Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
1,031 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-84644automation-controller-container: automation-controller: automation-controller: server-side request forgery via the Thycotic Secret Server external credential plugin test endpoint (caller-controlled server_url, backend executed in the controller web process) | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84678automation-controller: automation-controller-container: automation-controller: GALAXY_TASK_ENV setting is not filtered for dynamic-linker / interpreter environment variables, allowing a system administrator to achieve code execution in the project-update execution environment | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84686automation-controller: automation-controller-container: automation-controller: notification template password fields can be decrypted by a notification-template administrator by replaying encrypted values across subfields, exposing plaintext Slack, PagerDuty, Twilio, AWS SNS and Grafana credentials | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84689automation-controller: automation-controller-container: automation-controller: bulk job launch allows setting a workflow node's job reference to an arbitrary unified job, enabling a low-privileged user to cancel and read metadata of jobs in other organizations | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84692automation-controller: automation-controller-container: automation-controller: workflow job template node execute permission check bypassed by creating a node with a null unified_job_template and then patching it, allowing a single workflow-admin to execute any other tenant's job template with the victim's credentials (cross-tenant privilege escalation) | Red Hat | Important | 1 | 2026-09-23 |
| CVE-2026-84708automation-controller: automation-controller-container: automation-controller: container group pod_spec_override mints the automation-controller ServiceAccount token and mounts control-plane namespace secrets into job pods, bypassing automountServiceAccountToken:false (control-plane secret and identity compromise) | Red Hat | Important | 1 | 2026-09-23 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.