Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
988 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-105221gist: gist: Traffic interception and credential theft via improper TLS certificate validation | Red Hat | Important | 1 | 2026-10-04 |
| CVE-2026-71889org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-lts8on: bouncycastle: Bouncy Castle: Certificate validation bypass via missing name constraint checks | Red Hat | Important | 1 | 2026-10-03 |
| CVE-2026-71888bouncycastle: bouncycastle-fips: Bouncy Castle: Security bypass via unvalidated attributes in CMS AuthenticatedData parser | Red Hat | Important | 1 | 2026-10-03 |
| CVE-2026-103877org.apache.directory.api/api-ldap-client-api: Apache Directory LDAP API: Remote code execution via untrusted Java object deserialization | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-86537thrift: thrift: Denial of Service via infinite loop in D language bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-104848tinypool: tinypool: arbitrary code execution via prototype pollution in worker options | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-103885org.apache.directory.api/api-ldap-model: Apache Directory LDAP API: Denial of Service via crafted telephone numbers | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-85494thrift: thrift: Denial of Service via improper message handling in language bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-103631chromium-browser: Buffer overflow in WebRTC | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94646thrift: thrift: Denial of Service via prototype pollution in Node.js bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-91135thrift: Apache Thrift: Arbitrary code execution via heap-based buffer overflow during frame compression | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-93925thrift: thrift: Denial of Service via stack-based buffer overflow in THeaderProtocol | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-104845seroval: seroval: Denial of Service via unbounded memory allocation during deserialization | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-102731org.apache.directory.api/api-asn1-ber: Apache Directory LDAP API: Denial of Service via excessive memory allocation | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-104843uv: uv: Arbitrary code execution via malicious package extraction on Windows | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-66054thrift: thrift: Denial of Service via improper handling of compressed data | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-63772github.com/apache/thrift: Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-66081thrift: thrift: Denial of Service via uninitialized pointer access in c_glib bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-66859thrift: thrift: Denial of Service via NULL pointer dereference in c_glib bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-83663github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-83745thrift: thrift: Denial of Service via excessive memory allocation in WebSocket transport | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-96289thrift: Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-96287thrift: Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic) | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-96286thrift: Apache Thrift: Perl servers end `serve()` when serving one connection fails | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-96277thrift: thrift: Denial of Service via uncaught exception in Ruby bindings | Red Hat | Important | 1 | 2026-10-02 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.