Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
1,031 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-114616authlib: authlib: Authentication bypass via zero-length HMAC key | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-112085webpack-dev-server: webpack-dev-server: unauthorized backend access via unvalidated WebSocket proxy requests | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-114663vyper: Vyper: Contract logic corruption via improper name resolution of imported constants | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-115504cfitsio: cfitsio: arbitrary code execution via crafted FITS file | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-114615authlib: Authlib: Authentication bypass via improper asymmetric key validation | Red Hat | Important | 1 | 2026-10-22 |
| DSA-6578-1aide — security update | Debian | Not stated | 0 | 2026-10-22 |
| DSA-6577-1chromium — security update | Debian | Not stated | 0 | 2026-10-22 |
| DSA-6534-3webkit2gtk — regression update | Debian | Not stated | 0 | 2026-10-22 |
| USN-8946-1unbound vulnerabilities | Ubuntu | Not stated | 10 | 2026-10-21 |
| CVE-2026-109618php: OOM bailout during request parsing leads to memory corruption and RCE | Red Hat | Important | 1 | 2026-10-21 |
| USN-8948-2php5, php7.0, php7.2, php7.4 vulnerabilities | Ubuntu | Not stated | 2 | 2026-10-21 |
| USN-8948-1php8.1, php8.3, php8.5 vulnerabilities | Ubuntu | Not stated | 2 | 2026-10-21 |
| CVE-2026-109619php: fatal error handling retains stale request state leading to use-after-free | Red Hat | Important | 1 | 2026-10-21 |
| USN-8951-1c-ares vulnerabilities | Ubuntu | Not stated | 4 | 2026-10-21 |
| CVE-2026-94300bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-114094dulwich: Dulwich: Arbitrary code execution via unvalidated drive letters in repository paths | Red Hat | Important | 1 | 2026-10-21 |
| DSA-6575-1nginx — security update | Debian | Not stated | 5 | 2026-10-21 |
| USN-8949-1ghostscript vulnerabilities | Ubuntu | Not stated | 2 | 2026-10-21 |
| CVE-2026-114045freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-114126storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-96888bind: bind: Denial of Service via assertion failure during redirect processing | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-19630bind: BIND: Denial of Service via unbounded processing of crafted DNS messages | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-97313bind: bind: Denial of service via assertion failure in RPZ query processing | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-114138djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing | Red Hat | Important | 1 | 2026-10-21 |
| CVE-2026-96640pillow: pillow: Denial of Service via duplicate page references in PDF files | Red Hat | Important | 1 | 2026-10-21 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.