Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
987 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-110353haproxy: HAProxy: Denial of Service via truncated HTTP/2 PING frame | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-110354haproxy: haproxy: Denial of Service via specially crafted HTTP/1.1 chunked request | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-114730roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-111079goose: goose: Shell History and Environment Leak via Terminal Integration | Red Hat | Important | 1 | 2026-10-22 |
| USN-8946-1unbound vulnerabilities | Ubuntu | Not stated | 10 | 2026-10-21 |
| USN-8951-1c-ares vulnerabilities | Ubuntu | Not stated | 4 | 2026-10-21 |
| CVE-2026-114094dulwich: Dulwich: Arbitrary code execution via unvalidated drive letters in repository paths | Red Hat | Important | 1 | 2026-10-21 |
| DSA-6575-1nginx — security update | Debian | Not stated | 5 | 2026-10-21 |
| USN-8949-1ghostscript vulnerabilities | Ubuntu | Not stated | 2 | 2026-10-21 |
| CVE-2026-114045freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-114052vllm: vLLM: Denial of Service via unbounded processor caching in MOSS-Audio | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-114109uv: uv: Arbitrary code execution via path traversal in entry point names | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-114051vllm: vllm: Denial of Service via improper token parameter validation | Red Hat | Important | 1 | 2026-10-21 |
| USN-8930-2u-boot vulnerabilities | Ubuntu | Not stated | 4 | 2026-10-21 |
| CVE-2026-114055vllm: vLLM: Denial of Service via unvalidated multimodal processor arguments | Red Hat | Important | 1 | 2026-10-21 |
| USN-8950-1poppler vulnerability | Ubuntu | Not stated | 1 | 2026-10-21 |
| CVE-2026-114102adm-zip: adm-zip: Denial of Service via malformed ZIP archive decompression | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-114112sharp: sharp: Arbitrary code execution via crafted image files | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-114050vllm: vllm: Denial of Service via multimodal cache desynchronization | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-114096dulwich: dulwich: Arbitrary code execution via symlink following during file checkout | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-114098dulwich: Dulwich: Arbitrary code execution via symlink directory traversal during stash pop | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-114097dulwich: dulwich: Arbitrary code execution via symlink path traversal during branch filtering | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-114113sharp: sharp: arbitrary code execution via crafted image files | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-91403OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns | Red Hat | Critical | 1 | 2026-10-21 |
| CVE-2026-96640pillow: pillow: Denial of Service via duplicate page references in PDF files | Red Hat | Important | 1 | 2026-10-21 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.