CurrentChecked 12 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
Security advisories from the vendors you use.
Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.
11Vendor sources
16,884Advisories collected
6,375Published or updated in 30 days
6,999Marked critical or high
Coverage
Connected directly to official vendor sources
The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.
CurrentChecked 42 minutes ago
Checked hourly
Browse this vendor's advisories
Official source
Check delayedChecked 24 days ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked 42 minutes ago
Checked hourly
Browse this vendor's advisories
Official source
CurrentChecked 42 minutes ago
Checked hourly
Browse this vendor's advisories
Official source
CurrentChecked 2 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked 2 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked about an hour ago
Checked every 6 hours
Browse this vendor's advisories
Official source
CurrentChecked 2 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked 42 minutes ago
Checked hourly
Browse this vendor's advisories
Official source
CurrentChecked 12 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
16,884 advisories
Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.
Fortinet PSIRT AdvisoriesFG-IR-26-185
CriticalCVSS 9.6
Improper access control and session management in the web management interface
CVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests. Revised on 2026-10-13 00:00:00
Affected productsFortiSandbox
Fortinet PSIRT AdvisoriesFG-IR-26-180
CriticalCVSS 9.4
Arbitrary file write in grpc phQueryMaster
CVSSv3 Score: 9.4 An Improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets. Revised on 2026-10-13 00:00:00
Affected productsFortiSIEM
Fortinet PSIRT AdvisoriesFG-IR-26-178
HighCVSS 7.9
Multiple Arbitrary File Read/Write via SQL Injection
CVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted...
Affected productsFortiAnalyzer, FortiManager, FortiManager Cloud, FortiAnalyzer Cloud
Fortinet PSIRT AdvisoriesFG-IR-26-184
HighCVSS 7.7
SQL command injection in webmail
CVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Revised on...
Affected productsFortiMail
Fortinet PSIRT AdvisoriesFG-IR-26-177
MediumCVSS 5.3
arbitrary command execution in fgfmsd daemon
CVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands vi...
Affected productsFortiManager
Fortinet PSIRT AdvisoriesFG-IR-26-176
MediumCVSS 4.8
Persistent Denial of Service in Admin Profile
CVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Revised on 2026-10-13 00:00:00
Affected productsFortiSandbox
Fortinet PSIRT AdvisoriesFG-IR-20-005
MediumCVSS 4.9
HTML injection in WebUI
CVSSv3 Score: 4.9 An improper neutralization of script-related HTML tags in a web page in FortiManager and FortiAnalyzer may allow an attacker to perform a cross site scripting (XSS) attack via the Identify Provider name field. Revised on 2026-10-13 00:00:00
Affected productsFortiManager, FortiAnalyzer
Fortinet PSIRT AdvisoriesFG-IR-26-181
MediumCVSS 6.7
GUI Denial of Service
CVSSv3 Score: 6.7 An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests. Revised on 2026-10-13 00:00:00
Affected productsFortiOS
Fortinet PSIRT AdvisoriesFG-IR-26-179
MediumCVSS 4.9
Fabric API Authentication bypass
CVSSv3 Score: 4.9 A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests Revised on 2026-10-13 00:00:00
Affected productsFortiSandbox, FortiSandbox Cloud
Fortinet PSIRT AdvisoriesFG-IR-26-182
LowCVSS 2.1
Double free in signal handler
CVSSv3 Score: 2.1 A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands. Revised on 2026-10-13 00:00:00
Affected productsFortiOS, FortiProxy, FortiSwitch
Fortinet PSIRT AdvisoriesFG-IR-26-183
LowCVSS 3.4
Broken authorization
CVSSv3 Score: 3.4 A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests Revised on 2026-10-13 00:00:00
Affected productsFortiSIEM
Ubuntu Security NoticesUSN-8915-1
Severity not listed
USN-8915-1: FFmpeg vulnerabilities
Momoko Shiraishi discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS...
Microsoft Security Response CenterCVE-2026-56857
CriticalCVSS 9.8
Root.Mkdir(All) can follow junctions out of the root on Windows in os
Mariner
Affected productsazl3 golang 1.26.7-1 on Azure Linux 3.0, azl3 golang 1.27.1-1 on Azure Linux 3.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-67693
HighCVSS 7.5
An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)
Mariner
Affected productsazl3 gnutls 3.8.13-1 on Azure Linux 3.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-88647
HighCVSS 7.4
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.
Mariner
Affected productsazl3 gnutls 3.8.13-1 on Azure Linux 3.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-95210
LowCVSS 3.7
Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.
Mariner
Affected productsazl3 gnutls 3.8.13-1 on Azure Linux 3.0
Vendor guidance
Release Notes
Ubuntu Security NoticesUSN-8914-1
Severity not listed
USN-8914-1: Google Guest Agent, Google OS Config Agent vulnerability
It was discovered that the Go x/net/idna package, vendored in Google Guest Agent and Google OS Config Agent, incorrectly accepted Punycode-encoded labels that decoded to ASCII-only labels when processing internationalized domain names. A remote attacker could possibly use this...
Ubuntu Security NoticesUSN-8913-1
Severity not listed
USN-8913-1: libx11 vulnerabilities
Adam Bedard discovered that libx11 incorrectly handled certain XKB keyboard map replies. If a user were tricked into connecting to a malicious X server, a remote attacker could possibly use this issue to cause libx11 to crash, resulting in a denial of service, or possibly exec...
Citrix Security BulletinsCTX697096
CriticalCVSS 9.5
Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778
Citrix NetScaler ADC and Citrix NetScaler Gateway are affected by the vulnerabilities identified below
Affected productsCitrix NetScaler ADC and Citrix NetScaler Gateway, The following supported versions of Citrix NetScaler ADC and Citrix NetScaler Gateway are affected by the vulnerabilities: Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37 Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23 Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279
Fixed versionsCitrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases, Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1, Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS, Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP
Vendor guidance
Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the releva...
Ubuntu Security NoticesUSN-8912-1
Severity not listed
USN-8912-1: Perl DBI module vulnerabilities
Harsh Raj Singhania discovered that the Perl DBI module did not correctly validate certain attributes. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-78030) Harsh Raj Singhania discovered that the Perl DBI module did not correctly handle certain...
Microsoft Security Response CenterCVE-2025-12429
HighCVSS 9.4
Chromium: CVE-2025-12429 Inappropriate implementation in V8
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
Affected productsMicrosoft Edge (Chromium-based), cbl2 nodejs18 18.20.3-12 on CBL-Mariner 2.0
Fixed versions142.0.3595.53
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2025-12428
CriticalCVSS 9.8
Chromium: CVE-2025-12428 Type Confusion in V8
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
Affected productsMicrosoft Edge (Chromium-based), cbl2 nodejs18 18.20.3-12 on CBL-Mariner 2.0
Fixed versions142.0.3595.53
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2025-12727
CriticalCVSS 9.8
Chromium: CVE-2025-12727 Inappropriate implementation in V8
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
Affected productsMicrosoft Edge (Chromium-based), cbl2 nodejs18 18.20.3-12 on CBL-Mariner 2.0
Fixed versions142.0.3595.65, 142.0.3595.66
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2025-60876
HighCVSS 9.4
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
Mariner
Affected productsazl3 busybox 1.36.1-19 on Azure Linux 3.0, azl3 busybox 1.36.1-21 on Azure Linux 3.0, cbl2 busybox 1.35.0-18 on CBL Mariner 2.0, azl3 busybox 1.36.1-22 on Azure Linux 3.0
Vendor guidance
Release Notes
Before you act
Start with the vendor's bulletin.
We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.
Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.