Vendor advisories

Security advisories from the vendors you use.

Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.

Set up product alerts Follow the RSS feed

11Vendor sources

18,859Advisories collected

6,669Published or updated in 30 days

8,675Marked critical or high

Coverage

Connected directly to official vendor sources

The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.

AWS Security Bulletins 182 advisories

CurrentChecked 7 minutes ago

Checked every 15 minutes Browse this vendor's advisories Official source

Apple Security Releases 40 advisories

CurrentChecked 5 minutes ago

Checked hourly Browse this vendor's advisories Official source

Cisco Security Advisories 107 advisories

Check delayedChecked 30 days ago

Checked every 15 minutes Browse this vendor's advisories Official source

Citrix Security Bulletins 30 advisories

CurrentChecked 7 minutes ago

Checked hourly Browse this vendor's advisories Official source

Delinea Security Advisories 14 advisories

CurrentChecked 5 minutes ago

Checked hourly Browse this vendor's advisories Official source

Fortinet PSIRT Advisories 112 advisories

CurrentChecked 12 minutes ago

Checked every 15 minutes Browse this vendor's advisories Official source

Ivanti Security Advisories 10 advisories

CurrentChecked 7 minutes ago

Checked every 15 minutes Browse this vendor's advisories Official source

Microsoft Security Response Center 17,776 advisories

CurrentChecked 4 hours ago

Checked every 6 hours Browse this vendor's advisories Official source

Palo Alto Networks Security Advisories 69 advisories

CurrentChecked 12 minutes ago

Checked every 15 minutes Browse this vendor's advisories Official source

SonicWall PSIRT Advisories 12 advisories

Check delayedChecked 3 days ago

Checked hourly Browse this vendor's advisories Official source

Ubuntu Security Notices 507 advisories

CurrentChecked 12 minutes ago

Checked every 15 minutes Browse this vendor's advisories Official source

18,859 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results

Microsoft Security Response CenterCVE-2026-49176

Published Jul 14, 2026

HighCVSS 7.8

Windows WalletService Elevation of Privilege Vulnerability

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)

Fixed versions10.0.17763.9020, 10.0.20348.5386, 10.0.19044.7548, 10.0.19045.7548

Vendor guidance

Install KB5099538. Install KB5099540. Install KB5099539. Install KB5099536. Install KB5101650. Install KB5101649. Install KB5099535.

CVE-2026-49176

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-49175

Published Jul 14, 2026

HighCVSS 7.8

Windows DNS Client Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2022, Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems

Fixed versions10.0.20348.5386, 10.0.19044.7548, 10.0.19045.7548, 10.0.26100.33158

Vendor guidance

Install KB5099540. Install KB5099539. Install KB5099536. Install KB5101650. Install KB5101649.

CVE-2026-49175

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-49173

Published Jul 14, 2026

HighCVSS 7.8

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Affected productsWindows 11 version 26H1 for x64-based Systems, Windows 11 Version 26H1 for ARM64-based Systems

Fixed versions10.0.28000.2525

Vendor guidance

Install KB5101649.

CVE-2026-49173

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-49172

Published Jul 14, 2026

HighCVSS 9.8

Windows FTP Service Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.

Affected productsWindows 11 Version 25H2 for x64-based Systems, Windows Server 2025, Windows 10 Version 21H2 for ARM64-based Systems, Windows Server 2022 (Server Core installation)

Fixed versions10.0.26200.8875, 10.0.26100.33158, 10.0.19044.7548, 10.0.20348.5386

Vendor guidance

Install KB5101650. Install KB5099536. Install KB5099539. Install KB5099540. Install KB5099538. Install KB5099414. Install KB5099535. Install KB5101649.

