Vendor advisories

Security advisories from the vendors you use.

Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.

Set up product alerts Follow the RSS feed

11Vendor sources

18,986Advisories collected

6,810Published or updated in 30 days

8,727Marked critical or high

Coverage

Connected directly to official vendor sources

The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.

AWS Security Bulletins 182 advisories

CurrentChecked 10 minutes ago

Checked every 15 minutes Browse this vendor's advisories Official source

Apple Security Releases 40 advisories

CurrentChecked 6 minutes ago

Checked hourly Browse this vendor's advisories Official source

Cisco Security Advisories 107 advisories

Check delayedChecked 31 days ago

Checked every 15 minutes Browse this vendor's advisories Official source

Citrix Security Bulletins 30 advisories

CurrentChecked 11 minutes ago

Checked hourly Browse this vendor's advisories Official source

Delinea Security Advisories 14 advisories

CurrentChecked 6 minutes ago

Checked hourly Browse this vendor's advisories Official source

Fortinet PSIRT Advisories 112 advisories

CurrentChecked 10 minutes ago

Checked every 15 minutes Browse this vendor's advisories Official source

Ivanti Security Advisories 10 advisories

CurrentChecked 10 minutes ago

Checked every 15 minutes Browse this vendor's advisories Official source

Microsoft Security Response Center 17,903 advisories

CurrentChecked 3 hours ago

Checked every 6 hours Browse this vendor's advisories Official source

Palo Alto Networks Security Advisories 69 advisories

CurrentChecked 10 minutes ago

Checked every 15 minutes Browse this vendor's advisories Official source

SonicWall PSIRT Advisories 12 advisories

Check delayedChecked 4 days ago

Checked hourly Browse this vendor's advisories Official source

Ubuntu Security Notices 507 advisories

CurrentChecked 10 minutes ago

Checked every 15 minutes Browse this vendor's advisories Official source

18,986 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results

Microsoft Security Response CenterCVE-2026-42899

Published May 12, 2026

HighCVSS 7.5

ASP.NET Core Denial of Service Vulnerability

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected products.NET 8.0 installed on Windows, .NET 9.0 installed on Linux, .NET 8.0 installed on Mac OS, .NET 8.0 installed on Linux

Fixed versions8.0.27, 9.0.16, 10.0.8

Vendor guidance

Install KB5093447. Install KB5093448. Install KB5093446.

CVE-2026-42899

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-42896

Published May 12, 2026

HighCVSS 7.8

Windows DWM Core Library Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems

Fixed versions10.0.26100.32860, 10.0.26100.32772, 10.0.26200.8457, 10.0.26200.8390

Vendor guidance

Install KB5087539. Install KB5087423. Install KB5089549. Install KB5089466. Install KB5089548.

CVE-2026-42896

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-42893

Published May 12, 2026

HighCVSS 7.4

Microsoft Outlook for iOS Tampering Vulnerability

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.

Affected productsMicrosoft Outlook for iOS

Fixed versions5.2617.1

Vendor guidance

See the Microsoft Security Update Guide for the update that applies to your product.

CVE-2026-42893

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-42832

Published May 12, 2026

HighCVSS 7.7

Microsoft Office Spoofing Vulnerability

Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.

Affected productsMicrosoft Word for Android, Microsoft Excel for Android, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024

Fixed versions16.0.19822.20190, 16.109.26051019

Vendor guidance

Release Notes

CVE-2026-42832

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-42830

Published May 12, 2026

HighCVSS 6.5

Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability

Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

Affected productsAzure Monitor Agent Metrics Extension

Fixed versions1.42.0

Vendor guidance

Release Notes

CVE-2026-42830

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-42823

Published May 12, 2026

HighCVSS 9.9

Azure Logic Apps Elevation of Privilege Vulnerability

Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

Affected productsAzure Logic Apps

CVE-2026-42823

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41614

Published May 12, 2026

HighCVSS 6.2

M365 Copilot for Desktop Spoofing Vulnerability

Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.

Affected productsM365 Copilot for Desktop

Fixed versions19.2604.43111.0

Vendor guidance

Release Notes

CVE-2026-41614

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41613

Published May 12, 2026

HighCVSS 8.8

Visual Studio Code Elevation of Privilege Vulnerability

Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

Affected productsVisual Studio Code

Fixed versions1.119.1

Vendor guidance

Release Notes

CVE-2026-41613

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41612

Published May 12, 2026

HighCVSS 5.5

Visual Studio Code Information Disclosure Vulnerability

Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.

Affected productsVisual Studio Code - Live Preview extension

Fixed versions0.4.19

Vendor guidance

Release Notes

CVE-2026-41612

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41611

Published May 12, 2026

HighCVSS 7.8

Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.

