Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
996 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-85476thrift: Apache Thrift: c_glib `read_all` spins when the underlying read returns 0 | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-94654thrift: thrift: Denial of Service via infinite loop in Python bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-104849tinypool: Tinypool: Prototype Pollution Gadget to RCE in run() options | Red Hat | Critical | 1 | 2026-10-02 |
| CVE-2026-103628chromium-browser: Out of bounds write in WebGL | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-104846seroval: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940) | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-103552org.apache.directory.api/api-ldap-codec-core: Apache Directory LDAP API: Denial of Service via deeply nested search filter | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-86535thrift: thrift: Denial of Service via TJSONProtocol in Node.js bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-103630chromium-browser: Use after free in FedCM | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-103626chromium-browser: Incorrect authorization in FileSystem | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-104851fsspec: fsspec: arbitrary code execution via unrestricted template rendering in ReferenceFileSystem | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-103625chromium-browser: Type confusion in V8 | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-103623chromium-browser: Use after free in MediaStream | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-103622chromium-browser: Use after free in SVG | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-66837thrift: thrift: Denial of Service via buffer overflow in PHP bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-103624chromium-browser: Use after free in Contextual Tasks | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-66055thrift: thrift: Denial of Service via uncontrolled resource allocation | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-66858thrift: Apache Thrift: Denial of Service via deeply nested unknown fields | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-85086thrift: thrift: Information disclosure via improper certificate validation in Perl bindings | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-104873langgraph-sdk: langgraph-sdk: Authorization bypass via improper resource handler registration | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-85088thrift: thrift: Man-in-the-middle attacks via improper certificate validation | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-85087thrift: Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-104988pki-core: dogtag-pki: redhat-pki: pki: EST fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-103621chromium-browser: Integer overflow in Compositing | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-103629chromium-browser: skia: Integer overflow in Skia | Red Hat | Important | 1 | 2026-10-02 |
| CVE-2026-104854nx: Nx: Arbitrary code execution via insecure socket permissions | Red Hat | Important | 1 | 2026-10-02 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.