Security intelligence · 2026 watch
Find advisories for the products you manage. A severity rating, evidence of exploitation, and proof that your own system is affected are different things; check each before deciding what to do.
Source snapshotReviewed October 12, 2026 at 16:20 UTCCISA KEV catalog: 2026.10.08Curated guidance—not a complete vulnerability inventory
240 current watch groups255 CISA KEV additions in 2026798 searchable 2026 and established records125 official source endpoints monitored
Current watch
Check the product, release, role, configuration, and exposure against the current official advisory. The remediation listed below is a source snapshot, not a command to run or proof that your system is affected. After a change, check service behavior and retain the result with your change record.
hexpm · hex_core default hex_http_httpc adapter
GHSA-p26c-h8c2-rwqj / CVE-2026-103502 · 1 CVE — hex_core 0.20.0 Restores TLS Certificate ValidationRecorded remediation: hex_core 0.20.0; supported workarounds include explicit certificate-verifying SSL options, another HTTP adapter, or OTP 26 or later
Medium · exploitation not stated
Ubuntu · Google Guest Agent and Google OS Config Agent on Ubuntu 22.04 LTS
USN-8914-1 · 1 CVE — Ubuntu Google Guest Agents Fix Hostname-Validation BypassRecorded remediation: jammy: google-guest-agent 20250116.00-0ubuntu1~22.04.4 / jammy: google-osconfig-agent 20251028.00-0ubuntu2~22.04.1
Not provided by the authority · exploitation not stated
Red Hat · python-tornado on RHEL 10.0 Extended Update Support
RHSA-2026:80741 · 3 CVEs — Red Hat Python Tornado Update Addresses Three High-Severity FlawsRecorded remediation: python-tornado 6.5.8-0.el10_0.1
High · exploitation not stated
Red Hat · Goose database migration tooling on RHEL 9.8 EUS and RHEL 10.2
RHSA-2026:80764 / RHSA-2026:80765 · 4 CVEs — Red Hat Goose Updates Address Four High-Severity VulnerabilitiesRecorded remediation: goose 1.45.0-1.el9_8 or 1.45.0-1.el10_2 for the matching branch
High · exploitation not stated
Ubuntu · libx11 on supported Ubuntu LTS and ESM releases
USN-8913-1 · 4 CVEs — Ubuntu libX11 Updates Address Four VulnerabilitiesRecorded remediation: bionic: libx11 2:1.6.4-3ubuntu0.4+esm3 / focal: libx11 2:1.6.9-2ubuntu1.6+esm1 / jammy: libx11 2:1.7.5-1ubuntu0.4 / noble: libx11 2:1.8.7-1ubuntu0.1 / resolute: libx11 2:1.8.13-1ubuntu0.1 / trusty: libx11 2:1.6.2-1ubuntu2.1+esm6 / xenial: libx11 2:1.6.3-1ubuntu2.2+esm5
Not provided by the authority · exploitation not stated
Ash Project · ash_typescript RPC endpoints
GHSA-7gxc-w225-f7f3 / CVE-2026-105283 · 1 CVE — ash_typescript 0.19.1 Redacts Internal RPC Error DetailsRecorded remediation: ash_typescript 0.19.1
Medium · exploitation not stated
Red Hat · environment-modules on RHEL 10.2
RHSA-2026:80664 · 1 CVE — Red Hat Environment Modules Update Addresses CVE-2026-85013Recorded remediation: environment-modules 5.6.1-2.el10_2.1
High · exploitation not stated
Red Hat · libxml2 on RHEL 8.10 Extended Update Support
RHSA-2026:80675 · 1 CVE — Red Hat libxml2 Update Fixes CVE-2026-86142Recorded remediation: libxml2 2.9.7-21.el8_10.10
Medium · exploitation not stated
Red Hat · tftp and tftp-server on RHEL 9.8 Extended Update Support
RHSA-2026:80663 · 1 CVE — Red Hat TFTP Update Addresses CVE-2026-85234Recorded remediation: tftp and tftp-server 5.2-40.el9_8.1
High · exploitation not stated
Red Hat · cjose on RHEL 10.2
RHSA-2026:80605 · 1 CVE — Red Hat cjose Update Fixes Critical RHEL 10 VulnerabilityRecorded remediation: cjose 0.6.2.2-7.el10_2.2
Critical · exploitation not stated
OTRS · OTRS and OTRS Community Edition where each OSA applies
OSA-2026-10 / OSA-2026-11 / OSA-2026-12 / OSA-2026-13 / OSA-2026-14 / OSA-2026-15 / OSA-2026-16 / OSA-2026-17 / OSA-2026-18 · 9 CVEs — OTRS 2026.7.1 Addresses Nine Security VulnerabilitiesRecorded remediation: OTRS 2026.7.1 or later; OSA-2026-18 also states OTRS 7.x and later are fixed
Medium to Critical · exploitation not stated
Dassault Systèmes · Tuleap Enterprise Edition 17.0 through 17.5
CVE-2026-105407 / CVE-2026-105408 / CVE-2026-105409 / CVE-2026-105410 / CVE-2026-105411 / CVE-2026-105412 · 6 CVEs — Dassault Systèmes Publishes Six Tuleap Enterprise Security AdvisoriesRecorded remediation: The public advisories direct customers to Dassault Systèmes remediation information but do not state public fixed-build numbers; obtain the supported fixed build through the vendor channel
High · exploitation not stated
Red Hat · curl and libcurl on RHEL 9.8 Extended Update Support
RHSA-2026:80511 · 2 CVEs — Red Hat Updates curl and libcurl on RHEL 9.8 EUSRecorded remediation: curl and libcurl 7.76.1-40.el9_8.8
Medium · exploitation not stated
Red Hat · Flatpak on RHEL 10.2
RHSA-2026:80498 · 4 CVEs — Red Hat Flatpak Update Addresses Four RHEL 10 VulnerabilitiesRecorded remediation: flatpak 1.16.0-9.el10_2.4 and the matching advisory-listed packages
High · exploitation not stated
Red Hat · flatpak-builder on RHEL 10.2 and RHEL 9.8 Extended Update Support
RHSA-2026:80495 / RHSA-2026:80496 · 1 CVE — Red Hat Flatpak Builder Updates Fix CVE-2026-86320Recorded remediation: flatpak-builder 1.4.4-1.el10_2.1 or 1.2.3-1.el9_8.1 for the matching entitled branch
High · exploitation not stated
Red Hat · GIMP on RHEL 9.4 Extended Update Support
RHSA-2026:80509 · 13 CVEs — Red Hat GIMP Update Addresses Thirteen RHEL 9 VulnerabilitiesRecorded remediation: gimp 2.99.8-4.el9_4.19 and the matching advisory-listed packages
High · exploitation not stated
Thelia · Thelia 2.6.0 and 2.6.1
VU#162329 · 11 CVEs — CERT/CC Warns of Eleven Vulnerabilities in Thelia 2.6.0 and 2.6.1Recorded remediation: No patch was available when CERT/CC published revision 1; apply the authority's access restrictions and hardening measures while obtaining supported vendor remediation
Not provided by the authority · exploitation not stated
GitLab · GitLab Community Edition and Enterprise Edition
GitLab Critical Patch Release 19.4.2 / 19.3.4 / 19.2.8 · 24 CVEs — GitLab Critical Patch Release Fixes 24 Security VulnerabilitiesRecorded remediation: GitLab 19.2.8, 19.3.4, or 19.4.2 for the matching supported branch; account for the documented 19.3.4 Ona merge-request-page issue and planned 19.3.5 follow-up
Low to Critical · exploitation not stated
Bosch Rexroth · Bosch Rexroth PRI7000 engineering software
