Chromium: CVE-2026-3061 Out of bounds read in Media

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3061

Chromium: CVE-2026-3062 Out of bounds read and write in Tint

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3062

Chromium: CVE-2026-3063 Inappropriate implementation in DevTools

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3063

CVE-2025-69873 ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-69873

CVE-2026-27969 Vitess users with backup storage access can write to arbitrary file paths on restore

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27969

CVE-2026-27965 Vitess users with backup storage access can gain unauthorized access to production deployment environments

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27965

CVE-2026-27571 nats-server websockets are vulnerable to pre-auth memory DoS

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27571

CVE-2026-21523 GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability

Download links fixed

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523

CVE-2026-21518 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Download links fixed

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21518

CVE-2025-38162 netfilter: nft_set_pipapo: prevent overflow in lookup table allocation

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-38162

CVE-2025-40039 ksmbd: Fix race condition in RPC handle list access

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40039

CVE-2025-40040 mm/ksm: fix flag-dropping behavior in ksm_madvise

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40040

CVE-2025-40005 spi: cadence-quadspi: Implement refcount to handle unbind during busy

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40005

CVE-2025-40082 hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40082

CVE-2026-23228 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23228

CVE-2026-23222 crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23222

CVE-2026-23216 scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23216

CVE-2026-28364 In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-28364

CVE-2025-71232 scsi: qla2xxx: Free sp in error path to fix system crash

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-71232

CVE-2026-23220 ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23220

CVE-2026-23212 bonding: annotate data-races around slave->last_rx

Information published.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23212