Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
996 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-12405rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-12540foreman: command injection in foreman-rake errors:fetch_log via request_id parameter | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-12541foreman: command injection in foreman-rake database tasks | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-63292httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-96658foreman: Foreman: Arbitrary code execution via safemode sandbox bypass | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-56154httpd: httpd: Denial of Service via mod_rewrite lookahead | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-103262tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-63718httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-59685httpd: httpd: Denial of Service via out-of-bounds write during Windows path expansion | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-56153httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-63686httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-46729httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-103484pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-73636httpd: httpd: Authentication bypass via credential replay in mod_auth_digest | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-12423foreman: unauthenticated information disclosure via provisioning token validation flaw | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2023-54404zod: zod: Denial of service via unbounded array validation | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-86344389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-PDU connection requeue | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-96659foreman: Excessive Permissions for Viewer Role on Preview | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-12544foreman: SSTI and insecure deserialization in foreman-rake configuration | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-15911confluent-kafka: confluent-kafka: Information disclosure via improper TLS certificate validation in HashiCorp Vault integration | Red Hat | Important | 1 | 2026-10-01 |
| CVE-2026-15815grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-88920org.apache.wss4j/wss4j-ws-security-dom: Apache WSS4J: Authentication bypass via unsigned SAML sender-vouches assertion | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-103226ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-77185org.apache.sshd/sshd-core: Apache MINA SSHD: Asynchronous authentication can bypass signature verification | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-102992piscina: piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env | Red Hat | Important | 1 | 2026-09-30 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.