Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
988 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-106501@backstage/plugin-scaffolder-backend: Backstage: Sensitive information exposure in Scaffolder | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106439hydra-core: hydra-core: Arbitrary code execution via mutable execution policy manipulation | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106211chromium-browser: Use after free in TabStrip | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106197chromium-browser: Use after free in Browser | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106240chromium-browser: Type confusion in V8 | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-96404code.gitea.io/gitea: Gitea: Authentication bypass via web installer | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106227chromium-browser: Use after free in Core | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106239chromium-browser: Integer overflow in WebGL | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106445handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-102322chromium-browser: Incorrect Authorization in SiteIsolation | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106382chromium-browser: Use after free in Chromecast | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106235chromium-browser: Use after free in WebAudio | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106268chromium-browser: Use after free in WebRTC | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106503plugin-scaffolder-backend: plugin-scaffolder-backend: Authorization bypass via scaffolder action inputs | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106200chromium-browser: Use after free in Track | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106193chromium-browser: Use after free in Parser | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106233chromium-browser: Use after free in Metrics | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106509plugin-techdocs-node: Backstage plugin-techdocs-node: Arbitrary code execution via improper MkDocs configuration validation | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106486plugin-scaffolder-backend-module-bitbucket-cloud: plugin-scaffolder-backend-module-bitbucket-server: Backstage: Unauthorized file manipulation via Bitbucket pull-request Scaffolder actions | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106190chromium-browser: Use after free in Media | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-94205code.gitea.io/gitea: Gitea Actions: Arbitrary code execution via improperly authorized fork workflows | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106329chromium-browser: Incorrect authorization in FileSystem | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106347chromium-browser: Use after free in Track | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106204chromium-browser: Use after free in PDF | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106203chromium-browser: Incomplete cleanup in Autofill | Red Hat | Important | 1 | 2026-10-06 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.