BOSCH-SA-069646 · 1 CVE — Bosch Rexroth PRI7000 Updates Bundled 7-Zip for CVE-2026-14266Recorded remediation: PRI7000 1.11.17.3, 1.11.18.3, or 1.11.19.1 or later for the matching branch
High · exploitation not stated
nginx-modules · ngx_cache_purge for NGINX
ngx_cache_purge 3.0.4 / CVE-2026-108981 · 1 CVE — ngx_cache_purge 3.0.4 Restricts Symlink TraversalRecorded remediation: ngx_cache_purge 3.0.4 for symlinks created at an arbitrary earlier time; the authority says an applicable TOCTOU race remains
Low · exploitation not stated
Zephyr Project · Zephyr RTOS ESP32 I2S and Bluetooth host or controller components
GHSA-5g9q-h8wq-rrf3 / GHSA-6gp4-cwf7-2vp8 / GHSA-6mcj-5jw8-ff36 / GHSA-84v8-vgp5-4vc9 / GHSA-rgw4-3qr8-pp36 · 5 CVEs — Zephyr Discloses Five Embedded and Bluetooth Availability FlawsRecorded remediation: Project fixes merged on applicable branches; Zephyr 4.5.0 is projected but was not released when verified, so confirm each advisory's current branch and backport status
Medium to High · exploitation not stated
Decimal Project · Decimal for Elixir
GHSA-6c27-994x-c52f / CVE-2026-97853 / Decimal 3.1.2 · 1 CVE — Decimal 3.1.2 Fixes Unbounded Rounding AllocationRecorded remediation: Decimal 3.1.2 or later
Medium · exploitation not stated
Apache Software Foundation · Apache DataSketches C++
CVE-2026-103501 / CVE-2026-103513 / CVE-2026-103634 / CVE-2026-103635 / CVE-2026-103636 / Apache DataSketches C++ 5.3.0 · 5 CVEs — Apache DataSketches C++ 5.3.0 Hardens Five Deserialization PathsRecorded remediation: Apache DataSketches C++ 5.3.0 or later
Low to Moderate · exploitation not stated
ZTE · ZTE Z80 Ultra, product identifier NX741J
SA-202610-1743956 / SA-202610-1743919 / SA-202610-1743926 / SA-202610-1743952 / SA-202610-1743906 · 5 CVEs — ZTE Z80 Ultra Build B28MR2 Fixes Five Information-Disclosure FlawsRecorded remediation: GEN_ZTE_PQ85A01V1.0.0B28MR2, obtained through the ZTE Global Customer Support Center
Low to Medium · exploitation not stated
Red Hat · Red Hat Hardened Images opentelemetry-collector-contrib RPM on aarch64 and x86_64
RHSA-2026:80217 · 2 CVEs — Red Hat Hardened Images Update OpenTelemetry Collector for AMQP Denial of ServiceRecorded remediation: opentelemetry-collector-contrib 0.162.0-0.2.hum1 for aarch64 or x86_64, using supported Red Hat Hardened Images content
Medium to High · exploitation not stated
Red Hat · Red Hat Hardened Images poppler RPM family on aarch64 and x86_64
RHSA-2026:80172 · 1 CVE — Red Hat Hardened Images Update Poppler for PDF Decryption OverflowRecorded remediation: the advisory-listed poppler RPM family at 26.08.0-1.3.hum1 for aarch64 or x86_64, using supported Red Hat Hardened Images content
Medium · exploitation not stated
Amazon Web Services · AWS Amplify API Category packages for SQL-backed GraphQL models
2026-133-AWS · 1 CVE — AWS Amplify Updates Fix Cross-Owner GraphQL Record AccessRecorded remediation: @aws-amplify/graphql-index-transformer 3.1.2, @aws-amplify/graphql-api-construct 1.21.4, and @aws-amplify/data-construct 1.17.4 or later, followed by backend redeployment
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel packages on Ubuntu 24.04 LTS (noble)
USN-8911-1 · 29 CVEs — Ubuntu OEM Kernel Update Addresses 29 VulnerabilitiesRecorded remediation: noble: linux-oem-6.17 6.17.0-1033.33
Not provided by the authority · exploitation not stated
Red Hat · RHEL 9.6 EUS standard, 64k, real-time, and NFV kernel package relationships listed by the advisory
RHSA-2026:79784 · 1 CVE — Red Hat RHEL 9.6 EUS Kernel Update Fixes CVE-2026-74705Recorded remediation: kernel 5.14.0-570.148.1.el9_6 and the matching advisory-listed packages, followed by a controlled reboot
High · exploitation not stated
Red Hat · RHEL 8.8 Update Services for SAP Solutions and Telecommunications Update Service kernel packages
RHSA-2026:79782 · 2 CVEs — Red Hat RHEL 8.8 SAP and TUS Kernel Update Fixes Two VulnerabilitiesRecorded remediation: kernel 4.18.0-477.174.1.el8_8 and the matching advisory-listed packages, followed by a controlled reboot
High · exploitation not stated
Red Hat · RHEL 8.6 Advanced Mission Critical Update Support and RHEL 8.6 EUS Long Life kernel packages
RHSA-2026:79783 · 3 CVEs — Red Hat RHEL 8.6 AUS and EUS Kernel Update Addresses Three VulnerabilitiesRecorded remediation: kernel 4.18.0-372.221.1.el8_6 and the matching advisory-listed packages, followed by a controlled reboot
High · exploitation not stated
Xen Project · Linux guests using Xen xen-netfront with a potentially untrusted network backend
XSA-522 · 1 CVE — Xen XSA-522 Patch Prevents Network Backend Guest CrashesRecorded remediation: Apply the Xen Project xsa522-linux.patch or the corresponding supported Linux distribution update
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel packages on Ubuntu 24.04 LTS (noble)
USN-8887-3 · 1050 CVEs — Ubuntu 7.0 Kernel Updates Address 1,050 VulnerabilitiesRecorded remediation: noble: linux-gcp-7.0 7.0.0-1014.14~24.04.1 / noble: linux-hwe-7.0 7.0.0-38.38~24.04.4 / noble: linux-oracle-7.0 7.0.0-1013.13~24.04.1
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel packages on Ubuntu 22.04 LTS (jammy)
USN-8875-2 · 951 CVEs — Ubuntu NVIDIA Kernel Update Addresses 951 VulnerabilitiesRecorded remediation: jammy: linux-nvidia 5.15.0-1112.113
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel packages on Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy)
USN-8903-2 · 232 CVEs — Ubuntu Kernel Updates Address 232 VulnerabilitiesRecorded remediation: jammy: linux-lowlatency-hwe-6.8 6.8.0-146.146.1~22.04.1 / jammy: linux-nvidia-6.8 6.8.0-1064.67~22.04.1 / noble: linux-gke 6.8.0-1065.73 / noble: linux-gkeop 6.8.0-1051.55 / noble: linux-ibm 6.8.0-1066.67 / noble: linux-lowlatency 6.8.0-146.146.1 / noble: linux-nvidia 6.8.0-1064.67 / noble: linux-nvidia-lowlatency 6.8.0-1064.67.1 / noble: linux-oracle 6.8.0-1063.66
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel packages on Ubuntu 24.04 LTS (noble)
USN-8905-2 · 233 CVEs — Ubuntu GCP Kernel Update Addresses 233 VulnerabilitiesRecorded remediation: noble: linux-gcp 6.8.0-1070.78
Not provided by the authority · exploitation not stated
Red Hat · RHEL 8.4 Advanced Mission Critical Update Support and RHEL 8.4 EUS Long Life kernel packages
RHSA-2026:79778 · 2 CVEs — Red Hat RHEL 8.4 AUS and EUS Kernel Update Fixes Two VulnerabilitiesRecorded remediation: kernel 4.18.0-305.213.1.el8_4 and the matching advisory-listed packages, followed by a controlled reboot
High · exploitation not stated
MongoDB · MongoDB Ops Manager 7.0 and 8.0
CVE-2026-87108 / CVE-2026-87109 / CVE-2026-87110 · 3 CVEs — MongoDB Ops Manager 8.0.27 Fixes Three Authorization and Availability VulnerabilitiesRecorded remediation: Ops Manager 8.0.27 or later; obtain supported vendor direction for affected 7.0 deployments because the authority does not identify a fixed 7.0 build
Low to Medium · exploitation not stated
Red Hat · gzip RPM content in Red Hat Hardened Images
RHSA-2026:79717 · 2 CVEs — Red Hat Hardened Images gzip Update Fixes Two VulnerabilitiesRecorded remediation: gzip 1.15-1.hum1 for the advisory-listed Red Hat Hardened Images architectures
Low to Medium · exploitation not stated
Red Hat · Red Hat Advanced Cluster Security for Kubernetes 4.11
RHSA-2026:79575 · 2 CVEs — Red Hat Advanced Cluster Security 4.11.5 Fixes Two VulnerabilitiesRecorded remediation: Red Hat Advanced Cluster Security for Kubernetes 4.11.5 using the exact advisory-listed immutable image digests
High · exploitation not stated
Red Hat · Red Hat Quay 3.12 container images
RHSA-2026:79546 · 14 CVEs — Red Hat Quay 3.12.23 Addresses Fourteen VulnerabilitiesRecorded remediation: Red Hat Quay 3.12.23 using the exact advisory-listed immutable image digests
Medium to High · exploitation not stated
Red Hat · Red Hat OpenShift Container Platform 4.14 RHCOS and package content
RHSA-2026:73866 / RHSA-2026:73864 · 8 CVEs — Red Hat OpenShift 4.14.75 Updates Address Eight VulnerabilitiesRecorded remediation: OpenShift Container Platform 4.14.75 with the exact RHCOS builds and packages listed by both advisories
Medium to High · exploitation not stated
Red Hat · Red Hat OpenShift Container Platform 4.16 RHCOS content
RHSA-2026:73851 · 3 CVEs — Red Hat OpenShift 4.16.72 RHCOS Update Fixes Three VulnerabilitiesRecorded remediation: OpenShift Container Platform 4.16.72 with the exact RHCOS builds listed by RHSA-2026:73851
High · exploitation not stated
Red Hat · RHEL 9 glibc packages
RHSA-2026:79281 · 6 CVEs — Red Hat glibc Update Addresses Six RHEL 9 VulnerabilitiesRecorded remediation: glibc 2.34-283.el9_8 and the matching advisory-listed packages
Medium · exploitation not stated
Strapi · Strapi
CISA KEV: CVE-2023-22894 · 1 CVE — CISA Adds Strapi Sensitive-Data Exposure to KEVRecorded remediation: Apply vendor mitigations under CISA BOD 26-04 guidance by 2026-10-11, or discontinue use if mitigations are unavailable
Not provided by the authority · exploitation CISA KEV
ProFTPD · ProFTPD
CISA KEV: CVE-2015-3306 · 1 CVE — CISA Adds ProFTPD Arbitrary File Access to KEVRecorded remediation: Apply vendor mitigations under CISA BOD 26-04 guidance by 2026-10-11, or discontinue use if mitigations are unavailable
Not provided by the authority · exploitation CISA KEV
ONLYOFFICE · ONLYOFFICE Docs
CISA KEV: CVE-2021-3199 · 1 CVE — CISA Adds ONLYOFFICE Docs Path Traversal to KEVRecorded remediation: Apply vendor mitigations under CISA BOD 26-04 guidance by 2026-10-11, or discontinue use if mitigations are unavailable
Not provided by the authority · exploitation CISA KEV
ISC · ISC BIND
CISA KEV: CVE-2015-5477 · 1 CVE — CISA Adds ISC BIND TKEY Denial of Service to KEVRecorded remediation: Apply vendor mitigations under CISA BOD 26-04 guidance by 2026-10-11, or discontinue use if mitigations are unavailable
Not provided by the authority · exploitation CISA KEV
Apache · Apache Struts
CISA KEV: CVE-2016-3081 · 1 CVE — CISA Adds Apache Struts Command Injection to KEVRecorded remediation: Apply vendor mitigations under CISA BOD 26-04 guidance by 2026-10-11, or discontinue use if mitigations are unavailable
Not provided by the authority · exploitation CISA KEV
Ubuntu · libxml2 on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial), Ubuntu 14.04 ESM (trusty)
USN-8910-1 · 6 CVEs — Ubuntu libxml2 Updates Fix Six VulnerabilitiesRecorded remediation: bionic: libxml2 2.9.4+dfsg1-6.1ubuntu1.9+esm9 / focal: libxml2 2.9.10+dfsg-5ubuntu0.20.04.10+esm6 / jammy: libxml2 2.9.13+dfsg-1ubuntu0.14 / noble: libxml2 2.9.14+dfsg-1.3ubuntu3.10 / resolute: libxml2 2.15.2+dfsg-0.1ubuntu0.3 / trusty: libxml2 2.9.1+dfsg1-3ubuntu4.13+esm13 / xenial: libxml2 2.9.3+dfsg1-1ubuntu0.7+esm14
Not provided by the authority · exploitation not stated
Red Hat · RHEL 8 BIND 9.11 packages
RHSA-2026:79162 · 3 CVEs — Red Hat BIND Update Addresses Three RHEL 8 VulnerabilitiesRecorded remediation: bind 9.11.36-16.el8_10.16 and the matching advisory-listed packages
High · exploitation not stated
Amazon Web Services · aws-cdk-lib Docker asset bundling
2026-131-AWS · 1 CVE — AWS CDK 2.267.0 Restricts Symlinks in Docker Asset BundlingRecorded remediation: aws-cdk-lib 2.267.0 or later
Not provided by the authority · exploitation not stated
Red Hat · RHEL 8 kbd packages
RHSA-2026:78951 · 1 CVE — Red Hat kbd Update Fixes CVE-2026-72693 on RHEL 8Recorded remediation: kbd 2.0.4-11.el8_10.1 and the matching advisory-listed packages
High · exploitation not stated
Red Hat · RHEL 8.8 E4S and TUS bind9.16 packages
RHSA-2026:79160 · 8 CVEs — Red Hat BIND 9.16 Update Addresses Eight RHEL 8.8 VulnerabilitiesRecorded remediation: bind9.16 9.16.23-0.14.el8_8.9 and the matching advisory-listed packages
Medium to High · exploitation not stated
Red Hat · Red Hat build of MicroShift 4.20
RHSA-2026:74797 · 5 CVEs — Red Hat MicroShift 4.20.41 Fixes Five VulnerabilitiesRecorded remediation: Red Hat build of MicroShift 4.20.41 and the matching advisory-listed packages
High · exploitation not stated
Amazon Web Services · Amazon Agent Plugins for AWS databases-on-aws plugin
2026-130-AWS · 1 CVE — AWS databases-on-aws 1.7.1 Blocks Agent-Assisted Command InjectionRecorded remediation: databases-on-aws 1.7.1 or later, or pinned repository commit 8b13a503746a4ebb0402b936645163224058bde3 or later
Not provided by the authority · exploitation not stated
Red Hat · RHEL 10 Dovecot packages
RHSA-2026:79371 · 8 CVEs — Red Hat Dovecot Update Addresses Eight RHEL 10 VulnerabilitiesRecorded remediation: dovecot 2.3.21-19.el10_2.8 and the matching advisory-listed packages
High to Critical · exploitation not stated
Red Hat · Red Hat Ansible Automation Platform 2.7 container images
RHSA-2026:79378 · 13 CVEs — Red Hat Ansible Automation Platform 2.7 Addresses Thirteen VulnerabilitiesRecorded remediation: Red Hat Ansible Automation Platform 2.7 at the exact advisory-listed immutable image digests
High to Critical · exploitation not stated
Red Hat · Red Hat Satellite 6.18 IOP VMAAS, remediations, insights-engine, and vulnerability-engine container images
RHSA-2026:79376 / RHSA-2026:79377 / RHSA-2026:79379 / RHSA-2026:79380 · 4 CVEs — Red Hat Satellite 6.18 IOP Containers Address Three VulnerabilitiesRecorded remediation: the exact Satellite 6.18 immutable image digests listed by all four advisories
High · exploitation not stated
Amazon Web Services · AWS Toolkit for Visual Studio Code CodeCatalyst connection handling
2026-129-AWS · 1 CVE — AWS Toolkit for VS Code 4.10.0 Secures Cached CodeCatalyst TokensRecorded remediation: AWS Toolkit for Visual Studio Code 4.10.0 or later
Not provided by the authority · exploitation not stated
Red Hat · Red Hat Satellite 6.19 IOP VMAAS and vulnerability-engine container images
RHSA-2026:79372 / RHSA-2026:79373 · 1 CVE — Red Hat Satellite 6.19 IOP Containers Fix CVE-2026-78677Recorded remediation: the exact Satellite 6.19 satellite/iop-vmaas-rhel9 and satellite/iop-vulnerability-engine-rhel9 image digests listed by both advisories
High · exploitation not stated
Ubuntu · libde265 on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial)
USN-8909-1 · 1 CVE — Ubuntu libde265 Update Fixes CVE-2026-88373Recorded remediation: bionic: libde265 1.0.2-2ubuntu0.18.04.1~esm7 / focal: libde265 1.0.4-1ubuntu0.4+esm3 / jammy: libde265 1.0.8-1ubuntu0.3+esm3 / noble: libde265 1.0.15-1ubuntu0.2 / resolute: libde265 1.0.16-1ubuntu0.1~esm2 / xenial: libde265 1.0.2-2ubuntu0.16.04.1~esm7
Not provided by the authority · exploitation not stated
Red Hat · RHEL 9 kernel, real-time kernel, and NFV kernel packages on the advisory-listed channels
RHSA-2026:76739 · 38 CVEs — Red Hat RHEL 9 Kernel Update Addresses 38 VulnerabilitiesRecorded remediation: kernel 5.14.0-687.55.1.el9_8 and the matching advisory-listed packages, followed by a controlled reboot
Medium to High · exploitation not stated
Red Hat · Red Hat OpenShift distributed tracing platform (Tempo) 3.11
RHSA-2026:79368 · 4 CVEs — Red Hat OpenShift Tempo 3.11.2 Fixes Four VulnerabilitiesRecorded remediation: Red Hat OpenShift distributed tracing platform 3.11.2 using the exact advisory-listed immutable image digests
High · exploitation not stated
Red Hat · RHEL 9.8 kernel, real-time kernel, and NFV kernel packages on the advisory-listed channels
RHSA-2026:77689 · 14 CVEs — Red Hat RHEL 9.8 Kernel Update Addresses Fourteen VulnerabilitiesRecorded remediation: kernel 5.14.0-687.56.1.el9_8 and the matching advisory-listed packages, followed by a controlled reboot
Medium to High · exploitation not stated
HashiCorp · HashiCorp go-getter 1.x and go-getter/v2 directory downloads from Amazon S3 or Google Cloud Storage
HCSEC-2026-44 · 1 CVE — HashiCorp go-getter Updates Block S3 and GCS Path TraversalRecorded remediation: go-getter 1.8.10 or go-getter/v2 2.2.5
Not provided by the authority · exploitation not stated
Red Hat · Red Hat Directory Server 11.5 E4S for RHEL 8
RHSA-2026:79217 · 8 CVEs — Red Hat Directory Server 11.5 Update Addresses Eight VulnerabilitiesRecorded remediation: 389-ds-base 1.4.3.34-9.module+el8dsrv+24847+c94540a6 and the matching advisory-listed module packages
Medium to Critical · exploitation not stated
Red Hat · RHEL 9.2 Update Services for SAP Solutions libxml2 packages
RHSA-2026:79118 · 1 CVE — Red Hat libxml2 Update Fixes CVE-2025-6170 on RHEL 9.2Recorded remediation: libxml2 2.9.13-3.el9_2.12 and the matching advisory-listed packages
Low · exploitation not stated
CISA · Internet-facing enterprise and small-office infrastructure targeted by the CISA-described Integrity Technology Group campaign
AA26-281A · 8 CVEs — CISA AA26-281A: Chinese Government-Linked Campaign Targets Sensitive DataRecorded remediation: Apply current vendor fixes across exposed assets and implement CISA's hardening, identity, monitoring, hunting, and incident-response actions; no single fixed version applies to this campaign advisory
Not provided by the authority · exploitation confirmed
Red Hat · OpenSSL and compatibility packages on supported RHEL 8, RHEL 9, and RHEL 10 streams
RHSA-2026:76918 / RHSA-2026:77396 / RHSA-2026:80510 / RHSA-2026:80514 · 2 CVEs — Red Hat OpenSSL Fixes Expand to RHEL Compatibility PackagesRecorded remediation: openssl 3.5.8-2.el9_8 or 3.5.8-2.el10_2; compat-openssl10 1.0.2o-4.el8_10.4; or compat-openssl11 1.1.1k-5.el9_8.6 for the matching branch
High · exploitation not stated
Red Hat · RHEL 6 Extended Lifecycle Support Extension dracut packages
RHSA-2026:79114 · 2 CVEs — Red Hat dracut Update Addresses Two RHEL 6 ELS VulnerabilitiesRecorded remediation: dracut 004-414.el6_10 and the matching advisory-listed packages
High · exploitation not stated
Red Hat · Red Hat Hardened Images HDF5 and libXtst RPM content
RHSA-2026:79131 / RHSA-2026:79192 · 2 CVEs — Red Hat Hardened Images Updates Address HDF5 and libXtst VulnerabilitiesRecorded remediation: hdf5 2.2.0-0.1.3.hum1 and libXtst 1.2.5-5.1.hum1 with the matching advisory-listed architectures
Medium to High · exploitation not stated
Red Hat · RHEL 8 TFTP packages
RHSA-2026:78952 · 1 CVE — Red Hat TFTP Update Fixes CVE-2026-85234 on RHEL 8Recorded remediation: tftp 5.2-28.el8_10 and the matching advisory-listed packages
High · exploitation not stated
Red Hat · Python 3.14 on RHEL 9 and 10 plus Python 3.12 on RHEL 9
RHSA-2026:77021 / RHSA-2026:77018 / RHSA-2026:77017 · 2 CVEs — Red Hat Python Updates Address Two Vulnerabilities on RHEL 9 and 10Recorded remediation: python3.14 3.14.8-1.el9_8, python3.14 3.14.8-1.el10_2, or python3.12 3.12.15-1.el9_8 for the matching branch
High · exploitation not stated
Red Hat · RHEL 9 nodejs:22 module packages
RHSA-2026:76750 · 2 CVEs — Red Hat Node.js 22 Update Addresses Two RHEL 9 VulnerabilitiesRecorded remediation: nodejs 22.23.2-2.module+el9.8.0+24958+80b2ac6e and the matching advisory-listed module packages
High · exploitation not stated
Red Hat · RHEL 9.6 Extended Update Support standard, real-time, and NFV kernel packages
RHSA-2026:77219 · 16 CVEs — Red Hat RHEL 9.6 EUS Kernel Update Addresses Sixteen VulnerabilitiesRecorded remediation: kernel 5.14.0-570.147.1.el9_6 and the matching advisory-listed packages, followed by a controlled reboot
Medium to High · exploitation not stated
Red Hat · RESTEasy packages on RHEL 9.4 E4S and RHEL 9.6 EUS
RHSA-2026:77297 / RHSA-2026:80505 · 1 CVE — Red Hat RESTEasy Fix Expands Across RHEL 9.4 and 9.6Recorded remediation: resteasy 3.0.26-20.el9_4 or 3.0.26-20.el9_6 for the matching branch
High · exploitation not stated
Red Hat · RHEL 9 OpenTelemetry Collector packages
RHSA-2026:76744 · 1 CVE — Red Hat OpenTelemetry Collector Update Fixes CVE-2026-84445Recorded remediation: opentelemetry-collector 0.158.0-1.el9_8 and the matching advisory-listed packages
High · exploitation not stated
Red Hat · Red Hat Developer Hub 1.10
RHSA-2026:79088 · 56 CVEs — Red Hat Developer Hub 1.10.5 Addresses 56 VulnerabilitiesRecorded remediation: Red Hat Developer Hub 1.10.5 using the five exact advisory-listed image digests
Medium to Critical · exploitation not stated
Red Hat · RHEL 8 standard kernel packages
RHSA-2026:77498 · 3 CVEs — Red Hat RHEL 8 Kernel Update Addresses Three VulnerabilitiesRecorded remediation: kernel 4.18.0-553.172.1.el8_10 and the matching advisory-listed packages, followed by a controlled reboot
High · exploitation not stated
Red Hat · RHEL 9 FreeRDP packages
RHSA-2026:76755 · 6 CVEs — Red Hat FreeRDP Update Addresses Six RHEL 9 VulnerabilitiesRecorded remediation: freerdp 2.11.7-7.el9_8.8 and the matching advisory-listed subpackages
Medium to High · exploitation not stated
Red Hat · RHEL 9 perl-DBI packages
RHSA-2026:76760 · 1 CVE — Red Hat Perl DBI Update Fixes CVE-2026-88815 on RHEL 9Recorded remediation: perl-DBI 1.643-9.el9_8.7 and the matching advisory-listed subpackages
High · exploitation not stated
Red Hat · RHEL 10.0 Extended Update Support standard, real-time, and NFV kernel packages
RHSA-2026:77634 · 10 CVEs — Red Hat RHEL 10 EUS Kernel Update Addresses Ten VulnerabilitiesRecorded remediation: kernel 6.12.0-55.109.1.el10_0 and the matching advisory-listed packages, followed by a controlled reboot
Medium to High · exploitation not stated
Red Hat · Thunderbird 140.15 on RHEL 10.0 EUS and RHEL 9.2, 9.4, and 9.6 extended-support streams
RHSA-2026:77631 / RHSA-2026:77627 / RHSA-2026:77632 / RHSA-2026:80503 · 13 CVEs — Red Hat Thunderbird 140.15 Fixes Expand to RHEL 9.6 EUSRecorded remediation: Thunderbird 140.15.0-1.el10_0, 140.15.0-1.el9_2, 140.15.0-1.el9_4, or 140.15.0-1.el9_6 for the matching branch
Low to High · exploitation not stated
Red Hat · RHEL 7 Extended Lifecycle Support standard and real-time kernel packages
RHSA-2026:78843 / RHSA-2026:78844 · 1 CVE — Red Hat RHEL 7 ELS Kernel Updates Fix CVE-2025-40026Recorded remediation: kernel 3.10.0-1160.165.1.el7 and kernel-rt 3.10.0-1160.165.1.rt56.1317.el7 with the matching advisory-listed packages, followed by a controlled reboot
Medium · exploitation not stated
Red Hat · Red Hat OpenShift Container Platform 4.16
RHSA-2026:73854 / RHSA-2026:73853 · 10 CVEs — Red Hat OpenShift 4.16.72 Security Updates Address Ten VulnerabilitiesRecorded remediation: OpenShift Container Platform 4.16.72 with the exact release images, RHCOS builds, RPMs, and image digests listed by both advisories
High to Critical · exploitation not stated
Red Hat · Red Hat OpenShift Container Platform 4.14
RHSA-2026:73870 / RHSA-2026:73869 · 11 CVEs — Red Hat OpenShift 4.14.75 Security Updates Address Eleven VulnerabilitiesRecorded remediation: OpenShift Container Platform 4.14.75 with the exact release images, RHCOS builds, RPMs, and image digests listed by both advisories
High to Critical · exploitation not stated
Satel · Satel Netco Design communications-network design software
ICSA-26-281-03 · 4 CVEs — CISA ICSA-26-281-03: Satel Netco Design 2.1.7 Fixes Four VulnerabilitiesRecorded remediation: Satel Netco Design 2.1.7 or later
Medium to High · exploitation not publicly reported
Red Lion Controls · Red Lion Controls N-Tron 700 Series industrial Ethernet switches
ICSA-26-281-01 · 7 CVEs — CISA ICSA-26-281-01: Update Red Lion N-Tron 700 Series SwitchesRecorded remediation: N-Tron 700 Series firmware 3.11.1 or later; also follow current Red Lion/HMS bootloader direction because CISA does not state a separate fixed bootloader release
Medium to High · exploitation not publicly reported
Grid Protection Alliance · Grid Protection Alliance openPDC and openHistorian, including published openPDC Docker images
ICSA-26-281-02 · 6 CVEs — CISA ICSA-26-281-02: Patch openPDC and openHistorian OT Data SystemsRecorded remediation: openPDC 2.9.482 or later and openHistorian 2.8.585 or later, plus explicit interface-binding and Modbus firewall validation; CISA states that no fixed published openPDC Docker image is planned
Medium to Critical · exploitation not publicly reported
HashiCorp · Vault Community Edition and Vault Enterprise through 2.1.1 with delegated permissions and specific deny or denied_parameters policy patterns
HCSEC-2026-43 · 1 CVE — HashiCorp Vault Updates Correct Non-Canonical ACL Policy EvaluationRecorded remediation: Vault Community Edition 2.1.2; Vault Enterprise 2.1.2, 1.21.12, 1.20.17, or 1.19.23
Not provided by the authority · exploitation not stated
HashiCorp · Vault Enterprise through 2.1.1 with namespaces
HCSEC-2026-42 · 1 CVE — HashiCorp Vault Enterprise Update Corrects Cross-Namespace ACL ResolutionRecorded remediation: Vault Enterprise 2.1.2, 1.21.12, 1.20.17, or 1.19.23
Not provided by the authority · exploitation not stated
HashiCorp · Vault Community Edition and Vault Enterprise through 2.1.1 using Shamir seals with an external plugin directory
HCSEC-2026-41 · 1 CVE — HashiCorp Vault Updates Block Snapshot-Restored Plugin Code ExecutionRecorded remediation: Vault Community Edition 2.1.2; Vault Enterprise 2.1.2, 1.21.12, 1.20.17, or 1.19.23 on every node and Enterprise secondary
Not provided by the authority · exploitation not stated
HashiCorp · Vault Community Edition and Vault Enterprise 1.14.0 through 2.1.1 with PKI ACME enabled and the sign-verbatim default directory policy
HCSEC-2026-40 · 1 CVE — HashiCorp Vault Updates Prevent Unverified ACME Certificate IdentitiesRecorded remediation: Vault Community Edition 2.1.2; Vault Enterprise 2.1.2, 1.21.12, 1.20.17, or 1.19.23
Not provided by the authority · exploitation not stated
Amazon Web Services · Amazon Athena engine version 3 request handling
2026-128-AWS · 1 CVE — AWS Reports Remediated Athena Cross-Account Metadata ExposureRecorded remediation: AWS service-side remediation completed September 1, 2026; the authority states that no customer action is required
Not provided by the authority · exploitation not stated
Ubuntu · golang-golang-x-net on Ubuntu 22.04 LTS (jammy)
USN-8900-1 · 8 CVEs — Ubuntu Go Networking Update Fixes Eight VulnerabilitiesRecorded remediation: jammy: golang-golang-x-net 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1
Not provided by the authority · exploitation not stated
Google Chrome · ChromeOS devices on the Long Term Support Candidate channel
ChromeOS LTC 150.0.7871.256 · 43 CVEs — Google ChromeOS LTC 150 Update Fixes 43 Security IssuesRecorded remediation: ChromeOS LTC browser version 150.0.7871.256 and platform version 16700.66.0
Not provided by the authority · exploitation not stated
Red Hat · Firefox ESR on RHEL 10.0 Extended Update Support
RHSA-2026:77610 · 10 CVEs — Red Hat Firefox 140.15 Update Addresses Ten RHEL 10 VulnerabilitiesRecorded remediation: firefox 140.15.0-1.el10_0 for the matching entitled RHEL 10.0 EUS architecture
Medium to High · exploitation not stated
Red Hat · Red Hat JBoss Web Server 7.0 on RHEL 8, 9, and 10
RHSA-2026:76952 · 11 CVEs — Red Hat JBoss Web Server 7.0.2 Addresses Eleven Tomcat VulnerabilitiesRecorded remediation: Red Hat JBoss Web Server 7.0.2 with jws7-tomcat 11.0.21-7.redhat_00006.1 for the matching RHEL branch
Low to High · exploitation not stated
Red Hat · RHEL 8 Vim packages
RHSA-2026:77359 · 1 CVE — Red Hat Vim Update Fixes Arbitrary Command Execution on RHEL 8Recorded remediation: vim 8.0.1763-32.el8_10 and the matching advisory-listed Vim packages
High · exploitation not stated
Red Hat · RHEL 8 real-time and NFV kernel packages
RHSA-2026:77500 · 3 CVEs — Red Hat Real-Time Kernel Update Addresses Three RHEL 8 VulnerabilitiesRecorded remediation: kernel-rt 4.18.0-553.172.1.rt7.513.el8_10 and the matching advisory-listed packages, followed by a controlled reboot
High · exploitation not stated
Ubuntu · Canonical Livepatch kernel variants listed in LSN-0122-1 for Ubuntu 26.04 (resolute) LTS, Ubuntu 24.04 (noble) LTS, Ubuntu 22.04 (jammy) LTS, Ubuntu 20.04 (focal) ESM, Ubuntu 18.04 (bionic) ESM, Ubuntu 16.04 (xenial) ESM
LSN-0122-1 · 150 CVEs — Ubuntu Livepatch 122 Addresses 150 Kernel VulnerabilitiesRecorded remediation: bionic: aws Livepatch 122.1 / bionic: azure-4.15 Livepatch 122.1 / bionic: gcp-4.15 Livepatch 122.1 / bionic: generic-4.15 Livepatch 122.1 / bionic: lowlatency-4.15 Livepatch 122.1 / bionic: generic-5.4 Livepatch 122.1 / bionic: lowlatency-5.4 Livepatch 122.1 / bionic: oracle Livepatch 122.1 / focal: generic-5.4 Livepatch 122.1 / focal: lowlatency-5.4 Livepatch 122.1 / jammy: aws Livepatch 122.4 / jammy: aws-6.8 Livepatch 122.1 / jammy: azure Livepatch 122.4 / jammy: gcp Livepatch 122.4 / jammy: gcp-6.8 Livepatch 122.1 / jammy: linux Livepatch 122.4 / jammy: linux Livepatch 122.4 / jammy: hwe-6.8 Livepatch 122.2 / jammy: gke Livepatch 122.4 / jammy: ibm Livepatch 122.4 / jammy: ibm-6.8 Livepatch 122.1 / jammy: lowlatency Livepatch 122.1 / noble: aws Livepatch 122.1 / noble: azure Livepatch 122.1 / noble: gcp Livepatch 122.1 / noble: linux Livepatch 122.2 / noble: gke Livepatch 122.1 / noble: ibm Livepatch 122.1 / noble: oracle Livepatch 122.1 / resolute: aws Livepatch 122.1 / resolute: azure Livepatch 122.1 / resolute: gcp Livepatch 122.1 / resolute: linux Livepatch 122.1 / xenial: aws-hwe Livepatch 122.1 / xenial: aws Livepatch 122.1 / xenial: azure Livepatch 122.1 / xenial: gcp Livepatch 122.1 / xenial: generic-4.15 Livepatch 122.1 / xenial: lowlatency-4.15 Livepatch 122.1 / xenial: generic-4.4 Livepatch 122.1 / xenial: lowlatency-4.4 Livepatch 122.1
Not provided by the authority · exploitation not stated
Red Hat · Red Hat Service Telemetry Framework 1.5 container components
RHSA-2026:77532 · 7 CVEs — Red Hat Service Telemetry Framework 1.5.7 Addresses Seven VulnerabilitiesRecorded remediation: Service Telemetry Framework 1.5.7 images using the advisory-listed registry digests
Medium to High · exploitation not stated
Red Hat · RHEL 8.4, 8.6, and 8.8 entitled mod_auth_openidc:2.3 module streams
RHSA-2026:77372 / RHSA-2026:77370 / RHSA-2026:77371 · 1 CVE — Red Hat mod_auth_openidc Updates Fix CVE-2026-53938 on RHEL 8Recorded remediation: the advisory-listed mod_auth_openidc 2.4.9.4-1 and cjose 0.6.1-3 module builds for the matching 8.4, 8.6, or 8.8 support channel
High · exploitation not stated
Red Hat · Red Hat Hardened Images GnuPG 2 RPM content
RHSA-2026:77484 · 1 CVE — Red Hat Hardened Images GnuPG Update Fixes CVE-2026-105712Recorded remediation: gnupg2 2.4.9-18.1.hum1 and the matching advisory-listed GnuPG subpackages
Low · exploitation not stated
Red Hat · RHEL 8.8 SAP E4S and Telecommunications Update Service kernel packages
RHSA-2026:77301 · 18 CVEs — Red Hat RHEL 8.8 SAP and TUS Kernel Update Addresses 18 VulnerabilitiesRecorded remediation: kernel 4.18.0-477.172.1.el8_8 and the matching advisory-listed packages, followed by a controlled reboot
High · exploitation not stated
Red Hat · RHEL 9.4 Update Services for SAP Solutions kernel packages
RHSA-2026:77218 · 21 CVEs — Red Hat RHEL 9.4 SAP Kernel Update Addresses 21 VulnerabilitiesRecorded remediation: kernel 5.14.0-427.154.1.el9_4 and the matching advisory-listed packages, followed by a controlled reboot
High · exploitation not stated
Red Hat · Red Hat OpenShift Container Platform 4.19
RHSA-2026:74435 / RHSA-2026:74434 / RHSA-2026:74433 · 17 CVEs — Red Hat OpenShift 4.19.50 Addresses Seventeen VulnerabilitiesRecorded remediation: OpenShift Container Platform 4.19.50 with the exact advisory-listed release image, RHCOS build, RPMs, and image digests
Medium to High · exploitation not stated
Red Hat · RHEL 9.2 Update Services for SAP Solutions kernel packages
RHSA-2026:77215 · 10 CVEs — Red Hat RHEL 9.2 SAP Kernel Update Addresses Ten VulnerabilitiesRecorded remediation: kernel 5.14.0-284.195.1.el9_2 and the matching advisory-listed packages, followed by a controlled reboot
Medium to High · exploitation not stated
Red Hat · RHEL 9.2 E4S real-time and NFV kernel packages
RHSA-2026:77214 · 10 CVEs — Red Hat Real-Time Kernel Update Addresses Ten VulnerabilitiesRecorded remediation: kernel-rt 5.14.0-284.195.1.rt14.480.el9_2 and matching advisory-listed packages
Medium to High · exploitation not stated
Red Hat · RHEL 9.4 E4S OpenSSH packages
RHSA-2026:76993 · 6 CVEs — Red Hat OpenSSH Update Addresses Six RHEL 9 VulnerabilitiesRecorded remediation: openssh 8.7p1-38.el9_4.10 client and server packages
Medium to High · exploitation not stated
Red Hat · RHEL 8.10 EUS Ghostscript and libgs packages
RHSA-2026:76877 · 1 CVE — Red Hat Ghostscript Update Fixes CVE-2026-39919 on RHEL 8Recorded remediation: ghostscript and libgs 9.27-18.el8_10
High · exploitation not stated
Red Hat · RHEL 9.2 E4S Python 3.9 packages
RHSA-2026:76945 · 3 CVEs — Red Hat Python 3.9 Update Addresses Three RHEL 9 VulnerabilitiesRecorded remediation: python3.9 3.9.16-1.el9_2.15 and the matching advisory-listed Python packages
Medium to High · exploitation not stated
Red Hat · RHEL 10.2 perl-DBI packages
RHSA-2026:76762 · 1 CVE — Red Hat Perl DBI Update Fixes CVE-2026-88815 on RHEL 10Recorded remediation: perl-DBI 1.643-26.el10_2.7
High · exploitation not stated
Amazon Web Services · bedrock-agentcore-starter-toolkit 0.1.4 through releases before 0.3.14
2026-127-AWS · 2 CVEs — AWS Fixes Code Injection and SSRF in Bedrock AgentCore Starter ToolkitRecorded remediation: bedrock-agentcore-starter-toolkit 0.3.14; re-import agents and replace generated local or deployed artifacts; plan migration to @aws/agentcore
Not provided by the authority · exploitation not stated
Ubuntu · Ubuntu Pro for WSL on Ubuntu 26.04 (resolute) LTS, Ubuntu 24.04 (noble) LTS, Ubuntu 22.04 (jammy) LTS, Ubuntu 20.04 (focal) ESM
USN-8892-1 · 1 CVE — Ubuntu Pro for WSL Update Protects Attach TokensRecorded remediation: focal: wsl-pro-service 0.1.18~20.04.2+esm1 / jammy: wsl-pro-service 0.1.18~22.04.3 / noble: wsl-pro-service 0.1.18~24.04.4 / resolute: wsl-pro-service 0.1.19ubuntu2.1
Not provided by the authority · exploitation not stated
Red Hat · Red Hat build of MicroShift 4.21
RHSA-2026:74796 · 5 CVEs — Red Hat MicroShift 4.21.36 Addresses Five VulnerabilitiesRecorded remediation: MicroShift 4.21.36 and the exact advisory-listed packages
High · exploitation not stated
Elastic · Elastic Agent and Endpoint on affected Windows locales in 8.19.13-8.19.21, 9.2.7-9.2.8, 9.3.0-9.3.8, 9.4.0-9.4.7, and 9.5.0-9.5.4
ESA-2026-194 · 1 CVE — Elastic Agent and Endpoint Update Prevents Windows Protection CrashesRecorded remediation: Elastic Agent and Endpoint 8.19.22, 9.4.8, or 9.5.5
Medium · exploitation not stated
Elastic · Kibana 8.19 and 9.x branches under the advisory-specific Fleet and feature conditions
ESA-2026-187 / ESA-2026-191 / ESA-2026-193 · 3 CVEs — Elastic Kibana Updates Address Three Fleet Security IssuesRecorded remediation: Kibana 8.19.22, 9.4.8, or 9.5.5 for the matching branch; ESA-2026-191 is resolved by 9.4.0 or later where the feature was removed
Medium to High · exploitation not stated
Elastic · Elasticsearch 7.17, 8.19, 9.3, 9.4, and 9.5 branches under the advisory-specific version and feature conditions
ESA-2026-185 / ESA-2026-188 / ESA-2026-189 / ESA-2026-190 / ESA-2026-192 / ESA-2026-195 / ESA-2026-196 / ESA-2026-197 / ESA-2026-198 / ESA-2026-199 · 10 CVEs — Elastic Publishes Ten Elasticsearch Security AdvisoriesRecorded remediation: Elasticsearch 8.19.23, 9.4.8, or 9.5.5 for the broadest combined coverage, while following each ESA's branch-specific fixed version
Medium to High · exploitation not stated
Red Hat · Firefox ESR packages on the advisory-listed RHEL 8.4 and RHEL 9.6 extended-support channels
RHSA-2026:76894 / RHSA-2026:76895 · 10 CVEs — Red Hat Firefox 140.15 Updates Address Ten VulnerabilitiesRecorded remediation: firefox 140.15.0-1.el8_4 or 140.15.0-1.el9_6 for the matching entitled channel
Medium to High · exploitation not stated
Red Hat · Red Hat Hardened Images .NET 8 RPM content
RHSA-2026:77004 · 1 CVE — Red Hat Hardened Images Update Fixes CVE-2026-58649Recorded remediation: dotnet 8.0.131-0.1.hum1 packages for the advisory-listed architectures
Medium · exploitation not stated
Red Hat · Red Hat OpenShift Container Platform 4.20
RHSA-2026:74380 / RHSA-2026:74377 · 10 CVEs — Red Hat OpenShift 4.20.41 Addresses Ten VulnerabilitiesRecorded remediation: OpenShift Container Platform 4.20.41 using the exact advisory-listed image digests and RHCOS 4.20.9.6.202609301206-0
Medium to High · exploitation not stated
Red Hat · RHEL 9.6 EUS firewalld packages
RHSA-2026:76844 · 1 CVE — Red Hat firewalld Update Fixes CVE-2026-4948 on RHEL 9Recorded remediation: firewalld 1.3.4-15.el9_6.1 and matching firewall-applet, firewall-config, filesystem, and python3-firewall packages
Medium · exploitation not stated
Red Hat · RHEL 8.10 EUS Dovecot packages
RHSA-2026:76763 · 8 CVEs — Red Hat Dovecot Update Addresses Eight RHEL 8 VulnerabilitiesRecorded remediation: dovecot 1:2.3.16-16.el8_10 and the matching advisory-listed subpackages
High to Critical · exploitation not stated
Google Chrome · Google Chrome Stable for Windows, macOS, Linux, and Android
Chrome 155 Stable 2026-10-06 · 247 CVEs — Google Chrome 155 Stable Update Fixes 247 Security IssuesRecorded remediation: Chrome 155.0.8059.39/.40 for Windows and macOS, 155.0.8059.39 for Linux, and 155.0.8059.39 for Android
Not provided by the authority · exploitation not stated
Ubuntu · libsoup on Ubuntu 26.04 (resolute) LTS, Ubuntu 24.04 (noble) LTS, Ubuntu 22.04 (jammy) LTS, Ubuntu 20.04 (focal) ESM, Ubuntu 18.04 (bionic) ESM, Ubuntu 16.04 (xenial) ESM
USN-8890-1 · 8 CVEs — Ubuntu libsoup Updates Address Eight VulnerabilitiesRecorded remediation: bionic: libsoup2.4 2.62.1-1ubuntu0.4+esm9 / focal: libsoup2.4 2.70.0-1ubuntu0.5+esm4 / jammy: libsoup2.4 2.74.2-3ubuntu0.9 / jammy: libsoup3 3.0.7-0ubuntu1+esm9 / noble: libsoup2.4 2.74.3-6ubuntu1.9 / noble: libsoup3 3.4.4-5ubuntu0.9 / resolute: libsoup2.4 2.74.3-10.1ubuntu5+esm3 / resolute: libsoup3 3.6.6-1ubuntu0.1 / xenial: libsoup2.4 2.52.2-1ubuntu0.3+esm8
Not provided by the authority · exploitation not stated
Ubuntu · Ubuntu 7.0 generic, cloud, and OEM kernel families on Ubuntu 26.04 (resolute) LTS
USN-8887-1 / USN-8888-1 / USN-8889-1 · 1151 CVEs — Ubuntu 7.0 Kernel Updates Address Broad Vulnerability SetsRecorded remediation: resolute: linux 7.0.0-38.38 / resolute: linux-aws 7.0.0-1014.14 / resolute: linux-gcp 7.0.0-1014.14 / resolute: linux-gke 7.0.0-1008.9 / resolute: linux-ibm 7.0.0-1015.15 / resolute: linux-oracle 7.0.0-1013.13 / resolute: linux-realtime 7.0.0-38.38.1 / resolute: linux-azure 7.0.0-1017.17 / resolute: linux-azure-fde 7.0.0-1016.16 / resolute: linux-oem-7.0 7.0.0-1015.15
