Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
988 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-97791org.apache.cxf/cxf-rt-ws-security: Apache CXF: Authentication bypass via shared token validation state | Red Hat | Important | 1 | 2026-10-09 |
| CVE-2026-105958None | Red Hat | Important | 1 | 2026-10-09 |
| CVE-2026-97468org.apache.cxf/cxf-rt-ws-security: org.apache.cxf/cxf-services-sts-core: Apache CXF: Authentication bypass via hash collision in token cache | Red Hat | Important | 1 | 2026-10-09 |
| CVE-2026-98378kernel: bpf: Skip unsettled links in link iterator | Red Hat | Important | 1 | 2026-10-09 |
| CVE-2026-95702gvisor.dev/gvisor: gVisor: Arbitrary code execution via use-after-free in VFS | Red Hat | Important | 1 | 2026-10-09 |
| CVE-2026-78669net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-97031crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-78667net/http: golang: golang: Denial of Service via crafted HTTP Range headers | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-105959spice-server: spice: Heap buffer overflow via GLZ dictionary max_encoders integer truncation | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-107286pydantic-ai: pydantic-ai: Denial of Service via unreleased concurrency slots in streaming requests | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-107728strawberry-graphql: strawberry-graphql: Authorization bypass via improper permission evaluation | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-93858openstack-mistral: mistral: OS command injection via unvalidated proxy_command in std.ssh_proxied action | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-109832gnome-remote-desktop: Busy-Wait DoS in VNC TLS I/O Handlers (GNUTLS_E_AGAIN / GNUTLS_E_INTERRUPTED) | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-107725com.hazelcast/hazelcast: Hazelcast: arbitrary code execution via missing authorization checks in IMap Predicates API | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-107726com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-93017insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-97147openstack-mistral: mistral: Cross-project resource tampering via missing ownership check in action definition and environment update paths | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-107295pydantic-ai-slim: pydantic-ai-slim: Unauthorized tool execution via missing Content-Type validation | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-107716banks: Banks: Information disclosure via symbolic link traversal | Red Hat | Important | 1 | 2026-10-08 |
| CVE-2026-113672argo-cd: github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: A Jsonnet import can read files from the repo-server | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-113708github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: A Kustomize remote ref can run commands in the repo-server | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-113709github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: argocd: A Kustomize Helm config home can run commands in the repo-server | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-77459argo-cd: github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-106510plugin-techdocs-node: plugin-techdocs-node: Arbitrary code execution via crafted mkdocs configuration | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-106558@backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node: Arbitrary code execution via improper markdown extension configuration | Red Hat | Important | 1 | 2026-10-07 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.