Search threats, CVEs… ⌘K
Vendor advisories

Security advisories from the vendors you use.

Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.

Set up product alerts Follow the RSS feed
11Vendor sources
16,884Advisories collected
6,318Published or updated in 30 days
6,999Marked critical or high
Coverage

Connected directly to official vendor sources

The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.

16,884 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-41602
HighCVSS 7.5

Apache Thrift: Go TFramedTransport uint32 overflow

Mariner

Affected productsazl3 influxdb 2.7.5-15 on Azure Linux 3.0, azl3 kata-containers 3.19.1.kata3-1 on Azure Linux 3.0, cbl2 kata-containers-cc 3.2.0.azl2-8 on CBL Mariner 2.0, azl3 telegraf 1.31.0-19 on Azure Linux 3.0
Fixed versions2.7.5-16, 3.19.1.kata3-2, 1.31.0-20, 0.15.0-6
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-41602
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-34933
MediumCVSS 5.5

Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon

Mariner

Affected productscbl2 avahi 0.8-5 on CBL Mariner 2.0, azl3 avahi 0.8-7 on Azure Linux 3.0, cbl2 avahi 0.8-5 on CBL-Mariner 2.0, azl3 avahi 0.8-8 on Azure Linux 3.0
Fixed versions0.8-6, 0.8-8
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-34933
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-3184
LowCVSS 3.7

Util-linux: util-linux: access control bypass due to improper hostname canonicalization

Mariner

Affected productscbl2 util-linux 2.37.4-10 on CBL-Mariner 2.0, cbl2 util-linux 2.37.4-10 on CBL Mariner 2.0, azl3 util-linux 2.40.2-3 on Azure Linux 3.0, azl3 util-linux 2.40.2-4 on Azure Linux 3.0
Fixed versions2.37.4-11, 2.40.2-4
Vendor guidance

Release Notes CBL-Mariner Releases

CVE-2026-3184
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-27456
MediumCVSS 4.7

util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup

Mariner

Affected productsazl3 util-linux 2.40.2-3 on Azure Linux 3.0, cbl2 util-linux 2.37.4-10 on CBL Mariner 2.0, cbl2 util-linux 2.37.4-10 on CBL-Mariner 2.0, azl3 util-linux 2.40.2-4 on Azure Linux 3.0
Fixed versions2.40.2-4, 2.37.4-11
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-27456
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-35386
LowCVSS 3.6

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.

Mariner

Affected productsazl3 openssh 9.8p1-5 on Azure Linux 3.0, cbl2 openssh 8.9p1-9 on CBL Mariner 2.0, cbl2 openssh 8.9p1-9 on CBL-Mariner 2.0
Fixed versions9.8p1-6
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-35386
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-35385
MediumCVSS 7.5

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

Mariner

Affected productscbl2 openssh 8.9p1-9 on CBL Mariner 2.0, azl3 openssh 9.8p1-5 on Azure Linux 3.0, cbl2 openssh 8.9p1-9 on CBL-Mariner 2.0
Fixed versions9.8p1-6
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-35385
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-35387
LowCVSS 3.1

OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.

Mariner

Affected productsazl3 openssh 9.8p1-6 on Azure Linux 3.0, cbl2 openssh 8.9p1-9 on CBL-Mariner 2.0, azl3 openssh 9.8p1-5 on Azure Linux 3.0, cbl2 openssh 8.9p1-9 on CBL Mariner 2.0
Fixed versions9.8p1-8
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-35387
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources