Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
1,031 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-100792firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102823russh: russh: State corruption via unverified SSH channel identifiers | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-100811firefox: firefox: Sandbox escape via use-after-free in DOM component | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-100782firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-95291chromium-browser: UI misrepresentation in SecurityIndicators | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102311chromium-browser: chromium-browser: Uninitialized resource in GPU | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-95324chromium-browser: Uninitialized resource in GPU | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-100766firefox: thunderbird: Information disclosure in the Networking: JAR component | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-100832firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102674electron: Electron: Sandbox bypass via popup window creation | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-100761firefox: Privilege escalation due to use-after-free in the Graphics: WebGPU component | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102315chromium-browser: chromium-browser: Uninitialized resource in Media | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102318chromium-browser: chromium-browser: Out of bounds read in WebGL | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102319chromium-browser: chromium-browser: Uninitialized resource in GPU | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102675electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-97687urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102831jupyterlab: JupyterLab: Cross-Site Scripting via malicious clipboard cell pasting | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102329chromium-browser: chromium-browser: Cross-site scripting in WebUI | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-95298chromium-browser: Use after free in Browser | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102930virtualenv: virtualenv: Arbitrary code execution via unverified downloaded seed wheels | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-19547ghostscript: ghostscript: Local privilege escalation via predictable resource search path | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102925virtualenv: virtualenv: Arbitrary code execution via crafted paths in activation scripts | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102937virtualenv: virtualenv: Arbitrary code execution via unescaped prompt in Windows activation script | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-95315chromium-browser: Use after free in Aura | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-100308gluonts: gluonts: Arbitrary command execution via untrusted model deserialization | Red Hat | Important | 1 | 2026-09-29 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.