Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
988 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-56851golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-107227org.asynchttpclient/async-http-client: AsyncHttpClient: Denial of Service via unbounded WebSocket decompression | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-107183llama.cpp: llama.cpp: Arbitrary code execution via crafted completion request | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-107279org.asynchttpclient/async-http-client: AsyncHttpClient: Mutual authentication bypass via Digest auth-int negotiation | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-105816github.com/hashicorp/vault: Vault: Arbitrary code execution via plugin catalog entries in restored snapshots | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-77214expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-106471candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-106556plugin-techdocs-node: plugin-techdocs-node: arbitrary command execution via configuration sanitization bypass | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-107231org.asynchttpclient/async-http-client: async-http-client: Credential exposure via authentication downgrade | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-107232org.asynchttpclient/async-http-client: async-http-client: Information disclosure via transmission of credentials after failed proxy CONNECT | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-107282org.asynchttpclient/async-http-client: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host | Red Hat | Critical | 1 | 2026-10-07 |
| CVE-2026-107230org.asynchttpclient/async-http-client: async-http-client: Information disclosure via improper connection pool partitioning | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-92543github.com/moby/moby: Docker Engine: Certificate verification bypass via flawed registry DNS check | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-92542github.com/moby/moby: Moby: Unauthorized traffic injection via forged VXLAN datagrams | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-93516xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-93521xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-88812xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-93523xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-93522xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes | Red Hat | Important | 1 | 2026-10-07 |
| CVE-2026-105841lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106446handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106443weasyprint: WeasyPrint: Arbitrary code execution via unsafe PostScript image processing | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-94205code.gitea.io/gitea: Gitea Actions: Arbitrary code execution via improperly authorized fork workflows | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106445handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-96404code.gitea.io/gitea: Gitea: Authentication bypass via web installer | Red Hat | Important | 1 | 2026-10-06 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.