Security advisories from the vendors you use.
Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.
Connected directly to official vendor sources
The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.
16,745 advisories
Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.
Windows Subsystem for Linux Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
Release Notes
Microsoft Exchange Server Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
Install KB5121576. Install KB5121573. Install KB5121574. Install KB5121575.
Microsoft PowerShell Remote Code Execution Vulnerability
Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.
See the Microsoft Security Update Guide for the update that applies to your product.
USN-8940-1: Perl XS::Parse::Keyword module vulnerability
It was discovered that the Perl XS::Parse::Keyword module did not correctly handle certain inputs. If a user or automated system were tricked into receiving specially crafted input, an attacker could cause a denial of service.
net: fix memory leak in skb_segment_list for GRO packets
Mariner
Release Notes
netfilter: nf_tables: avoid chain re-validation if possible
Mariner
Release Notes
net: dsa: properly keep track of conduit reference
Mariner
Release Notes
ksmbd: Fix refcount leak when invalid session is found on session lookup
Mariner
Release Notes
HID: core: Harden s32ton() against conversion to 0 bits
Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...
Release Notes
CVE-2026-18394 - Incorrect authorization in Strands Agents Tools http_request tool
Open the original vendor bulletin for the full description and affected-version details.
CVE-2026-16317 and CVE-2026-16318: Issues with s2n-tls: an open-source implementation of the TLS/SSL protocols
Open the original vendor bulletin for the full description and affected-version details.
CVE-2026-15415 - Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server
Open the original vendor bulletin for the full description and affected-version details.
CVE-2026-16584 - AWS API MCP Server Security Policy Bypass via Startup Failure
Open the original vendor bulletin for the full description and affected-version details.
CVE-2026-15737 - Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK
Open the original vendor bulletin for the full description and affected-version details.
CVE-2026-12283 - Issue with Athena Federated Query Synapse Connector
Open the original vendor bulletin for the full description and affected-version details.
CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
Open the original vendor bulletin for the full description and affected-version details.
CVE-2026-15746 - Credential disclosure in Strands Agents Tools elasticsearch_memory tool
Open the original vendor bulletin for the full description and affected-version details.
CVE-2026-16756 - Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
Open the original vendor bulletin for the full description and affected-version details.
CVE-2026-15895: OS command injection in jsii-diff in AWS jsii
Open the original vendor bulletin for the full description and affected-version details.
CVE-2026-18140 - Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
Open the original vendor bulletin for the full description and affected-version details.
Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react
Open the original vendor bulletin for the full description and affected-version details.
CVE-2026-15643 - AWS HealthLake MCP Server SSRF via Unvalidated Pagination URL
Open the original vendor bulletin for the full description and affected-version details.
Issue with containerd CRI Plugin - CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262
Open the original vendor bulletin for the full description and affected-version details.
CVE-2026-12957 and CVE-2026-12958 - Issues in Language Servers for AWS and Amazon Q Developer Plugins
Open the original vendor bulletin for the full description and affected-version details.
Both issues are remediated in Language Servers for AWS version 1.69.0.
Start with the vendor's bulletin.
We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.
Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.