alloc_spi shouldn't use 0 as SPI

2025-10-14 CVE-2025-39965

mediumMicrosoft MSRC 2025-W42

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension funct

2025-10-14 CVE-2024-31573

mediumMicrosoft MSRC 2025-W42

Xorg: xmayland: use-after-free in xpresentnotify structure creation

2025-10-14 CVE-2025-62229

highMicrosoft MSRC 2025-W42