Search threats, CVEs… ⌘K
Vendor advisories

Security advisories from the vendors you use.

Search new and updated bulletins from Microsoft, Citrix, Cisco, Palo Alto Networks, Fortinet, Ivanti, Delinea, Ubuntu, and AWS. We keep each vendor's advisory ID, affected products, CVEs, severity, dates, and available fix guidance together.

Set up product alerts Follow the RSS feed
11Vendor sources
18,986Advisories collected
6,744Published or updated in 30 days
8,727Marked critical or high
Coverage

Connected directly to official vendor sources

The original vendor bulletin remains the authority. SecurityAlert gives you one place to find it and compare the details vendors publish in different formats.

18,986 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-26133
HighCVSS 7.1

M365 Copilot Information Disclosure Vulnerability

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Affected productsMicrosoft OneNote for iOS, Microsoft Outlook for Mac, Microsoft Outlook for Android, Microsoft 365 Copilot for iOS
Fixed versions2.106.26020617, 5.2605, 2.107.2, 145.3800.99
Vendor guidance

Release Notes Release Note

CVE-2026-26133
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-0385
LowCVSS 5.0

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L), integrity (I:L) and availability (A:L). What does that mean for this vulnerability? While we cannot rule out the impact to Confidentiality, Integrity,...

Affected productsMicrosoft Edge for Android
Fixed versions146.0.3856.59
Vendor guidance

Release Notes

CVE-2026-0385
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-21715
LowCVSS 3.3

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.

Mariner

Affected productsazl3 nodejs 20.14.0-14 on Azure Linux 3.0, azl3 nodejs24 24.13.0-3 on Azure Linux 3.0
Fixed versions20.14.0-15, 24.14.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2026-21715
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-21716
LowCVSS 3.3

An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.

Mariner

Affected productsazl3 nodejs24 24.13.0-3 on Azure Linux 3.0, azl3 nodejs 20.14.0-14 on Azure Linux 3.0
Fixed versions24.14.1-1, 20.14.0-15
Vendor guidance

CBL-Mariner Releases

CVE-2024-36137CVE-2026-21716
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-21714
MediumCVSS 5.3

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

Mariner

Affected productsazl3 nodejs24 24.13.0-3 on Azure Linux 3.0, azl3 nodejs 20.14.0-14 on Azure Linux 3.0
Fixed versions24.14.1-1, 20.14.0-15
Vendor guidance

CBL-Mariner Releases

CVE-2026-21714
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-21713
MediumCVSS 5.9

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

Mariner

Affected productsazl3 nodejs 20.14.0-14 on Azure Linux 3.0, azl3 nodejs24 24.13.0-3 on Azure Linux 3.0
Fixed versions20.14.0-15, 24.14.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2026-21713
Read the vendor advisory Watch this product
Palo Alto Networks Security AdvisoriesPAN-SA-2026-0005
InformationalCVSS 0.0

PAN-SA-2026-0005: Informational Bulletin: Precautionary Fixes for Non-Exploitable OSS CVEs in PAN-OS

The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. These CVEs were determined to have no impact on PAN-OS, but they have been fixed out of an abundance of caution.

Affected productsPAN-OS
Fixed versionsPAN-OS All
Vendor guidance

The OSS CVEs are fixed in the respective PAN-OS versions.

Read the vendor advisory Watch this product
Palo Alto Networks Security AdvisoriesPAN-SA-2026-0006
InformationalCVSS 0.0

PAN-SA-2026-0006: Informational Bulletin: Impact assessment of OSS CVEs in PAN-OS

The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the affected OSS package, PAN-OS does not offer any scenarios required for an attacker to suc...

Affected productsPAN-OS
Fixed versionsPAN-OS All
Vendor guidance

The OSS CVEs are fixed in the respective PAN-OS versions.

Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-4645
HighCVSS 7.5

Github.com/antchfx/xpath: xpath: denial of service via crafted boolean xpath expressions

Mariner

Affected productscbl2 telegraf 1.29.4-21 on CBL Mariner 2.0, cbl2 terraform 1.3.2-29 on CBL Mariner 2.0, azl3 telegraf 1.31.0-15 on Azure Linux 3.0, azl3 telegraf 1.31.0-17 on Azure Linux 3.0
Fixed versions1.29.4-22, 1.3.2-30, 1.31.0-17, 1.31.0-16
Vendor guidance

CBL-Mariner Releases

CVE-2026-4645
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-5281
Severity not listed

Chromium: CVE-2026-5281 Use after free in Dawn

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information. Google is aware that an exploit for CVE-2026-5281 exists in the wild.

Affected productsMicrosoft Edge (Chromium-based)
Fixed versions146.0.3856.97
Vendor guidance

Release Notes

CVE-2026-5281
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources