Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
1,031 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-97185gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file | Red Hat | Important | 1 | 2026-09-24 |
| CVE-2026-93817kernel: perf: Fix addr_filter_ranges lifetime | Red Hat | Important | 1 | 2026-09-24 |
| CVE-2026-93288kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state | Red Hat | Important | 1 | 2026-09-24 |
| CVE-2026-84474automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and X-Forwarded-For spoofing of provisioning-callback host match | Red Hat | Critical | 1 | 2026-09-23 |
| CVE-2026-94422xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84502automation-controller: automation-controller-container: automation-controller: Project scm_url argument injection into `git ls-remote --upload-pack` yields RCE on the controller-task control-plane pod | Red Hat | Critical | 1 | 2026-09-23 |
| CVE-2026-86243tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-77791tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-75887openshift/console: openshift/console: Unauthenticated path traversal in i18n locale handler | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84486automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (AllowAny, routed without DEBUG guard) allow advisory-lock starvation of job dispatch (DoS) | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-63132OpenBao: OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-77422org.jline/jline: JLine: Denial of Service via regular expression processing in built-in grep command | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-89425com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-91777com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-91776jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-85475automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via LOG_AGGREGATOR_* settings leads to remote code execution in the control-plane rsyslog component | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84719automation-controller: automation-controller: WorkflowJobTemplate /copy/ deep-copy sanitizer omits instance_groups authorization (InstanceGroup use_role bypass to control-plane) | Red Hat | Critical | 1 | 2026-09-23 |
| CVE-2026-96804mlflow: MLflow: Arbitrary Code Execution via Insecure Deserialization | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-75884awx: awx: Privilege escalation to OpenShift namespace via pod_spec_override injection in container groups | Red Hat | Critical | 1 | 2026-09-23 |
| CVE-2026-6668pgbouncer: PgBouncer: Denial of Service via integer overflow in packet buffer growth | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-67232rabbitmq: rabbitmq_web_mqtt: RabbitMQ Web-MQTT plugin: Denial of Service via decompression bomb | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-19888pgbouncer: PgBouncer: Denial of Service via malformed SCRAM client-final-message | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-76183tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-77423org.jline/jline: JLine: Denial of Service via user-controlled regular expressions | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-96775mlflow: MLflow dspy: Arbitrary code execution via crafted MLmodel artifact | Red Hat | Important | 1 | 2026-09-23 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.