Vendor advisories

Security advisories from the vendors you use.

Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.

Set up product alerts Follow the RSS feed

11Vendor sources

16,785Advisories collected

6,419Published or updated in 30 days

6,988Marked critical or high

Coverage

Connected directly to official vendor sources

The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.

AWS Security Bulletins 169 advisories

CurrentChecked 16 minutes ago

Checked every 15 minutes Browse this vendor's advisories Official source

Apple Security Releases 29 advisories

CurrentChecked 51 minutes ago

Checked hourly Browse this vendor's advisories Official source

Cisco Security Advisories 104 advisories

Check delayedChecked 21 days ago

Checked every 15 minutes Browse this vendor's advisories Official source

Citrix Security Bulletins 24 advisories

CurrentChecked 51 minutes ago

Checked hourly Browse this vendor's advisories Official source

Delinea Security Advisories 14 advisories

CurrentChecked 51 minutes ago

Checked hourly Browse this vendor's advisories Official source

Fortinet PSIRT Advisories 55 advisories

CurrentChecked just now

Checked every 15 minutes Browse this vendor's advisories Official source

Ivanti Security Advisories 9 advisories

CurrentChecked just now

Checked every 15 minutes Browse this vendor's advisories Official source

Microsoft Security Response Center 15,888 advisories

CurrentChecked 5 hours ago

Checked every 6 hours Browse this vendor's advisories Official source

Palo Alto Networks Security Advisories 59 advisories

CurrentChecked just now

Checked every 15 minutes Browse this vendor's advisories Official source

SonicWall PSIRT Advisories 11 advisories

CurrentChecked 51 minutes ago

Checked hourly Browse this vendor's advisories Official source

Ubuntu Security Notices 423 advisories

CurrentChecked just now

Checked every 15 minutes Browse this vendor's advisories Official source

16,785 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results

Microsoft Security Response CenterCVE-2026-96215

Published Oct 13, 2026

HighCVSS 7.0

Windows Autopilot Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Affected productsWindows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems

Fixed versions10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711, 10.0.28000.3231

Vendor guidance

Install KB5127648. Install KB5127646.

CVE-2026-96215

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-96209

Published Oct 13, 2026

HighCVSS 7.0

Windows Network File System Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)

Fixed versions6.2.9200.26434, 6.3.9600.23470, 10.0.14393.9612, 10.0.17763.9376

Vendor guidance

Install KB5126835. Install KB5126836. Install KB5126868. Install KB5126651. Install KB5126657. Install KB5126655. Install KB5126653. Install KB5127648. Install KB5126646. Install KB5127646.

CVE-2026-96209

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-96206

Published Oct 13, 2026

HighCVSS 6.5

Windows Subsystem for Linux Information Disclosure Vulnerability

Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.

Affected productsWindows Subsystem for Linux (WSL2)

Fixed versions3.0.1

Vendor guidance

Release Notes

CVE-2026-96206

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-96204

Published Oct 13, 2026

HighCVSS 6.5

Azure Arc Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.

Affected productsArc Enabled Servers - Azure Connected Machine Agent

Fixed versions1.68

Vendor guidance

Release Notes

CVE-2026-96204

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-96188

Published Oct 13, 2026

HighCVSS 7.3

Microsoft PowerToys Elevation of Privilege Vulnerability

External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.

Affected productsMicrosoft PowerToys

Fixed versions0.101.2632.0

Vendor guidance

Release Notes

CVE-2026-96188

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-96186

Published Oct 13, 2026

HighCVSS 7.8

Microsoft Windows Media Foundation Elevation of Privilege Vulnerability

Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

Fixed versions10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711, 10.0.26100.33650

Vendor guidance

Install KB5127648. Install KB5126646. Install KB5126835. Install KB5126836. Install KB5126868. Install KB5126651. Install KB5126657. Install KB5126655. Install KB5126653. Install KB5127646.

