Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
996 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-94656thrift: Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94655thrift: Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94653thrift: Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic) | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94648thrift: Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94637github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of compressed data | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94636thrift: Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-90440thrift: thrift: Denial of Service via improper exception handling in TNonblockingServer | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-87117thrift: Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-82459thrift: thrift: Denial of Service via integer underflow in THeaderTransport | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-82458thrift: thrift: Denial of Service via excessive memory allocation | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-96288thrift: Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory) | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-96292thrift: thrift: Denial of Service via inefficient regular expression evaluation in Lua bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-96294thrift: Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-61373org.apache.thrift/libthrift: Apache Thrift: Denial of Service via unbounded resource allocation in TSaslNonblockingServer | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-96990thrift: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94644apache/thrift: thrift: Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94645thrift: Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94650thrift: thrift: Denial of Service via uncontrolled recursion in C GLib bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-85493thrift: Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME) | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-91137thrift: Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-93926thrift: thrift: Denial of Service via memory leak in THeaderTransport | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94633thrift: thrift: Denial of Service via excessive memory allocation in Dart bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94634thrift: Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94635thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-104861probe-image-size: probe-image-size: Denial of Service via crafted SVG input | Red Hat | Important | 1 | 2026-10-02 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.