Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
998 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-112397pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-80344org.apache.camel/camel-as2: Apache Camel AS2: Server-Side Request Forgery via unvalidated receipt destination | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-111064aiohttp: aiohttp: Denial of Service via missing initial request timeout | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-111066aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112391pillow: Pillow: Denial of Service via unbounded recursion in PDF parser | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112390pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112366picomatch: picomatch: Denial of Service via single-branch repeated extglob patterns | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112075unsloth: unsloth: Arbitrary code execution via unsafe class selection | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-88900org.apache.camel/camel-jgroups: camel-jgroups: Arbitrary code execution via untrusted data deserialization | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-103314stackrox: stackrox: SAML response replay allows multiple Central authentication tokens | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112897pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112896pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112895pillow: pillow: Denial of service via crafted PDF during append operations | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112894pillow: pillow: Denial of Service via crafted multi-frame image conversion | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112893pillow: Pillow: Denial of Service via invalid pointer free during font rendering | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112892pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112406pillow: pillow: Denial of Service via infinite loop during PDF page rewriting | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112405pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112404pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112392pillow: pillow: Denial of Service via zero-size images in rank filters | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112400pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112399pillow: pillow: Denial of service via crafted APNG image | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-112307sqlparse: sqlparse: Arbitrary code execution via unescaped PHP output formatting | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-110522oc-mirror: oc-mirror: execution of unsigned opm binary extracted from catalog image in v1 cache rebuild | Red Hat | Important | 1 | 2026-10-19 |
| CVE-2026-98532kernel: ipv6: do not let ipv6_find_hdr() return an offset past the packet end | Red Hat | Important | 1 | 2026-10-18 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.