Search threats, CVEs… ⌘K
Vendor advisories

Security advisories from the vendors you use.

Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.

Set up product alerts Follow the RSS feed
11Vendor sources
16,884Advisories collected
6,318Published or updated in 30 days
6,999Marked critical or high
Coverage

Connected directly to official vendor sources

The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.

16,884 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-31609
HighCVSS 7.8

smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()

Mariner

Affected productsazl3 kernel 6.6.130.1-3 on Azure Linux 3.0, azl3 kernel 6.6.134.1-2 on Azure Linux 3.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0
Fixed versions6.6.134.1-2
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-31609
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-35535
HighCVSS 7.4

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

Mariner

Affected productscbl2 sudo 1.9.17-1 on CBL Mariner 2.0, azl3 sudo 1.9.17-1 on Azure Linux 3.0, cbl2 sudo 1.9.17-1 on CBL-Mariner 2.0
Fixed versions1.9.17-2
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-35535
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-35414
LowCVSS 4.2

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

Mariner

Affected productsazl3 openssh 9.8p1-5 on Azure Linux 3.0, cbl2 openssh 8.9p1-9 on CBL Mariner 2.0, azl3 openssh 9.8p1-6 on Azure Linux 3.0, cbl2 openssh 8.9p1-9
Fixed versions9.8p1-7
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-35414
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-34714
HighCVSS 9.2

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Mariner

Affected productscbl2 vim 9.2.0240-1 on CBL Mariner 2.0, cbl2 vim 9.2.0240-1 on CBL-Mariner 2.0, azl3 vim 9.2.0240-1 on Azure Linux 3.0
Fixed versions9.2.0315-1
Vendor guidance

Release Notes CBL-Mariner Releases

CVE-2026-34714
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-31599
MediumCVSS 5.5

media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections

Mariner

Affected productsazl3 kernel 6.6.134.1-2 on Azure Linux 3.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0, azl3 kernel 6.6.130.1-3 on Azure Linux 3.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0
Fixed versions6.6.137.1-1
Vendor guidance

CBL-Mariner Releases Release Notes

CVE-2026-31599
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-4450
HighCVSS 8.8

Chromium: CVE-2026-4450 Out of bounds write in V8

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based), cbl2 nodejs18 18.20.3-12 on CBL-Mariner 2.0
Fixed versions146.0.3856.72
Vendor guidance

Release Notes

CVE-2026-4450
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources