Search threats, CVEs… ⌘K
Vendor advisories

Security advisories from the vendors you use.

Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.

Set up product alerts Follow the RSS feed
11Vendor sources
18,986Advisories collected
6,810Published or updated in 30 days
8,727Marked critical or high
Coverage

Connected directly to official vendor sources

The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.

18,986 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Palo Alto Networks Security AdvisoriesCVE-2026-0246
HighCVSS 8.5

CVE-2026-0246: Prisma Access Agent: Local Privilege Escalation Vulnerability

A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execu...

Affected productsPrisma Access Agent
Fixed versionsPrisma Access Agent >= 26.2.1 on Linux, >= 26.2.1 on macOS, >= 26.2.1 on Windows, Prisma Access Agent All on Android, All on ChromeOS, All on iOS
Vendor guidance

Version Minor Version Suggested Solution Prisma Access Agent on Linux 25.0 through 26.2 Upgrade to 26.2.1 or later. Prisma Access Agent on macOS 24.0 through 26.2 Upgrade to 26.2.1 or later. Prisma Access Agent on Win...

CVE-2026-0246
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-42833
HighCVSS 9.1

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

Affected productsMicrosoft Dynamics 365 (on-premises) version 9.1
Fixed versions9.1.45.11
Vendor guidance

Install KB5078943.

CVE-2026-42833
Read the vendor advisory Watch this product
Ivanti Security AdvisoriesIVANTI-MAY-2026-SECURITY-UPDATE
Severity not listedPriority signal

May 2026 Security Update

Ivanti releases standard security patches on the second Tuesday of every month. In today’s rapidly evolving technology and threat landscape, we believe responsible transparency should be a cornerstone of any product security program. AI is compressing the time-to-exploit, and ...

Affected productsIvanti Endpoint Manager, Endpoint Manager (EPM), Ivanti Xtraction
Vendor guidance

Ivanti releases standard security patches on the second Tuesday of every month.

Read the vendor advisory Watch this product
Citrix Security BulletinsCTX696581
Medium

XenServer Security Update for CVE-2025-54518

AMD has disclosed an issue in AMD Zen 2-based CPUs that may allow code in a guest VM to compromise the host. Although this hardware vulnerability is not an issue in the XenServer product itself, for the convenience of customers we are providing an update that mitigates this CP...

Affected productsXenServer
Vendor guidance

We have pushed updates to both the Early Access and Normal update channels of XenServer 8.4. We recommend that customers update to the latest version from their chosen channel following the instructions at https://doc...

CVE-2025-54518
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-42831
CriticalCVSS 7.8

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Office LTSC for Mac 2021, Microsoft Office for Android, Microsoft Office LTSC for Mac 2024
Fixed versions16.109.26051019, 16.0.19822.20190
Vendor guidance

Release Notes

CVE-2026-42831
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-41103
CriticalCVSS 9.1

Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability

Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.

Affected productsMicrosoft JIRA SAML SSO plugin, Microsoft Confluence SAML SSO plugin
Fixed versions1.3.3, 7.4.0
Vendor guidance

Release Notes

CVE-2026-41103
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-41096
CriticalCVSS 9.8

Windows DNS Client Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

Affected productsWindows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 23H2 for ARM64-based Systems
Fixed versions10.0.26100.32860, 10.0.26100.32772, 10.0.26200.8457, 10.0.26200.8390
Vendor guidance

Install KB5087539. Install KB5087423. Install KB5089549. Install KB5089466. Install KB5087420. Install KB5093998. Install KB5087541. Install KB5089548.

CVE-2026-41096
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-41089
CriticalCVSS 9.8

Windows Netlogon Remote Code Execution Vulnerability

Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

Affected productsWindows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022 (Server Core installation)
Fixed versions10.0.17763.8755, 10.0.20348.5139, 10.0.20348.5074, 10.0.26100.32860
Vendor guidance

Install KB5087538. Install KB5087545. Install KB5087424. Install KB5087539. Install KB5087423. Install KB5087541. Install KB5087537. Install KB5087470. Install KB5087471.

CVE-2026-41089
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-40403
CriticalCVSS 8.8

Windows Graphics Component Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8755, 10.0.20348.5139, 10.0.20348.5074, 10.0.19044.7291
Vendor guidance

Install KB5087538. Install KB5087545. Install KB5087424. Install KB5087544. Install KB5094127. Install KB5087539. Install KB5087423. Install KB5089549. Install KB5089466. Install KB5087420. Install KB5093998. Install ...

CVE-2026-40403
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-40402
CriticalCVSS 9.3

Windows Hyper-V Elevation of Privilege Vulnerability

Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.

Affected productsWindows Server 2022, Windows Server 2022 (Server Core installation), Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems
Fixed versions10.0.20348.5139, 10.0.20348.5074, 10.0.22631.7079, 10.0.22631.7219
Vendor guidance

Install KB5087545. Install KB5087424. Install KB5087420. Install KB5093998.

CVE-2026-40402
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-40366
CriticalCVSS 8.4

Microsoft Word Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems
Fixed versionshttps://aka.ms/OfficeSecurityReleases, 16.109.26051019, 16.0.5552.1000
Vendor guidance

Click to Run Release Notes Install KB5002858.

CVE-2026-40366
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-40365
CriticalCVSS 8.8

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Affected productsMicrosoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition
Fixed versions16.0.5552.1002, 16.0.10417.20128, 16.0.19725.20280
Vendor guidance

Install KB5002868. Install KB5002870. Install KB5002863.

CVE-2026-40365
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-40364
CriticalCVSS 8.4

Microsoft Word Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems
Fixed versionshttps://aka.ms/OfficeSecurityReleases, 16.109.26051019, 16.0.5552.1000
Vendor guidance

Click to Run Release Notes Install KB5002858.

CVE-2026-40364
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-40363
CriticalCVSS 8.4

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems
Fixed versionshttps://aka.ms/OfficeSecurityReleases, 16.109.26051019, 16.0.5552.1000, 16.0.19822.20190
Vendor guidance

Click to Run Release Notes Install KB5002866.

CVE-2026-40363
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-40358
CriticalCVSS 8.4

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems
Fixed versionshttps://aka.ms/OfficeSecurityReleases, 16.109.26051019, 16.0.5552.1000
Vendor guidance

Click to Run Release Notes Install KB5002866.

CVE-2026-40358
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-35421
CriticalCVSS 7.8

Windows GDI Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8755, 10.0.20348.5139, 10.0.20348.5074, 10.0.19044.7291
Vendor guidance

Install KB5087538. Install KB5087545. Install KB5087424. Install KB5087544. Install KB5094127. Install KB5087539. Install KB5087423. Install KB5089549. Install KB5089466. Install KB5087420. Install KB5093998. Install ...

CVE-2026-35421
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-20823
HighCVSS 5.5

Windows File Explorer Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8276, 10.0.20348.4648, 10.0.19044.6809, 10.0.19045.6809
Vendor guidance

Install KB5073723. Install KB5073457. Install KB5073724. Install KB5073379. Install KB5074109. Install KB5073455. Install KB5073450. Install KB5073722.

CVE-2026-20823
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources