Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
988 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-106547hdf5: hdf5: Arbitrary code execution via heap-based buffer overflow | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106369chromium-browser: Missing authorization in Translate | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106442hydra-core: hydra-core: Arbitrary code execution via target blocklist bypass in instantiate() | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106214chromium-browser: Information leak in Proxy | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106062gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-98320kernel: netfilter: flowtable: hold reference on ct until flow is released | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-98260kernel: exec: Cleanup POSIX timers right after de_thread() | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-98256kernel: signal: Prevent exec() race | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-98318kernel: smb: client: validate absolute native symlink targets before NT fixups | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-98364kernel: xfrm: hold net_device reference under RCU in bundle creation | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-106243chromium-browser: Incomplete cleanup in Proxy Auth | Red Hat | Important | 1 | 2026-10-06 |
| CVE-2026-104711org.apache.struts/struts2-core: Apache Struts: Arbitrary code execution via expression injection in legacy RESTful action mapper | Red Hat | Important | 1 | 2026-10-05 |
| CVE-2026-104712org.apache.struts/struts2-core: Apache Struts: Denial of Service via resource amplification in tag library | Red Hat | Important | 1 | 2026-10-05 |
| CVE-2026-94453libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP | Red Hat | Important | 1 | 2026-10-05 |
| CVE-2026-105782scrapy: Scrapy: Denial of Service via crafted Referrer-Policy header | Red Hat | Important | 1 | 2026-10-05 |
| CVE-2026-104852@graphql-tools/utils: @graphql-tools/utils: Denial of Service (DoS) via prototype pollution in mergeDeep | Red Hat | Important | 1 | 2026-10-05 |
| CVE-2019-25777perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment | Red Hat | Important | 1 | 2026-10-05 |
| CVE-2017-20285perl-yaml: perl-yaml: Arbitrary destructor method execution via crafted YAML document | Red Hat | Important | 1 | 2026-10-05 |
| CVE-2026-19395qt-mcu: qt: Denial of Service via empty image tag attribute in styled text | Red Hat | Important | 1 | 2026-10-05 |
| CVE-2026-93318github.com/moby/buildkit: BuildKit: arbitrary code execution via cache poisoning from mismatched layer identifiers | Red Hat | Important | 1 | 2026-10-05 |
| CVE-2026-63277libreoffice: libreoffice: Arbitrary code execution via remote Java database driver | Red Hat | Important | 1 | 2026-10-05 |
| CVE-2026-102282adm-zip: adm-zip: Privilege escalation via unfiltered permission bits in extracted archives | Red Hat | Important | 1 | 2026-10-05 |
| CVE-2026-93320github.com/moby/buildkit: BuildKit: Unintended host device access via special file inodes | Red Hat | Important | 1 | 2026-10-05 |
| CVE-2026-105516nfs-ganesha: nfs-ganesha: 9P TWALK component count stack buffer overflow | Red Hat | Critical | 1 | 2026-10-05 |
| CVE-2026-105517nfs-ganesha: nfs-ganesha: 9P TWRITE/TCLUNK race condition use-after-free | Red Hat | Important | 1 | 2026-10-05 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.