CVE-2026-49172

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-49171

Published Jul 14, 2026

HighCVSS 7.5

Windows Speech Runtime Elevation of Privilege Vulnerability

Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)

Fixed versions10.0.17763.9020, 10.0.20348.5386, 10.0.19044.7548, 10.0.19045.7548

Vendor guidance

Install KB5099538. Install KB5099540. Install KB5099539. Install KB5099536. Install KB5101650. Install KB5101649. Install KB5099535.

CVE-2026-49171

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-49170

Published Jul 14, 2026

HighCVSS 7.8

Windows StateRepository API Server file Elevation of Privilege Vulnerability

Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)

Fixed versions10.0.17763.9020, 10.0.20348.5386, 10.0.19044.7548, 10.0.19045.7548

Vendor guidance

Install KB5099538. Install KB5099540. Install KB5099539. Install KB5099536. Install KB5101650. Install KB5101649.

CVE-2026-49170

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-49169

Published Jul 14, 2026

HighCVSS 8.0

Windows DNS Server Remote Code Execution Vulnerability

Use after free in DNS Server allows an authorized attacker to execute code over a network.

Affected productsWindows Server 2025 (Server Core installation), Windows Server 2025

Fixed versions10.0.26100.33158

Vendor guidance

Install KB5099536.

CVE-2026-49169

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-49168

Published Jul 14, 2026

HighCVSS 6.8

Storage Spaces Direct Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges with a physical attack.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)

Fixed versions10.0.17763.9020, 10.0.20348.5386, 10.0.19044.7548, 10.0.19045.7548

Vendor guidance

Install KB5099538. Install KB5099540. Install KB5099539. Install KB5099536. Install KB5101650. Install KB5101649. Install KB5099535.

CVE-2026-49168

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-49167

Published Jul 14, 2026

HighCVSS 4.7

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)

Fixed versions10.0.17763.9020, 10.0.20348.5386, 10.0.19044.7548, 10.0.19045.7548

Vendor guidance

Install KB5099538. Install KB5099540. Install KB5099539. Install KB5099536. Install KB5101650. Install KB5101649.

CVE-2026-49167

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-49166

Published Jul 14, 2026

HighCVSS 7.8

Windows Print Configuration Elevation of Privilege Vulnerability

Use after free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems

Fixed versions10.0.26100.33158, 10.0.26200.8875, 10.0.26100.8875, 10.0.28000.2525

Vendor guidance

Install KB5099536. Install KB5101650. Install KB5101649.

CVE-2026-49166

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-49165

Published Jul 14, 2026

HighCVSS 7.1

Microsoft Windows App Store Information Disclosure Vulnerability

Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)

Fixed versions10.0.17763.9020, 10.0.20348.5386, 10.0.19044.7548, 10.0.19045.7548

Vendor guidance

Install KB5099538. Install KB5099540. Install KB5099539. Install KB5099536. Install KB5101650. Install KB5101649. Install KB5099535.

CVE-2026-49165

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-48581

Published Jul 14, 2026

HighCVSS 7.8

Surface Broker SDMA Elevation of Privilege Vulnerability

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

Affected productsSurface Windows Dev Kit, Microsoft Surface Hub, Microsoft Surface Laptop Go 2, Surface Laptop 4 with AMD Processor

CVE-2026-48581

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-48580

Published Jul 14, 2026

HighCVSS 5.5

Microsoft Excel Information Disclosure Vulnerability

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Affected productsOffice Online Server, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems

Fixed versions16.0.10417.20175, https://aka.ms/OfficeSecurityReleases, 16.111.26071215, 16.0.5561.1001

Vendor guidance

Click to Run Release Notes Install KB5002884. Install KB5002886.

CVE-2026-48580

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-48572

Published Jul 14, 2026

HighCVSS 7.0

Windows App Package Installer Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate privileges locally.

Fixed versions10.0.26100.33158, 10.0.26200.8875, 10.0.22631.7376, 10.0.26100.8875

Vendor guidance

Install KB5099536. Install KB5101650. Install KB5099414. Install KB5095051. Install KB5101649.

