CVE-2026-23223 xfs: fix UAF in xchk_btree_check_block_owner

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23223

CVE-2025-62878 Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62878

CVE-2026-21863 Malformed Valkey Cluster bus message can lead to Remote DoS

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21863

CVE-2025-67733 Valkey Affected by RESP Protocol Injection via Lua error_reply

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-67733

CVE-2026-23224 erofs: fix UAF issue for file-backed mounts w/ directio option

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23224

CVE-2025-71230 hfs: ensure sb->s_fs_info is always cleaned up

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-71230

CVE-2026-23229 crypto: virtio - Add spinlock protection with virtqueue notification

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23229

Chromium: CVE-2026-3061 Out of bounds read in Media

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3061

Chromium: CVE-2026-3062 Out of bounds read and write in Tint

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3062

Chromium: CVE-2026-3063 Inappropriate implementation in DevTools

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3063

CVE-2025-69873 ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-69873

CVE-2026-27969 Vitess users with backup storage access can write to arbitrary file paths on restore

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27969

CVE-2026-27965 Vitess users with backup storage access can gain unauthorized access to production deployment environments

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27965

CVE-2026-27571 nats-server websockets are vulnerable to pre-auth memory DoS

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27571

CVE-2026-21523 GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability

Download links fixed

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523

CVE-2026-21518 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Download links fixed

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21518

CVE-2025-38162 netfilter: nft_set_pipapo: prevent overflow in lookup table allocation

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-38162

CVE-2025-40039 ksmbd: Fix race condition in RPC handle list access

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40039

CVE-2025-40040 mm/ksm: fix flag-dropping behavior in ksm_madvise

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40040

CVE-2025-40005 spi: cadence-quadspi: Implement refcount to handle unbind during busy

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40005

CVE-2025-40082 hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40082