Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
996 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-19445python: Use-after-free of a server-side SSLContext when sni_callback switches contexts | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-94002org.apache.sshd/sshd-sftp: Apache MINA SSHD: Denial of Service via unsolicited SFTP replies | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-19553python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-102990basic-ftp: basic-ftp: Denial of Service via crafted Unix directory listings | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-76154grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-103000pypdf: pypdf: Denial of Service via large alphabetical page labels | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-102999pypdf: pypdf: Denial of Service via crafted PDF with numerous embedded files | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-102998pypdf: pypdf: Denial of Service via crafted PDF form fields | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-102997pypdf: pypdf: Denial of Service via crafted FlateDecode stream | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-102996pypdf: pypdf: Denial of Service via excessive memory consumption during font parsing | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-102994pypdf: pypdf: Denial of Service via crafted indirect object tokens in PDF files | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-92867pgpool-II: Pgpool-II: arbitrary code execution via out-of-bounds write | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-92870pgpool-II: pgpool-II: Denial of Service via stack-based buffer overflow | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-93994org.apache.sshd/sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-92871pgpool-II: pgpool-II: Denial of Service via NULL pointer dereference in watchdog process | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-103500thunderbird: thunderbird: Heap buffer overflow via opening large emails | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-103111pcre2: pcre2: Out-of-bounds write via crafted regular expression | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-103431collectl: collectl: colmux does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-47512nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: privilege escalation via out-of-bounds read in kernel mode layer | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-47511nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Arbitrary code execution via kernel-mode out-of-bounds write | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-47510nvidia-driver: nvidia-driver: Arbitrary code execution via integer overflow in kernel mode layer | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-47508nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Code execution via incorrect numeric type conversion | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-47507nvidia-driver: nvidia-driver: Privilege escalation via out-of-bounds array access in the kernel mode layer | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-47504nvidia-driver: nvidia-driver: Arbitrary code execution via type confusion in the NGX updater | Red Hat | Important | 1 | 2026-09-30 |
| CVE-2026-47501nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Privilege escalation via out-of-bounds write during event buffer setup | Red Hat | Important | 1 | 2026-09-30 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.