CVE-2026-96186

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-96118

Published Oct 13, 2026

HighCVSS 7.8

Windows Graphics Kernel Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)

Fixed versions6.2.9200.26434, 6.3.9600.23470, 10.0.14393.9612, 10.0.17763.9376

Vendor guidance

Install KB5126835. Install KB5126836. Install KB5126868. Install KB5126651. Install KB5126657. Install KB5126655. Install KB5126653. Install KB5127648. Install KB5126646. Install KB5127646.

CVE-2026-96118

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-96113

Published Oct 13, 2026

HighCVSS 9.8

Windows Domain Name Service Remote Code Execution Vulnerability

Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.

Affected productsWindows Server 2012 R2, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019

Fixed versions6.3.9600.23470, 10.0.14393.9612, 10.0.17763.9376, 10.0.20348.5761

Vendor guidance

Install KB5126836. Install KB5126868. Install KB5126651. Install KB5126655. Install KB5126646. Install KB5126835.

CVE-2026-96113

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-96108

Published Oct 13, 2026

HighCVSS 7.8

Desktop Window Manager Elevation of Privilege Vulnerability

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)

Fixed versions10.0.17763.9376, 10.0.19044.7807, 10.0.19045.7807, 10.0.20348.5761

Vendor guidance

Install KB5126651. Install KB5126657. Install KB5126655. Install KB5126653. Install KB5127648. Install KB5126646. Install KB5127646.

CVE-2026-96108

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-96096

Published Oct 13, 2026

HighCVSS 9.8

Windows Media Player Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.

Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)

Fixed versions6.2.9200.26434, 6.3.9600.23470, 10.0.14393.9612, 10.0.17763.9376

Vendor guidance

Install KB5126835. Install KB5126836. Install KB5126868. Install KB5126651. Install KB5126657. Install KB5126655. Install KB5126653. Install KB5127648. Install KB5126646. Install KB5127646.

CVE-2026-96096

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-96071

Published Oct 13, 2026

HighCVSS 7.5

Windows Media Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.

Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)

Fixed versions6.2.9200.26434, 6.3.9600.23470, 10.0.14393.9612, 10.0.17763.9376

Vendor guidance

Install KB5126835. Install KB5126836. Install KB5126868. Install KB5126651. Install KB5126657. Install KB5126655. Install KB5126653. Install KB5127648. Install KB5126646. Install KB5127646.

CVE-2026-96071

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-95943

Published Oct 13, 2026

HighCVSS 7.0

Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability

Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

Affected productsWindows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems

Fixed versions10.0.22631.7652, 10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711

Vendor guidance

Install KB5126653. Install KB5127648. Install KB5126646. Install KB5127646.

CVE-2026-95943

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-95904

Published Oct 13, 2026

HighCVSS 5.5

Windows Event Logging Service Information Disclosure Vulnerability

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)

Fixed versions6.2.9200.26434, 6.3.9600.23470, 10.0.14393.9612, 10.0.17763.9376

Vendor guidance

Install KB5126835. Install KB5126836. Install KB5126868. Install KB5126651. Install KB5126657. Install KB5126655. Install KB5126653. Install KB5127648. Install KB5126646. Install KB5127646.

CVE-2026-95904

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-94520

Published Oct 13, 2026

HighCVSS 4.9

Microsoft SQL Server Denial of Service Vulnerability

Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.

Affected productsMicrosoft SQL Server 2017 for x64-based Systems (CU31), Microsoft SQL Server 2022 for x64-based Systems (GDR), Microsoft SQL Server 2019 for x64-based Systems (CU32), Microsoft SQL Server 2017 for x64-based Systems (GDR)

Fixed versions14.0.3560.2, 16.0.1210.3, 15.0.4500.2, 14.0.2140.2

Vendor guidance

Install KB5128496. Install KB5128493. Install KB5128494. Install KB5128497. Install KB5128495. Install KB5126934. Install KB5128492. Install KB5126967.

