Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
1,031 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-102673electron: Electron: Sandbox bypass via popups opened from sandboxed iframes | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102317chromium-browser: chromium-browser: Improper privilege management in Mojo | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-102677electron: Electron: Privilege escalation via sandboxed preload code cache poisoning | Red Hat | Important | 1 | 2026-09-29 |
| CVE-2026-86330noobaa-core: noobaa-core: OS command injection in cluster_internal_api.set_hostname_internal | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-91006org.apache.karaf.instance/org.apache.karaf.instance.core: karaf: Apache Karaf: Arbitrary command execution via unquoted instance options | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-101894@xhmikosr/decompress: @xhmikosr/decompress: Path traversal via symlink chain | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-101919hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-93348unsloth-zoo: unsloth: Unsloth Zoo: Arbitrary code execution via crafted model configuration | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-96740streamshub/console: console-operator: Streams for Apache Kafka Console: Unfiltered Kafka client properties → SA-token exfiltration via config.providers | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-101906axios: axios: Denial of Service via crafted redirect hostname | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-85644perl-XS-Parse-Keyword: perl-XS-Parse-Keyword: Denial of Service via improper array reference validation | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-101901axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-101903axios: Axios: Denial of Service via malformed data URLs | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-101909axios: axios: Denial of Service via prototype pollution gadget in form serialization | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-102278brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-102276brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-101014opendmarc: OpenDMARC: Denial of Service via off-by-one error in opendmarc_util_cleanup | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-97024flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-101015opendmarc: OpenDMARC: DMARC policy bypass via Unicode dot character equivalence in policy.c Domain Handler | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-101905axios: axios: Request socket hijacking via inherited createConnection property | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-97023None | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-96760authlib: authlib: Signature verification bypass via deserialize_json | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-93355litellm: LiteLLM: Privilege escalation via unverified email lookup in JWT authentication | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-101916grpc-js: grpc-js: Authentication bypass via improper peer certificate validation | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-102268pyjwt: PyJWT: Authentication bypass via improper public key validation | Red Hat | Critical | 1 | 2026-09-28 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.