CurrentChecked 15 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
Security advisories from the vendors you use.
Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.
11Vendor sources
16,905Advisories collected
6,325Published or updated in 30 days
7,001Marked critical or high
Coverage
Connected directly to official vendor sources
The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.
CurrentChecked just now
Checked hourly
Browse this vendor's advisories
Official source
Check delayedChecked 26 days ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked 5 minutes ago
Checked hourly
Browse this vendor's advisories
Official source
CurrentChecked just now
Checked hourly
Browse this vendor's advisories
Official source
CurrentChecked 10 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked 15 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked about an hour ago
Checked every 6 hours
Browse this vendor's advisories
Official source
CurrentChecked 15 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked just now
Checked hourly
Browse this vendor's advisories
Official source
Check delayedChecked 35 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
16,905 advisories
Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.
Microsoft Security Response CenterCVE-2026-84323
Severity not listed
Chromium: CVE-2026-84323 Missing authorization in FileSystem
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
Affected productsMicrosoft Edge (Chromium-based)
Fixed versions152.0.4191.62
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-62761
Severity not listedCVSS 7.8
Windows DHCP Server Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
Vendor guidance
Install KB5120238. Install KB5120242. Install KB5120229. Install KB5120233. Install KB5120228. Install KB5120418. Install KB5120386. Install KB5120385.
Citrix Security BulletinsCTX697038
High
XenServer Security Update for Multiple Issues
Several issues have been identified that affect XenServer 8.4 and XenServer 9. Collectively, these issues may allow a malicious privileged user in a guest VM to compromise or crash the host.
Affected productsXenServer
Vendor guidance
We have pushed updates to both the Early Access and Normal update channels of each of XenServer 8.4 and XenServer 9. We recommend that customers update to the latest version from their chosen channel following the ins...
Microsoft Security Response CenterCVE-2026-18313
MediumCVSS 4.3
rpcapd memory leak in libpcap before 1.10.7
Mariner
Affected productsazl3 libpcap 1.10.6-1 on Azure Linux 3.0
Fixed versions1.10.7-1
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2026-86139
MediumCVSS 6.9
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
Mariner
Affected productsazl3 libxml2 2.11.5-10 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2026-86141
LowCVSS 2.9
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
Mariner
Affected productsazl3 libxml2 2.11.5-10 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2026-84303
Medium
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
Mariner
Affected productsazl3 grpc 1.62.3-1 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2026-82208
HighCVSS 7.4
wolfSSL CA-cache hit overrides callback
Mariner
Affected productsazl3 curl 8.11.1-11 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Fortinet PSIRT AdvisoriesFG-IR-26-166
CriticalCVSS 9.9
Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information
CVSSv3 Score: 9.9 An improper access control vulnerability [CWE-284] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests. Revised on 2026-09-08 00:00:00
Affected productsFortiSandbox, FortiSandbox Cloud
Fortinet PSIRT AdvisoriesFG-IR-26-170
CriticalCVSS 9.8
JWT used for authentication in web GUI signed with static key
CVSSv3 Score: 9.8 An Inclusion of Sensitive Information in Source Code vulnerability [CWE-540] in FortiMonitorOnSight web portal may allow a remote unauthenticated attacker to bypass authentication via forged or reused JWT Revised on 2026-09-08 00:00:00
Affected productsFortiMonitorOnSight
Fortinet PSIRT AdvisoriesFG-IR-26-168
CriticalCVSS 9.6
Improper Authentication of FortiPAM Server
CVSSv3 Score: 9.6 An improper authentication vulnerability [CWE-287] in the Fortinet Privileged Access Agent Chrome Extension may allow a remote unauthenticated attacker to proxy a user's browser traffic through attacker controlled servers if the user visits a malicious websit...
Affected productsFortiPAM
Fortinet PSIRT AdvisoriesFG-IR-26-174
HighCVSS 8.1
ZTNA Portal Improper Certificate Validation
CVSSv3 Score: 8.1 An improper certificate validation vulnerability [CWE-295] in FortiOS and FortiProxy Agentless ZTNA portal may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the ZTNA portal and the backe...
