Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
987 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-107349pgbouncer: pgbouncer: Denial of Service via empty parameter name in startup options | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-110859GitPython: GitPython: Arbitrary file read via argument injection in branch checkout | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-110837freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-107350pgbouncer: pgbouncer: Privilege escalation via secondary startup message during SCRAM authentication | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-110869nodemailer: nodemailer: Denial of Service via regular expression backtracking in SMTP authentication parsing | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-110856GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-94370qt-mcu: Qt: Memory corruption via improper string handling in Qt Quick Ultralite | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-110838freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-100236dpdk: dpdk: heap out-of-bounds read/write in GSO header copy | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-110839freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-102460io.vertx/vertx-web: vertx-web: Authorization bypass via ChainAuthHandler scope validation failure | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-90954busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-98417kernel: net: xfrm: reject unrepresentable espintcp transport headers | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2017-20286DevIL: DevIL: Arbitrary code execution via crafted GIF image | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-86476gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated GstVideoMeta plane extents in gst_video_frame_map_id and video_meta_deserialize | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-86563dpdk: dpdk: Double offset bug in vhost log mapping calculation | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-110865renovate: Renovate: HTTP header injection via shared configuration presets | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-86562dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-86565dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-112258gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-104795insights-runtime-extractor: insights-runtime-extractor: Container Escape via Privileged Binary Execution | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-86567dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap | Red Hat | Important | 1 | 2026-10-14 |
| CVE-2026-86848dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto | Red Hat | Important | 1 | 2026-10-14 |
| DSA-6561-1sogo — security update | Debian | Not stated | 0 | 2026-10-14 |
| DSA-6560-1firefox-esr — security update | Debian | Not stated | 0 | 2026-10-14 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.