Security advisories from the vendors you use.
Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.
Connected directly to official vendor sources
The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.
16,884 advisories
Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.
Windows HTTP.sys Elevation of Privilege Vulnerability
Integer underflow (wrap or wraparound) in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
Install KB5120238. Install KB5120242. Install KB5120229. Install KB5120249. Install KB5120233. Install KB5120228. Install KB5121003. Install KB5120994. Install KB5120240. Install KB5121000. Install KB5120418. Install ...
Microsoft Word Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Click to Run Release Notes Install KB5002901.
Microsoft Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Click to Run Release Notes Install KB5002884. Install KB5002903.
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
Install KB5120249. Install KB5121003. Install KB5120994. Install KB5121000.
Use-after-free of a server-side SSLContext when sni_callback switches contexts
Mariner
Release Notes
PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
Mariner
Release Notes
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
Mariner
Release Notes
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
Mariner
Release Notes
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
Mariner
Release Notes
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
Mariner
Release Notes
PyJWT accepts public JWK containers as HMAC secrets
Mariner
Release Notes
PyJWT BOM Bypass
Mariner
Release Notes
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
Mariner
Release Notes
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
Mariner
Release Notes
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName
Mariner
Release Notes
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv
Mariner
Release Notes
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
Mariner
Release Notes
Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
Mariner
Release Notes
iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
Mariner
Release Notes
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
Mariner
Release Notes
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
Mariner
Release Notes
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
Mariner
Release Notes
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
Mariner
Release Notes
PyJWT: PyJWKClient follows redirects when fetching JWKS
Mariner
Release Notes
Start with the vendor's bulletin.
We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.
Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.