First month free

Your vendors. Their CVEs. Straight to your inbox.

Never miss a critical CVE for the vendors you run. Unlimited covers every supported vendor, with whole-vendor and product or platform rules and CISA KEV flags. Your first month is free with a valid card, then US$15/month. Cancel anytime.

34 official vendor sources Unlimited CVE alerts Browsing CVEs is free

Start your free month Browse CVEs

Source-linked alerts

Email alerts

Follow any whole vendor or exact platform. Matching advisories arrive in your verified inbox with severity, affected products, fixes and the official source.

Create email alerts

Email + phone

Android app

Take the same vendor and platform coverage with you. Choose email, phone push notifications, or both for each rule and open the advisory in one tap.

Start your free month in the app with Google Play, which shows local pricing, or start it on the website.

Get the app App details

Source-linked dates

EOL checker

Choose a validated vendor, product and release or model to review published maintenance, security-support and final-support milestones.

Check a product lifecycle

Latest verified advisoryCritical [CVE-2026-110264] issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expressionGitLab·Critical·CVE-2026-110264·CVSS 10.0

Now available on Google Play

CVE alerts for the vendors and platforms you track.

Track every supported product across 34 official vendor sources and 160+ precise platforms. Choose phone notifications, email, or both—then open the official advisory from the alert. Unlimited covers every supported vendor, with whole-vendor alerts and unlimited product or platform rules. Your first month is free with a valid payment method.

Your vendors. Their CVEs. Straight to your inbox.

Email alerts

Android app

EOL checker

CVE alerts for the vendors and platforms you track.

Latest critical & high advisories by vendor

Critical [CVE-2026-109618 +1] Vulnerabilities in PHP Affecting Cisco Products: October 2026

Critical [CVE-2026-20043 +3] Multiple Cisco Products Snort 3 Security Hardening Release: October 2026

Critical [CVE-2026-76473 +7] Cisco Unified Communications Products Security Hardening Release: October 2026

Critical [CVE-2026-109618 +1] PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)

Critical [CVE-2026-109618 +1] Impact of Critical Vulnerabilities in PHP (, CVE-2026-109619) on Palo Alto Networks Products

High [CVE-2026-0322] PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

High [CVE-2026-102299 +448] PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)

High [CVE-2026-79811] ClearPass Policy Manager: SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL injection attacks against the ClearPass Policy Manager instance

High [CVE-2026-79810] ClearPass Policy Manager: Remote code execution vulnerabilities exist in the affected interface of HPE Networking ClearPass Policy Manager that could allow an authenticated remote attacker with high privileges to execute arbitrary code

High [CVE-2026-79809] ClearPass Policy Manager: unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager

Critical [CVE-2025-64392 +2] Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4

Critical [CVE-2026-65641] Vulnerability Resolved in Veeam ONE 13.1 Patch 0

Critical [CVE-2026-58067 +3] Vulnerabilities Resolved in Veeam Service Provider Console 9.3

High [CVE-2026-59347] VMware Workstation: VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS.

Critical [CVE-2026-59346] VMware Workstation: VMware Workstation and Fusion contain an integer-overflow vulnerability.

High [CVE-2026-41012] BOSH: Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and…

High [CVE-2026-108452] Microsoft Office SharePoint Remote Code Execution Vulnerability

High [CVE-2026-88164] Microsoft Office SharePoint Elevation of Privilege Vulnerability

High [CVE-2026-94512] SQL Server Remote Code Execution Vulnerability

Critical [CVE-2026-77099] CVFS Command Execution

High [CVE-2026-97333] QAPI stack-based buffer overflow

High [CVE-2026-77094] CvFWD Out-of-Bounds Write

High [CVE-2026-114045] heap buffer overflow in server rdpsnd via crafted audio formats

High [CVE-2026-113726] Arbitrary command execution via unescaped prompt variables in zsh

High [CVE-2026-113776] Arbitrary command execution via sequential placeholder substitution in activation templates

High [CVE-2026-111812] Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials

Critical [CVE-2026-111811] Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache

Critical [CVE-2026-107406] Protecting Customers: Immediate Guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway

High [CVE-2026-88779] Understanding and Addressing CVE-2026-88779 in Citrix NetScaler ADC and Citrix NetScaler Gateway

High [CVE-2026-88778] TCP Initial Sequence Number (ISN) prediction

High [CVE-2026-111357] Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026

Critical [CVE-2026-109412] exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information

High [CVE-2026-106047] Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files

High [CVE-2026-100232 +1] Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability ha…

Critical [CVE-2026-102255 +3] Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate acc…

Critical [CVE-2026-78327 +2] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Ne…

Critical [CVE-2026-86060] SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

High [CVE-2026-67281] Unauthenticated file read in Mikrotik RouterOS

High [CVE-2026-67277] Kernel memory disclosure and denial of service in MikroTik RouterOS btest service

High [CVE-2026-22927] Omnissa Workspace ONE Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

High [CVE-2026-22926] Omnissa Workspace ONE Assist for macOS contains a Local Privilege Escalation Vulnerability.

High [CVE-2025-25234] UAG: Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability.

High [CVE-2026-110459] malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device

High [CVE-2026-110455] malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device

High [CVE-2026-95862] Dream Machines: malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device

High [CVE-2026-113779] The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls

High [CVE-2026-111231] Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore and config_install ignore the 'User - Config: Deny Config Write' privilege

High [CVE-2026-111229] pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root

Critical [CVE-2026-25199] Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants

Critical [CVE-2026-50619] path traversal vulnerability has been reported to affect Qsirch.

Critical [CVE-2026-47786] OS command injection vulnerability has been reported to affect HybridDesk Station.

High [CVE-2026-39997] missing authentication for critical function vulnerability has been reported to affect HybridDesk Station.

Critical [CVE-2026-99999] Linux Kernel Vulnerability in NetApp Products

Critical [CVE-2026-109618 +1] October 2026 PHP Vulnerabilities in NetApp Products

High [CVE-2026-48798] SSH.NET Vulnerability in NetApp Products

High [CVE-2026-104939] Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress

High [CVE-2026-101019] Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization

High [CVE-2026-94197] authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication

Critical [CVE-2026-18367] privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6

Critical [CVE-2025-10159] authentication bypass vulnerability

Critical [CVE-2025-7624] SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can

Critical [CVE-2026-93616] directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server

Critical [CVE-2026-91843] Stack overflow in login process to the Security Management and Log Servers

Critical [CVE-2026-85103] heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems

High [CVE-2026-76307] Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR

High [CVE-2026-76306] Information Disclosure through REST API Query Filters in Splunk SOAR

High [CVE-2026-76298] Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise

Critical [CVE-2026-21589] This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center

High [CVE-2026-21588] This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center

High [CVE-2026-21587] Confluence: This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center

Critical [CVE-2026-105445] Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret

High [CVE-2026-106581] Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package

High [CVE-2026-92543] Docker Engine classifies a registry hostname as insecure using an any-match DNS check

High [CVE-2026-86134] NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service