Affected productsFortiOS, FortiProxy
Fortinet PSIRT AdvisoriesFG-IR-26-171
MediumCVSS 4.9
Workflow session email approval process bypass
CVSSv3 Score: 4.9 An improper access control vulnerability [CWE-284] in FortiManager may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests. Revised on 2026-09-08 00:00:00
Affected productsFortiManager
Fortinet PSIRT AdvisoriesFG-IR-26-172
MediumCVSS 6.5
Uncontrolled Resource Consumption in SNMP
CVSSv3 Score: 6.5 A Use of Uninitialized Variable [CWE-457] vulnerability in Fortinet FortiAnalyzer SNMP daemon may allow a remote authenticated attacker with user permission to cause a denial of service via SNMP GETBULK requests. Revised on 2026-09-08 00:00:00
Affected productsFortiAnalyzer
Fortinet PSIRT AdvisoriesFG-IR-26-169
LowCVSS 3.1
Open Redirect on FortiSIEM
CVSSv3 Score: 3.1 An URL redirection to untrusted site ('open redirect') [CWE-601] vulnerability in FortiSIEM may allow an authenticated attacker to cause a redirection to any website via specially crafted HTTP requests Revised on 2026-09-08 00:00:00
Affected productsFortiSIEM
Fortinet PSIRT AdvisoriesFG-IR-26-173
LowCVSS 2.5
Null Pointer Dereference in Log Report
CVSSv3 Score: 2.5 A NULL Pointer Dereference vulnerability [CWE-476] in FortiOS, FortiProxy and FortiPAM may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests. Revised on 2026-09-08 00:00:00
Affected productsFortiOS, FortiProxy, FortiPAM
Fortinet PSIRT AdvisoriesFG-IR-26-167
MediumCVSS 6.7
Cron Job Injection in Remote Backup
CVSSv3 Score: 6.7 An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] in FortiSandbox may allow a privileged attacker to execute unauthorized code or commands via crafted HTTP requests. Revised on 2026-09-08 00:00:00
Affected productsFortiSandbox
Fortinet PSIRT AdvisoriesFG-IR-26-164
MediumCVSS 5.4
Broken Access control on Websocket streams
CVSSv3 Score: 5.4 An Improper Access control vulnerability [CWE-284] in FortiSOAR may allow an authenticated attacker with zero permissions to subscribe to websocket streams and topics and to inject broadcast messages to the stream via crafted websocket requests Revised on 202...
Affected productsFortiSOAR
Fortinet PSIRT AdvisoriesFG-IR-26-165
MediumCVSS 5.1
Arbitrary process termination from exposed minifilter communication port
CVSSv3 Score: 5.1 An Unverified Ownership Vulnerability [CWE-283] in FortiClient Windows fortimon3 driver may allow an authenticated attacker to terminate arbitrary processes via an exposed minifilter communication port. Revised on 2026-09-08 00:00:00
Affected productsFortiClient
Ubuntu Security NoticesUSN-8734-1
Severity not listed
USN-8734-1: PHP vulnerabilities
It was discovered that PHP incorrectly handled Apache map decoding in SOAP servers with a typemap configured. A remote attacker could use this issue to cause a NULL pointer dereference, resulting in a denial of service. (CVE-2026-7262) It was discovered that PHP incorrectly ha...
Ubuntu Security NoticesUSN-8733-1
Severity not listed
USN-8733-1: Gzip vulnerabilities
Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable. A local attacker could possibly use this issue to overwrite arbitrary files. (CVE-2026-41991) Elias Hasas, Michał Majchrow...
Ubuntu Security NoticesUSN-8732-1
Severity not listed
USN-8732-1: Minetest vulnerability
It was discovered that Minetest did not properly sanitize the Lua sandbox environment when using LuaJIT. A malicious mod could escape the sandbox to execute arbitrary code and gain full file system access on the server. An attacker could use this issue to compromise the server.
Ubuntu Security NoticesUSN-8731-1
Severity not listed
USN-8731-1: MiniUPnPd vulnerability
It was discovered that MiniUPnPd contained an integer underflow vulnerability in SOAPAction header parsing. A remote attacker could use this issue to cause a denial of service or information disclosure by sending a malformed SOAPAction header with a single quote.
Ubuntu Security NoticesUSN-8730-1
Severity not listed
USN-8730-1: Linux kernel vulnerability
A security issue was discovered in the Linux kernel. An attacker could possibly use this to compromise the system. This update corrects flaws in the following subsystems: - IPv6 networking; - Netfilter;
Vendor guidance
This update corrects flaws in the following subsystems: - IPv6 networking; - Netfilter;
Before you act
Start with the vendor's bulletin.
We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.
Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.