CurrentChecked 10 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
Security advisories from the vendors you use.
Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.
11Vendor sources
16,914Advisories collected
6,332Published or updated in 30 days
7,001Marked critical or high
Coverage
Connected directly to official vendor sources
The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.
CurrentChecked about an hour ago
Checked hourly
Browse this vendor's advisories
Official source
Check delayedChecked 26 days ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked just now
Checked hourly
Browse this vendor's advisories
Official source
CurrentChecked about an hour ago
Checked hourly
Browse this vendor's advisories
Official source
CurrentChecked 16 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked 6 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked 5 hours ago
Checked every 6 hours
Browse this vendor's advisories
Official source
CurrentChecked 6 minutes ago
Checked every 15 minutes
Browse this vendor's advisories
Official source
CurrentChecked about an hour ago
Checked hourly
Browse this vendor's advisories
Official source
CurrentChecked just now
Checked every 15 minutes
Browse this vendor's advisories
Official source
16,914 advisories
Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.
Microsoft Security Response CenterCVE-2026-58612
HighCVSS 7.4
PowerShell Information Disclosure Vulnerability
Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.
Affected productsPowerShell 7.5, PowerShell 7.4, PowerShell 7.6
Fixed versions7.5.10.0, 7.4.19.0, 7.6.5
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2025-48965
MediumCVSS 4.0
Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.
Mariner
Affected productsazl3 qemu 10.1.0-1 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2025-52497
MediumCVSS 4.8
Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.
Mariner
Affected productsazl3 qemu 10.1.0-1 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2025-66442
MediumCVSS 5.1
In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.
Mariner
Affected productsazl3 qemu 10.1.0-1 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2026-25834
MediumCVSS 6.5
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
Mariner
Affected productsazl3 qemu 10.1.0-1 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2026-25835
HighCVSS 7.7
Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).
Mariner
Affected productsazl3 qemu 10.1.0-1 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2026-34876
HighCVSS 7.5
An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain adjacent CCM context data via invocation of the multipart CCM API with an oversized tag_len parameter. This is caused by missing validation of the tag_len parameter against the size of the internal 16-byte authentication buffer. The issue affects the public multipart CCM API in Mbed TLS 3.x, where mbedtls_ccm_finish() can be invoked directly by applications. In Mbed TLS 4.x versions prior to the fix, the same missing validation exists in the internal implementation; however, the function is not exposed as part of the public API. Exploitation requires application-level invocation of the multipart CCM API.
Mariner
Affected productsazl3 qemu 10.1.0-1 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2025-49600
MediumCVSS 4.9
In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an attacker (who can induce a hardware hash accelerator fault) to bypass LMS signature verification by reusing stale stack data, resulting in acceptance of an invalid signature. In mbedtls_lms_verify, the return values of the internal Merkle tree functions create_merkle_leaf_value and create_merkle_internal_value are not checked. These functions return an integer that indicates whether the call succeeded or not. If a failure occurs, the output buffer (Tc_candidate_root_node) may remain uninitialized, and the result of the signature verification is unpredictable. When the software implementation of SHA-256 is used, these functions will not fail. However, with hardware-accelerated hashing, an attacker could use fault
Mariner
Affected productsazl3 qemu 10.1.0-1 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2025-47917
HighCVSS 8.9
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).
Mariner
Affected productsazl3 qemu 10.1.0-1 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2026-72649
HighCVSS 8.8
Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
Mariner
Affected productsazl3 rubygem-elasticsearch 8.9.0-1 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2026-56143
MediumCVSS 4.9
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
Mariner
Affected productsazl3 rubygem-elasticsearch 8.9.0-1 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Microsoft Security Response CenterCVE-2026-78607
MediumCVSS 5.4
Missing Authorization in Elasticsearch Leading to Information Disclosure
Mariner
Affected productsazl3 rubygem-elasticsearch 8.9.0-1 on Azure Linux 3.0
Vendor guidance
See the Microsoft Security Update Guide for the update that applies to your product.
Ubuntu Security NoticesUSN-8661-4
Severity not listed
USN-8661-4: Linux kernel vulnerabilities
Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject p...
Vendor guidance
This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Network drivers; - NVME drivers; - Ext4 file system; - SMB network file system; - IPv4 networking; - Network traffic ...
Ubuntu Security NoticesUSN-8715-1
Severity not listed
USN-8715-1: Linux kernel (Oracle) vulnerabilities
Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject p...
Vendor guidance
This update corrects flaws in the following subsystems: - x86 architecture; - Cryptographic API; - InfiniBand drivers; - Media drivers; - NVIDIA Tegra memory controller driver; - Network drivers; - NVME drivers; - Fil...
Ubuntu Security NoticesUSN-8714-1
Severity not listed
USN-8714-1: Linux kernel vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - OCFS2 file system; - SCTP protocol; (CVE-2026-53043, CVE-2026-53224, CVE-2026-53225, CVE-2026-5...
Vendor guidance
This update corrects flaws in the following subsystems: - OCFS2 file system; - SCTP protocol; (CVE-2026-53043, CVE-2026-53224, CVE-2026-53225, CVE-2026-53246, CVE-2026-53309)
Cisco Security Advisoriescisco-sa-notice-f2SiMFxl
Informational
Cisco Advance Notification for Publication of September 2, 2026, Security Advisories
On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories:
Vendor guidance
On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco IOS XR Software Security ...
Cisco Security Advisoriescisco-sa-n9k-s1-rce-EH8dEtr
Critical
Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virt...
Vendor guidance
Cisco has released software updates that address this vulnerability.
Cisco Security Advisoriescisco-sa-phone-dos-txMYNRzv
High
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability
A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an...
Vendor guidance
Cisco has released software updates that address this vulnerability.
Ubuntu Security NoticesUSN-8713-1
Severity not listed
USN-8713-1: BioSig vulnerabilities
Mark Bereza and Lilith Wyatt discovered that BioSig incorrectly handled certain crafted input files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-22891, CVE-2026-20777)
Microsoft Security Response CenterCVE-2026-62880
HighCVSS 7.8
Windows NTFS Elevation of Privilege Vulnerability
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9121, 10.0.20348.5499, 10.0.20348.5440, 10.0.19044.7663
Vendor guidance
Install KB5120238. Install KB5120242. Install KB5120229. Install KB5120249. Install KB5120233. Install KB5120228. Install KB5121003. Install KB5120994. Install KB5120240. Install KB5121000. Install KB5120418. Install ...
Microsoft Security Response CenterCVE-2026-62768
HighCVSS 7.8
Windows Installer Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9121, 10.0.20348.5499, 10.0.20348.5440, 10.0.19044.7663
Vendor guidance
Install KB5120238. Install KB5120242. Install KB5120229. Install KB5120249. Install KB5120233. Install KB5120228. Install KB5121003. Install KB5120994. Install KB5120240. Install KB5121000. Install KB5120418. Install ...
Microsoft Security Response CenterCVE-2026-70336
HighCVSS 8.8
Visual Studio Code Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Affected productsVisual Studio Code
Fixed versions1.132.1
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-70335
HighCVSS 7.8
GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
Affected productsVisual Studio Code
Fixed versions1.132.1
Vendor guidance
Release Notes
Microsoft Security Response CenterCVE-2026-69306
HighCVSS 8.2
Visual Studio Code Security Feature Bypass Vulnerability
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Affected productsVisual Studio Code
Fixed versions1.132.1
Vendor guidance
Release Notes
Before you act
Start with the vendor's bulletin.
We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.
Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.