Affected productsVisual Studio Code

Fixed versions1.119.1

Vendor guidance

Release Notes

CVE-2026-41611

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41610

Published May 12, 2026

HighCVSS 6.3

Visual Studio Code Security Feature Bypass Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Affected productsVisual Studio Code

Fixed versions1.119.1

Vendor guidance

Release Notes

CVE-2026-41610

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41102

Published May 12, 2026

HighCVSS 7.1

Microsoft PowerPoint for Android Spoofing Vulnerability

Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.

Affected productsMicrosoft PowerPoint for Android

Fixed versions16.0.19822.20190

Vendor guidance

Release Notes

CVE-2026-41102

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41101

Published May 12, 2026

HighCVSS 7.1

Microsoft Word for Android Spoofing Vulnerability

Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.

Affected productsMicrosoft Word for Android

Fixed versions16.0.19822.20190

Vendor guidance

Release Notes

CVE-2026-41101

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41097

Published May 12, 2026

HighCVSS 6.7

Secure Boot Security Feature Bypass Vulnerability

Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)

Fixed versions10.0.17763.8755, 10.0.20348.5139, 10.0.20348.5074, 10.0.19044.7291

Vendor guidance

Install KB5087538. Install KB5087545. Install KB5087424. Install KB5087544. Install KB5094127. Install KB5087539. Install KB5087423. Install KB5089549. Install KB5089466. Install KB5087420. Install KB5093998. Install ...

CVE-2026-41097

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41095

Published May 12, 2026

HighCVSS 7.8

Data Deduplication Elevation of Privilege Vulnerability

Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2025 (Server Core installation), Windows Server 2019 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025

Fixed versions10.0.26100.32860, 10.0.26100.32772, 10.0.17763.8755, 10.0.25398.2330

Vendor guidance

Install KB5087539. Install KB5087423. Install KB5087538. Install KB5087541. Install KB5087537. Install KB5087471. Install KB5087545. Install KB5087424.

CVE-2026-41095

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-41094

Published May 12, 2026

HighCVSS 8.8

Microsoft Data Formulator Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.

Affected productsMicrosoft Data Formulator

Fixed versions0.7

Vendor guidance

Release Notes

CVE-2026-41094

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-40421

Published May 12, 2026

HighCVSS 4.3

Microsoft Word Information Disclosure Vulnerability

Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Affected productsMicrosoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems

Fixed versionshttps://aka.ms/OfficeSecurityReleases, 16.0.5552.1000

Vendor guidance

Click to Run Install KB5002858.

CVE-2026-40421

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-40420

Published May 12, 2026

HighCVSS 8.8

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

Fixed versionshttps://aka.ms/OfficeSecurityReleases

Vendor guidance

Click to Run

CVE-2026-40420

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-40419

Published May 12, 2026

HighCVSS 7.8

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

Fixed versionshttps://aka.ms/OfficeSecurityReleases

Vendor guidance

Click to Run

CVE-2026-40419

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-40418

Published May 12, 2026

HighCVSS 7.8

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

Fixed versionshttps://aka.ms/OfficeSecurityReleases

Vendor guidance

Click to Run

CVE-2026-40418

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-40415

Published May 12, 2026

HighCVSS 8.1

Windows TCP/IP Remote Code Execution Vulnerability

Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)

Fixed versions10.0.17763.8755, 10.0.20348.5139, 10.0.20348.5074, 10.0.19044.7291

Vendor guidance

CVE-2026-40415

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-40414

Published May 12, 2026

HighCVSS 7.4

Windows TCP/IP Denial of Service Vulnerability

According to the CVSS score, the attack vector is adjacent (AV:A). What does this mean for this vulnerability? This attack is limited to systems connected to the same network segment as the attacker. The attack cannot be performed across multiple networks (for example, a WAN) ...

Affected productsWindows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022

Fixed versions10.0.17763.8755, 10.0.20348.5139, 10.0.20348.5074, 10.0.19044.7291

Vendor guidance

CVE-2026-40414

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-40413

Published May 12, 2026

HighCVSS 7.4

Windows TCP/IP Denial of Service Vulnerability

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability? In this case, a successful attack could be performed from a low privilege Hyper-V guest. The attacker could traverse the guest's security bou...

Affected productsWindows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022

Fixed versions10.0.17763.8755, 10.0.20348.5139, 10.0.20348.5074, 10.0.19044.7291

Vendor guidance

CVE-2026-40413

Read the vendor advisory Watch this product

Microsoft Security Response CenterCVE-2026-40410

Published May 12, 2026

HighCVSS 7.0

Windows SMB Client Elevation of Privilege Vulnerability

Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)

Fixed versions10.0.17763.8755, 10.0.20348.5139, 10.0.20348.5074, 10.0.19044.7291

Vendor guidance

CVE-2026-40410

Read the vendor advisory Watch this product

Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources