Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
1,031 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-87114kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-94286libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-88815perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-102272pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-102266pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-102271pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-102273pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-102267pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-74246quay: Local file inclusion via file:// scheme in Quay custom build trigger | Red Hat | Important | 1 | 2026-09-28 |
| CVE-2026-100721vm2: vm2 before 3.12.2 Authorization Bypass via Custom Resolver | Red Hat | Critical | 1 | 2026-09-27 |
| CVE-2026-100723vm2: vm2: Information disclosure via zlib shared buffer pool | Red Hat | Important | 1 | 2026-09-27 |
| CVE-2026-101044pnpm: pnpm: Arbitrary file creation outside project directory via lockfile path traversal | Red Hat | Important | 1 | 2026-09-27 |
| CVE-2026-101043pnpm: pnpm: Information disclosure via environment variable expansion in proxy settings | Red Hat | Important | 1 | 2026-09-27 |
| CVE-2026-100650vllm: vLLM: Denial of Service via unbounded media ingestion | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100706github.com/kyverno/kyverno: kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100660io.netty/netty-codec-http3: netty-codec-http3: Denial of Service via unbounded QPACK encoder memory retention | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100652vllm: vLLM: Denial of Service via out-of-bounds stop token IDs | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100662io.netty/netty-codec-http3: netty-codec-http3: Denial of Service via unbounded memory allocation in QPACK stream decoder | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100661io.netty/netty-codec-http3: Netty: Denial of Service via unbounded accumulation in QPACK integer decoder | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100664io.netty/netty-codec-http3: Netty: Security bypass via HTTP Host header authority confusion | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100663io.netty/netty-codec-http3: netty-codec-http3: Security policy bypass via improper HTTP/1 to HTTP/3 CONNECT request translation | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100665io.netty/netty-codec-classes-quic: io.netty/netty-codec-quic: netty: Hostname verification bypass via incomplete QUIC certificate validation | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100700nodemailer: nodemailer: Denial of Service via regular expression backtracking in addressparser | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100666io.netty/netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec | Red Hat | Important | 1 | 2026-09-26 |
| CVE-2026-100705github.com/kyverno/kyverno: Kyverno: Server-Side Request Forgery via legacy API call executor | Red Hat | Important | 1 | 2026-09-26 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.