CVE-2026-48572

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-48571

Published Jul 14, 2026

HighCVSS 7.0

Windows App Package Installer Elevation of Privilege Vulnerability

Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally.

Fixed versions10.0.26100.33158, 10.0.26200.8875, 10.0.22631.7376, 10.0.26100.8875

Vendor guidance

Install KB5099536. Install KB5101650. Install KB5099414. Install KB5101649. Install KB5095051.

CVE-2026-48571

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-47642

Published Jul 14, 2026

HighCVSS 7.8

Microsoft Excel Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Office 365 for Mac, Office Online Server, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions

Fixed versions16.111.26071215, 16.0.10417.20175, https://aka.ms/OfficeSecurityReleases

Vendor guidance

Release Notes Click to Run Install KB5002884.

CVE-2026-47642

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-47305

Published Jul 14, 2026

HighCVSS 7.8

Visual Studio Remote Code Execution Vulnerability

Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Visual Studio 2026 version 18.7, Microsoft Visual Studio 2022 version 17.12, Microsoft Visual Studio 2022 version 17.14

Fixed versions18.7.4, 17.12.22, 17.14.36

Vendor guidance

Release Notes

CVE-2026-47305

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-47300

Published Jul 14, 2026

HighCVSS 8.8

ASP.NET Core Elevation of Privilege Vulnerability

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Affected products.NET 10.0 runtime installed on Linux, .NET 10.0 runtime installed on Mac OS, .NET 8.0 runtime installed on Windows, .NET 8.0 runtime installed on Mac OS

Fixed versions10.0.10, 8.0.29, 9.0.18, 17.12.22

Vendor guidance

Release Notes Install KB5104034. Install KB5104032. Install KB5104033.

CVE-2026-47300

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-47296

Published Jul 14, 2026

HighCVSS 7.5

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Affected productsMicrosoft SQL Server 2022 for x64-based Systems (CU 25), Microsoft SQL Server 2025 for x64-based Systems (CU6), Microsoft SQL Server 2017 for x64-based Systems (GDR), Microsoft SQL Server 2019 for x64-based Systems (GDR)

Fixed versions16.0.4262.2, 17.0.4060.2, 14.0.2120.1, 15.0.2180.2

Vendor guidance

Install KB5101347. Install KB5101346. Install KB5102338. Install KB5102336. Install KB5102340. Install KB5102339. Install KB5102337. Install KB5102334. Install KB5102333. Install KB5102335.

CVE-2026-47296

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-47295

Published Jul 14, 2026

HighCVSS 8.8

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Fixed versions16.0.4262.2, 17.0.4060.2, 14.0.2120.1, 15.0.2180.2

Vendor guidance

Install KB5101347. Install KB5101346. Install KB5102338. Install KB5102336. Install KB5102340. Install KB5102339. Install KB5102337. Install KB5102334. Install KB5102333. Install KB5102335.

CVE-2026-47295

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-47290

Published Jul 14, 2026

HighCVSS 7.8

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems

Fixed versionshttps://aka.ms/OfficeSecurityReleases, 16.0.5561.1000

Vendor guidance

Click to Run Install KB5002273.

CVE-2026-47290

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-47282

Published Jul 14, 2026

HighCVSS 6.5

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

Affected productsVisual Studio Code

Fixed versions1.128.1

Vendor guidance

Release Notes

CVE-2026-47282

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-45646

Published Jul 14, 2026

HighCVSS 7.5

OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected productsMicrosoft.AspNet.OData, Microsoft.AspNetCore.OData

Fixed versions7.8.0, 9.5.0[SX1]

Vendor guidance

Release Notes

CVE-2026-45646

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-45496

Published Jul 14, 2026

HighCVSS 5.5

Visual Studio Code Security Feature Bypass Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Affected productsVisual Studio Code

Fixed versions1.128.1

Vendor guidance

Release Notes

CVE-2026-45496

Read the vendor advisory Watch this product

Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources