Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Linux distribution advisories
1,031 from Debian, Red Hat, UbuntuThe Adobe feed did not respond at the last check. Other sources loaded.
| Advisory · title | Source | Severity | CVEs | Date ↓ |
|---|---|---|---|---|
| CVE-2026-110354haproxy: haproxy: Denial of Service via specially crafted HTTP/1.1 chunked request | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-110353haproxy: HAProxy: Denial of Service via truncated HTTP/2 PING frame | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-75508graphql-core: graphql-core: Denial of Service via token limit bypass using comments | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-75507graphql-core: graphql-core: Denial of Service via nested inline fragments during query validation | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-111497brotli: Out-of-Bounds Write in Google Brotli Decoder | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-92709rsyslog: rsyslog: Path traversal via unsanitized dynaFile templates | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-113872multer: multer: Denial of Service via aborted request during asynchronous file filtering | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-115347mistune: mistune: Denial of Service via unmatched square brackets | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-115355mistune: mistune: Arbitrary file read via path traversal in Include directive | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-111181body-parser: body-parser: Denial of Service via unhandled decompression stream error | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-94482next: Next.js: Denial of Service via crafted requests targeting Server Actions | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-115352mistune: mistune: Denial of Service via unmatched brackets in inline link parser | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-115348mistune: mistune: Denial of Service via unbalanced brackets in link parser | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-115349mistune: mistune: Denial of Service via deeply nested square brackets | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-114613msgpack: msgpack: Denial of Service via memory leak during map deserialization | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-114605dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-114727roundcubemail: roundcubemail: Arbitrary code execution via unsafe image resizing | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-114730roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-111079goose: goose: Shell History and Environment Leak via Terminal Integration | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-114616authlib: authlib: Authentication bypass via zero-length HMAC key | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-112085webpack-dev-server: webpack-dev-server: unauthorized backend access via unvalidated WebSocket proxy requests | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-114663vyper: Vyper: Contract logic corruption via improper name resolution of imported constants | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-115504cfitsio: cfitsio: arbitrary code execution via crafted FITS file | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-114615authlib: Authlib: Authentication bypass via improper asymmetric key validation | Red Hat | Important | 1 | 2026-10-22 |
| CVE-2026-109618php: OOM bailout during request parsing leads to memory corruption and RCE | Red Hat | Important | 1 | 2026-10-21 |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.