CVE-2025-40005 spi: cadence-quadspi: Implement refcount to handle unbind during busy
Published February 28, 2026
Information published.
Microsoft Security Response Center Blog Alerts
CVE-2025-38162 netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
Published February 28, 2026
Information published.
CVE-2026-28364 In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
Published February 28, 2026
Information published.
CVE-2025-40082 hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
Published February 28, 2026
Information published.
CVE-2025-69873 ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.
Published February 27, 2026
Information published.
CVE-2026-27969 Vitess users with backup storage access can write to arbitrary file paths on restore
Published February 27, 2026
Information published.
CVE-2026-27965 Vitess users with backup storage access can gain unauthorized access to production deployment environments
Published February 27, 2026
Information published.
Chromium: CVE-2026-3063 Inappropriate implementation in DevTools
Published February 27, 2026
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.
Chromium: CVE-2026-3062 Out of bounds read and write in Tint
Published February 27, 2026
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.
Chromium: CVE-2026-3061 Out of bounds read in Media
Published February 27, 2026
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.
