Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
1,031 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-78383tomcat: Apache Tomcat: Denial of Service via AJP request | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-66070rabbitmq-server: RabbitMQ: Cross-Origin Resource Sharing (CORS) misconfiguration allows unauthorized actions | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-88830busybox: busybox: TLS Montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-75886openshift/console: openshift/console: Unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-66079rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-86350tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84706automation-controller: automation-controller-container: automation-controller: Credential Type env-injector deny-list omits process-hijacking variables (BASH_ENV/LD_PRELOAD) allowing code execution in the execution environment | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84714automation-controller: automation-controller: incomplete sanitize_jinja() regex allows Jinja template injection into ad-hoc module_args, Machine-credential fields, and Host names, reaching ansible-core templating in the execution environment | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84683automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout HTML view via ANSI OSC 8 hyperlink sequences (javascript: anchor) enabling session takeover | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-67231rabbitmq: rabbitmq-server: RabbitMQ: Trust-store whitelist by Issuer+Serial only | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-96577oc-mirror__release-4.21: Embedded local cache registry listens on all interfaces without authentication, with delete enabled | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-42801ASR Crane: Falcon: as_rrc: 3g.mod: ASR Crane, Falcon: NULL pointer dereference allows pointer manipulation | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-67404rabbitmq-server: rabbitmq-server: OAuth2 silent verify_none fallback for JWKS fetch | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-96889librsvg: Use-after-free when XML includes have duplicated entities | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84691automation-controller: automation-controller-container: automation-controller: format string injection in the API 4XX error log setting discloses Django SECRET_KEY and database credentials to an administrator | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-66077RabbitMQ: RabbitMQ: Account takeover via stored Cross-Site Scripting in TLS peer-certificate DN | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-96512sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-88832busybox: busybox: romfs volume ID parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-96808flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-67405rabbitmq-server: RabbitMQ: Cross-Site WebSocket Hijacking via missing Origin header validation | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84638automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) instance groups and privilege escalation to control-plane code execution | Red Hat | Critical | 1 | 2026-09-23 |
| CVE-2026-84684automation-controller: automation-controller-container: automation-controller: constructed inventory input inventory attachment checks only read permission on the source inventory, allowing a read-only user to clone another tenant's hosts and secrets and run ad hoc commands against them | Red Hat | Critical | 1 | 2026-09-23 |
| CVE-2026-84711automation-controller: automation-controller: Project scm_branch/scm_refspec argument injection into git during project sync allows arbitrary file read on the sync host (control-plane ServiceAccount token, SECRET_KEY, and DB credentials on control-plane deployments) leading to full AAP and Kubernetes-namespace compromise | Red Hat | Critical | 1 | 2026-09-23 |
| CVE-2026-84679automation-controller: automation-controller-container: automation-controller: the AWX_TASK_ENV setting applies arbitrary environment variables to the control-plane web and task processes, enabling TLS interception of external credentials and code execution | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84475automation-controller: automation-controller-container: automation-controller: InventorySource.source_vars lacks prevent_search, enabling zero-privilege cross-tenant extraction of inline inventory-plugin credentials via the credential_types FieldLookupBackend count-oracle | Red Hat | Important | 1 | 2026-09-23 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.