Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
1,031 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-100657io.netty/netty-codec-stomp: netty-codec-stomp: Denial of Service via memory leak during frame decoding | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100656io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100655io.netty/netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-91765php: php: Denial of Service via unbounded recursion in SOAP parser | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-92550qpid-java: org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol: Apache Qpid Broker-J: Denial of Service via excessive memory allocation in AMQP decoder | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-92560org.apache.qpid/qpid-broker-plugins-amqp-0-10-protocol: Apache Qpid Broker-J: Denial of Service via excessive memory allocation in AMQP 0-10 decoder | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-92564org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol: Apache Qpid Broker-J: Denial of Service via unbounded type nesting | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-89091ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-92609apache-qpid-broker-j: org.apache.qpid/qpid-broker-plugins-management-http: Apache Qpid Broker-J: Unauthorized management session access via session fixation | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-67409rabbitmq-server: rabbitmq-server: Authentication Denial of Service via unvalidated JWKS HTTP response status codes | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-67410rabbitmq-server: rabbitmq-server: Sensitive credential disclosure via unauthenticated JavaScript endpoint | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-97528kernel: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-10758lerc: lerc: Denial of Service via heap-based out-of-bounds write | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-89032litellm: LiteLLM: Information disclosure via semantic cache metadata mismatch | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-95832kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-97602kernel: inet: frags: invalidate queues before flushing them | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-97941kernel: mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-98116kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF | Red Hat | Important | 1 | 2026-09-25 |
| CVE-2026-97417kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() | Red Hat | Important | 1 | 2026-09-24 |
| CVE-2026-97057redis-parser: redis-parser: Denial of Service via invalid RESP protocol array length | Red Hat | Important | 1 | 2026-09-24 |
| CVE-2026-93787kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir | Red Hat | Important | 1 | 2026-09-24 |
| CVE-2026-90959pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft | Red Hat | Important | 1 | 2026-09-24 |
| CVE-2026-67233rabbitmq-server: RabbitMQ: Privilege escalation allows monitoring users to delete shovels | Red Hat | Important | 1 | 2026-09-24 |
| CVE-2026-57178social-auth-core: social-auth-core: Authentication bypass via missing signature verification in VK App backend | Red Hat | Important | 1 | 2026-09-24 |
| CVE-2026-93827kernel: virtio-fs: avoid double-free on failed queue setup | Red Hat | Important | 1 | 2026-09-24 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.