CVE-2025-71237 nilfs2: Fix potential block overflow that cause system hang
Published February 28, 2026
Information published.
Microsoft Security Response Center Blog Alerts
CVE-2026-23220 ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths
Published February 28, 2026
Information published.
CVE-2025-69873 ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.
Published February 27, 2026
Information published.
CVE-2026-27969 Vitess users with backup storage access can write to arbitrary file paths on restore
Published February 27, 2026
Information published.
CVE-2026-27965 Vitess users with backup storage access can gain unauthorized access to production deployment environments
Published February 27, 2026
Information published.
Chromium: CVE-2026-3063 Inappropriate implementation in DevTools
Published February 27, 2026
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.
Chromium: CVE-2026-3062 Out of bounds read and write in Tint
Published February 27, 2026
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.
Chromium: CVE-2026-3061 Out of bounds read in Media
Published February 27, 2026
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.
CVE-2026-27571 nats-server websockets are vulnerable to pre-auth memory DoS
Published February 27, 2026
Information published.
CVE-2021-20225 A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Published February 26, 2026
Information published.
