CurrentChecked 3 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
Security advisories from the vendors you use.
Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.
11Vendor sources
16,884Advisories collected
6,374Published or updated in 30 days
6,999Marked critical or high
Coverage
Connected directly to official vendor sources
The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.
CurrentChecked 49 minutes ago
Checked hourly
Browse this vendor's advisories
Official source
Check delayedChecked 24 days ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked 49 minutes ago
Checked hourly
Browse this vendor's advisories
Official source
CurrentChecked 49 minutes ago
Checked hourly
Browse this vendor's advisories
Official source
CurrentChecked 14 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked 14 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked 3 hours ago
Checked every 6 hours
Browse this vendor's advisories
Official source
CurrentChecked 14 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked 49 minutes ago
Checked hourly
Browse this vendor's advisories
Official source
Check delayedChecked 24 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
16,884 advisories
Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.
Microsoft Security Response CenterCVE-2023-53348
MediumCVSS 5.5
btrfs: fix deadlock when aborting transaction during relocation with scrub
Mariner
Affected productscbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0, cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2023-53347
MediumCVSS 5.5
net/mlx5: Handle pairing of E-switch via uplink un/load APIs
Mariner
Affected productscbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2022-50357
MediumCVSS 5.5
usb: dwc3: core: fix some leaks in probe
Mariner
Affected productscbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2025-11215
MediumCVSS 4.3
Chromium: CVE-2025-11215 Off by one error in V8
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
Affected productsMicrosoft Edge (Chromium-based), cbl2 nodejs18 18.20.3-12 on CBL-Mariner 2.0
Fixed versions141.0.3537.57
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2025-11219
LowCVSS 3.7
Chromium: CVE-2025-11219 Use after free in V8
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
Affected productsMicrosoft Edge (Chromium-based), cbl2 nodejs18 18.20.3-12 on CBL-Mariner 2.0
Fixed versions141.0.3537.57
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2025-30258
LowCVSS 2.7
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...
Affected productscbl2 gnupg2 2.4.0-3 on CBL-Mariner 2.0, cbl2 gnupg2 2.4.0-2 on CBL Mariner 2.0, azl3 gnupg2 2.4.7-1 on Azure Linux 3.0, azl3 gnupg2 2.4.9-1 on Azure Linux 3.0
Fixed versions2.4.8-1
Vendor guidance
Release Notes CBL-Mariner Releases
Microsoft Security Response CenterCVE-2026-103006
MediumCVSS 6.5
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Mariner
Affected productsazl3 rubygem-elasticsearch 8.9.0-1 on Azure Linux 3.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-102411
MediumCVSS 6.5
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
Mariner
Affected productsazl3 rubygem-elasticsearch 8.9.0-1 on Azure Linux 3.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-102404
MediumCVSS 6.5
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Mariner
Affected productsazl3 rubygem-elasticsearch 8.9.0-1 on Azure Linux 3.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-102407
MediumCVSS 5.4
Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
Mariner
Affected productsazl3 rubygem-elasticsearch 8.9.0-1 on Azure Linux 3.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-106555
LowCVSS 2.2
In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
Mariner
Affected productsazl3 openssh 9.8p1-10 on Azure Linux 3.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-106584
LowCVSS 2.5
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.
Mariner
Affected productsazl3 openssh 9.8p1-10 on Azure Linux 3.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-106589
LowCVSS 2.9
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.
Mariner
Affected productsazl3 openssh 9.8p1-10 on Azure Linux 3.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-106586
LowCVSS 2.5
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
Mariner
Affected productsazl3 openssh 9.8p1-10 on Azure Linux 3.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-106583
LowCVSS 2.5
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
Mariner
Affected productsazl3 openssh 9.8p1-10 on Azure Linux 3.0
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-106587
LowCVSS 3.6
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
Mariner
Affected productsazl3 openssh 9.8p1-10 on Azure Linux 3.0
Vendor guidance
Release Notes
AWS Security BulletinsCVE-2026-107352
Severity not listed
CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling
Bulletin ID: 2026-128-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/07/2026 13:00 PM PDT Description: Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited que...
Vendor guidance
AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed.
Ubuntu Security NoticesUSN-8896-1
Severity not listed
USN-8896-1: GStreamer Ugly Plugins vulnerabilities
Michael Randrianantenaina discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubu...
Ubuntu Security NoticesUSN-8900-1
Severity not listed
USN-8900-1: Go Networking vulnerabilities
It was discovered that Go Networking did not properly handle server errors after sending a GOAWAY frame during HTTP/2 connection shutdown, which could cause the connection to hang. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-27664) I...
Ubuntu Security NoticesUSN-8898-1
Severity not listed
USN-8898-1: Apache HTTP Server vulnerabilities
It was discovered that Apache HTTP Server's mod_rewrite module incorrectly handled memory when performing certain variable lookups. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-56154) Lucian Nitescu, Simon Ka...
Ubuntu Security NoticesUSN-8897-1
Severity not listed
USN-8897-1: lxml vulnerabilities
Guillem Lefait discovered that lxml incorrectly handled certain URL attributes. A remote attacker could possibly use this issue to bypass URL sanitization, leading to a cross-site scripting attack. (CVE-2026-49825) Qiu Sihao discovered that lxml incorrectly handled untrusted X...
Cisco Security Advisoriescisco-sa-notice-fBn58ELx
Informational
Cisco Advance Notification for Publication of October 7, 2026, Security Advisories
On October 7, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables.
Affected productsCisco NX-OS Software, Cisco Application Policy Infrastructure Controller, Cisco Smart License (Smart Software Manager) On-Prem, Meraki, and Finesse
Vendor guidance
To remediate the vulnerabilities that were disclosed on October 7, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories.
Cisco Security Advisoriescisco-sa-hardening-nxosw1-cWzSbtR
CriticalPriority signal
Cisco NX-OS Software Security Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vu...
Affected productsMDS 9000 Series Multilayer Switches, Nexus 3000 Series Switches, Nexus 7000 Series Switches, Nexus 9000 Series Fabric Switches in ACI mode
Vendor guidance
To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerab...
Cisco Security Advisoriescisco-sa-hardening-apic-UOXWtfh
CriticalPriority signal
Cisco Application Policy Infrastructure Controller Security Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that addr...
Vendor guidance
To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerab...
Before you act
Start with the vendor's bulletin.
We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.
Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.