CVE-2026-94520

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-94512

Published Oct 13, 2026

HighCVSS 8.8

SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Affected productsMicrosoft SQL Server 2022 for x64-based Systems (CU27), Microsoft SQL Server 2025 for x64-based Systems (CU9), Microsoft SQL Server 2017 for x64-based Systems (GDR), Microsoft SQL Server 2019 for x64-based Systems (GDR)

Fixed versions16.0.4305.5, 17.0.5015.4, 14.0.2140.2, 15.0.2200.2

Vendor guidance

Install KB5126934. Install KB5126967. Install KB5128497. Install KB5128495. Install KB5128493. Install KB5128492. Install KB5128496. Install KB5128494.

CVE-2026-94512

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-94506

Published Oct 13, 2026

HighCVSS 6.5

Microsoft Office Access Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.

Affected productsMicrosoft Office LTSC 2021 for 64-bit editions, Microsoft Office LTSC 2021 for 32-bit editions, Microsoft Office LTSC 2024 for 64-bit editions, Microsoft Office LTSC 2024 for 32-bit editions

Fixed versions16.0.14334.20974, 16.0.17932.21056, https://aka.ms/OfficeSecurityReleases

Vendor guidance

Release Notes

CVE-2026-94506

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-88226

Published Oct 13, 2026

HighCVSS 4.6

Windows Storage Port Driver Information Disclosure Vulnerability

Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose information with a physical attack.

Affected productsWindows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)

Fixed versions6.2.9200.26434, 6.3.9600.23470, 10.0.14393.9612, 10.0.17763.9376

Vendor guidance

Install KB5126835. Install KB5126836. Install KB5126868. Install KB5126651. Install KB5126657. Install KB5126655. Install KB5126653. Install KB5127648. Install KB5126646. Install KB5127646.

CVE-2026-88226

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-88219

Published Oct 13, 2026

HighCVSS 8.8

RPC Runtime Library Remote Code Execution Vulnerability

Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network.

Affected productsWindows Server 2025 (Server Core installation), Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems, Windows Server 2012

Fixed versions10.0.26100.33650, 10.0.28000.3231, 6.2.9200.26434, 6.3.9600.23470

Vendor guidance

Install KB5126646. Install KB5127646. Install KB5126835. Install KB5126836. Install KB5126868. Install KB5126651. Install KB5126657. Install KB5126655. Install KB5126653. Install KB5127648.

CVE-2026-88219

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-88209

Published Oct 13, 2026

HighCVSS 4.6

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Affected productsMicrosoft SharePoint Server Subscription Edition

Fixed versions16.0.20326.20190

Vendor guidance

Install KB5002927.

CVE-2026-88209

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-88208

Published Oct 13, 2026

HighCVSS 4.6

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Affected productsMicrosoft SharePoint Server Subscription Edition

Fixed versions16.0.20326.20190

Vendor guidance

Install KB5002927.

CVE-2026-88208

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-88206

Published Oct 13, 2026

HighCVSS 7.5

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Affected productsMicrosoft SharePoint Server Subscription Edition

Fixed versions16.0.20326.20190

Vendor guidance

Install KB5002927.

CVE-2026-88206

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-88204

Published Oct 13, 2026

HighCVSS 7.3

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Affected productsMicrosoft SharePoint Server Subscription Edition

Fixed versions16.0.20326.20190

Vendor guidance

Install KB5002927.

CVE-2026-88204

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-88203

Published Oct 13, 2026

HighCVSS 6.5

Microsoft Office PowerPoint Information Disclosure Vulnerability

Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Fixed versions16.0.14334.20974, 16.0.17932.21056, https://aka.ms/OfficeSecurityReleases

Vendor guidance

Release Notes

CVE-2026-88203

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-88201

Published Oct 13, 2026

HighCVSS 6.5

Microsoft Office Excel Information Disclosure Vulnerability

Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Affected productsMicrosoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office LTSC 2021 for 64-bit editions, Microsoft Office LTSC 2021 for 32-bit editions

Fixed versionshttps://aka.ms/OfficeSecurityReleases, 16.0.14334.20974, 16.0.17932.21056

Vendor guidance

Release Notes

CVE-2026-88201

Read the vendor advisory Watch this product

Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources