Security advisories from the vendors you use.
Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.
Connected directly to official vendor sources
The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.
18,859 advisories
Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.
Path traversal in CLI command allows deletion of root file system
CVSSv3 Score: 5.0 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiOS, FortiPAM, FortiProxy and FortiSwitch Manager may allow a privileged authenticated attacker with physical access to the device to delete the fi...
Missed certificate verification in AD Connector communication with FortiClient EMS
CVSSv3 Score: 6.7 An Improper Certificate Validation vulnerability [CWE-295] in FortiClient EMS may allow a remote unauthenticated attacker to impersonate an AD Connector via a valid API Key. Revised on 2026-07-14 00:00:00
Header injection in captive portal authentication form
CVSSv3 Score: 3.1 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy captive portal may allow an attacker able to intercept and modify a user's authentication request to inject arbitrary he...
Header injection in Web Filter warning page
CVSSv3 Score: 3.4 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user...
Cross-Site Scripting in Domain parameter
CVSSv3 Score: 5.3 An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability [CWE-80] in FortiSIEM may allow a privileged administrator to execute unauthorized commands via crafted requests. Revised on 2026-07-14 00:00:00
DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment
Mariner
CBL-Mariner Releases
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile
Mariner
CBL-Mariner Releases
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders
Mariner
CBL-Mariner Releases
ClamAV ALZ Archive Processing Denial of Service Vulnerability
Mariner
CBL-Mariner Releases
ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerability
Mariner
CBL-Mariner Releases
ClamAV InstallShield File Format Processing Resource Exhaustion Vulnerability
Mariner
CBL-Mariner Releases
ClamAV 7Zip File Format Processing Out-of-Bounds Memory Corruption Vulnerability
Mariner
CBL-Mariner Releases
ClamAV FSG File Format Processing Out-of-Bounds Memory Corruption Vulnerability
Mariner
CBL-Mariner Releases
ClamAV PE File Format Processing Out-of-Bounds Memory Corruption Vulnerability
Mariner
CBL-Mariner Releases
Vim: Arbitrary Code Execution via PHP Omni-Completion
Mariner
CBL-Mariner Releases
libXfont2 PCF Font Parsing Heap Buffer Overflow
Mariner
CBL-Mariner Releases
libXfont2 computeProps Property Buffer Heap Buffer Overflow
Mariner
CBL-Mariner Releases
libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow
Mariner
CBL-Mariner Releases
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)
Mariner
CBL-Mariner Releases
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
Mariner
CBL-Mariner Releases
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.
Mariner
CBL-Mariner Releases
sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
Mariner
CBL-Mariner Releases
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
Mariner
CBL-Mariner Releases
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.
Mariner
CBL-Mariner Releases
Start with the vendor's bulletin.
We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.
Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.