Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
988 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-103007elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106298chromium-browser: Use after free in Chrome Tabs | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106281chromium-browser: Use after free in Tint | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106419chromium-browser: angle: Use after free in ANGLE | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106500@backstage/plugin-scaffolder-backend: @backstage/plugin-scaffolder-backend: Unauthorized file manipulation via improper task state validation | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106383chromium-browser: Use after free in Media | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106346chromium-browser: Improper state validation in DevTools | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106349chromium-browser: Use after free in V8 | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106323chromium-browser: Missing authorization in Chrome for iOS | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106293chromium-browser: angle: Type confusion in ANGLE | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-105840lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-105922vllm: vLLM: Denial of Service via crafted inference request with prompt embeddings | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106421chromium-browser: Use after free in PDF | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106411chromium-browser: Use after free in Parser | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106423chromium-browser: Use after free in Media | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106318chromium-browser: Use after free in Media | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106278chromium-browser: Use after free in Select | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106257chromium-browser: Use after free in HTML | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106248chromium-browser: Use after free in Bindings | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106393chromium-browser: Use after free in Storage | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106550convict: convict: Denial of Service via prototype pollution in config.set() | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106215chromium-browser: angle: Uninitialized resource in ANGLE | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106488plugin-auth-backend-module-oidc-provider: plugin-auth-backend-module-oidc-provider: Privilege escalation via unverified email addresses | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106308chromium-browser: Incorrect reference resolution in Autofill | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106440hydra-optuna-sweeper: hydra-optuna-sweeper: Arbitrary code execution via malicious sweep configuration | Red Hat | Important | 1 | 2026-10-06 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.