Not provided by the authority · exploitation not stated
Red Hat · Red Hat Enterprise Linux 10.0 EUS OpenSSH packages
RHSA-2026:76748 · 7 CVEs — Red Hat OpenSSH Update Fixes Seven RHEL 10 EUS FlawsRecorded remediation: openssh 9.9p1-7.el10_0.5
Medium to High · exploitation not stated
Red Hat · Red Hat Enterprise Linux 8 FreeRDP client and library packages
RHSA-2026:76747 · 6 CVEs — Red Hat FreeRDP Update Fixes Six RHEL 8 VulnerabilitiesRecorded remediation: freerdp 2.11.7-14.el8_10
Medium to High · exploitation not stated
Red Hat · Red Hat Enterprise Linux 10 OpenTelemetry Collector packages
RHSA-2026:76743 · 1 CVE — Red Hat Updates OpenTelemetry Collector on RHEL 10Recorded remediation: opentelemetry-collector 0.158.0-1.el10_2
High · exploitation not stated
Red Hat · Firefox ESR packages for RHEL 7 ELS, RHEL 8.8 E4S/TUS, and RHEL 9.2/9.4 E4S
RHSA-2026:76746 / RHSA-2026:76741 / RHSA-2026:76740 / RHSA-2026:76742 · 10 CVEs — Red Hat Firefox 140.15 Updates Extended RHEL BranchesRecorded remediation: firefox 140.15.0-1 on the advisory-listed RHEL branches
Medium to High · exploitation not stated
Red Hat · Red Hat Enterprise Linux 9 and 10 rpm-sequoia packages
RHSA-2026:76734 / RHSA-2026:76733 · 1 CVE — Red Hat Updates rpm-sequoia on RHEL 9 and 10Recorded remediation: rpm-sequoia 1.10.2.1-1.el9_8 or 1.10.2.1-1.el10_2
High · exploitation not stated
Ubuntu · Tesseract OCR on Ubuntu 26.04 (resolute) LTS, Ubuntu 24.04 (noble) LTS, Ubuntu 22.04 (jammy) LTS, Ubuntu 20.04 (focal) ESM, Ubuntu 18.04 (bionic) ESM, Ubuntu 16.04 (xenial) ESM, Ubuntu 14.04 (trusty) ESM
USN-8882-1 · 10 CVEs — Ubuntu Tesseract Updates Fix Ten VulnerabilitiesRecorded remediation: bionic: tesseract 4.00~git2288-10f4998a-2ubuntu0.1~esm1 / focal: tesseract 4.1.1-2ubuntu0.1~esm1 / jammy: tesseract 4.1.1-2.1ubuntu0.1~esm1 / noble: tesseract 5.3.4-1ubuntu0.1~esm1 / resolute: tesseract 5.5.0-1ubuntu0.1~esm1 / trusty: tesseract 3.03.02-3ubuntu0.1~esm1 / xenial: tesseract 3.04.01-4ubuntu0.1~esm1
Not provided by the authority · exploitation not stated
Red Hat · Red Hat Enterprise Linux 9 Vim packages
RHSA-2026:75768 · 1 CVE — Red Hat Fixes an Important Vim Flaw on RHEL 9Recorded remediation: vim 8.2.2637-26.el9_8.23
High · exploitation not stated
Ubuntu · FreeType on Ubuntu 26.04 (resolute) LTS, Ubuntu 24.04 (noble) LTS, Ubuntu 22.04 (jammy) LTS
USN-8881-1 · 1 CVE — Ubuntu FreeType Update Fixes CVE-2026-95512Recorded remediation: jammy: freetype 2.11.1+dfsg-1ubuntu0.4 / noble: freetype 2.13.2+dfsg-1ubuntu0.2 / resolute: freetype 2.14.2+dfsg-1ubuntu0.2
Not provided by the authority · exploitation not stated
Ubuntu · FreeRDP on Ubuntu 26.04 (resolute) LTS, Ubuntu 24.04 (noble) LTS
USN-8880-1 · CVE not listed — Ubuntu FreeRDP Updates Address Multiple Security IssuesRecorded remediation: noble: freerdp3 3.32.1+dfsg-0ubuntu0.24.04.1 / resolute: freerdp3 3.32.1+dfsg-0ubuntu0.26.04.1
Not provided by the authority · exploitation not stated
Ubuntu · sg3_utils on Ubuntu 26.04 (resolute) LTS, Ubuntu 24.04 (noble) LTS, Ubuntu 22.04 (jammy) LTS, Ubuntu 20.04 (focal) ESM, Ubuntu 18.04 (bionic) ESM, Ubuntu 16.04 (xenial) ESM, Ubuntu 14.04 (trusty) ESM
USN-8874-1 · 1 CVE — Ubuntu sg3_utils Update Fixes CVE-2026-16313Recorded remediation: bionic: sg3-utils 1.42-2ubuntu1.18.04.2+esm1 / focal: sg3-utils 1.44-1ubuntu2+esm1 / jammy: sg3-utils 1.46-1ubuntu0.22.04.2 / noble: sg3-utils 1.46-3ubuntu4.1 / resolute: sg3-utils 1.48-3ubuntu3.2 / trusty: sg3-utils 1.36-1ubuntu1+esm1 / xenial: sg3-utils 1.40-0ubuntu1+esm1
Not provided by the authority · exploitation not stated
Ubuntu · Ubuntu 5.15 kernel families on Ubuntu 20.04 (focal) ESM, Ubuntu 22.04 (jammy) LTS
USN-8878-1 / USN-8879-1 / USN-8875-1 · 973 CVEs — Ubuntu 5.15 Kernel Updates Address Broad Vulnerability SetsRecorded remediation: focal: linux-gcp-5.15 5.15.0-1118.128~20.04.1 / focal: linux-oracle-5.15 5.15.0-1114.120~20.04.1 / focal: linux-aws-5.15 5.15.0-1117.124~20.04.1 / focal: linux-azure-5.15 5.15.0-1123.132~20.04.1 / focal: linux-azure-fde-5.15 5.15.0-1122.131~20.04.1 / focal: linux-hwe-5.15 5.15.0-198.208~20.04.1 / focal: linux-ibm-5.15 5.15.0-1111.115~20.04.1 / focal: linux-intel-iotg-5.15 5.15.0-1112.118~20.04.1 / focal: linux-lowlatency-hwe-5.15 5.15.0-195.205~20.04.1 / jammy: linux 5.15.0-198.208 / jammy: linux-aws 5.15.0-1117.124 / jammy: linux-aws-fips 5.15.0-1117.124+fips1 / jammy: linux-azure 5.15.0-1123.132 / jammy: linux-azure-fips 5.15.0-1123.132+fips1 / jammy: linux-fips 5.15.0-198.208+fips1 / jammy: linux-gke 5.15.0-1113.119 / jammy: linux-gkeop 5.15.0-1100.108 / jammy: linux-ibm 5.15.0-1111.115 / jammy: linux-intel-iot-realtime 5.15.0-1109.111 / jammy: linux-intel-iotg 5.15.0-1112.118 / jammy: linux-kvm 5.15.0-1109.114 / jammy: linux-lowlatency 5.15.0-195.205 / jammy: linux-oracle 5.15.0-1114.120 / jammy: linux-realtime 5.15.0-1116.125 / jammy: linux-xilinx-zynqmp 5.15.0-1080.84
Not provided by the authority · exploitation not stated
Django · Django 6.1, 6.0, and 5.2 release branches
Django security releases 2026-10-06 · 4 CVEs — Django 6.1.2, 6.0.9, and 5.2.18 Fix Four Security IssuesRecorded remediation: Django 6.1.2, 6.0.9, or 5.2.18 for the matching release branch
Low to Moderate · exploitation not stated
Savannah lwIP · Savannah lwIP deployments using the vulnerable SMTP client before the upstream correction
ICSA-26-279-02 · 1 CVE — CISA Warns of Critical Savannah lwIP SMTP Client Buffer OverflowRecorded remediation: apply patch_125_smtp_txbuf.diff or upstream commit 614420f82c8729d070e01464c0dddb3c9525c772, then rebuild and deploy the affected firmware or application
Critical · exploitation not stated
Red Hat · Red Hat OpenShift Container Platform 4.21.36 and 4.22.17
RHSA-2026:74384 / RHSA-2026:74430 / RHSA-2026:74383 / RHSA-2026:74429 / RHSA-2026:74427 · 10 CVEs — Red Hat OpenShift 4.21.36 and 4.22.17 Address Ten VulnerabilitiesRecorded remediation: OpenShift Container Platform 4.21.36 or 4.22.17 at the advisory-listed packages and immutable image digests
Medium to High · exploitation not stated
Mozilla · Mozilla Firefox 157 before 157.0.1
MFSA 2026-104 · 1 CVE — Mozilla Firefox 157.0.1 Fixes a File-Handling Mitigation BypassRecorded remediation: Firefox 157.0.1
Moderate · exploitation not stated
Ubuntu · libxmltok on Ubuntu 24.04 (noble) LTS, Ubuntu 22.04 (jammy) LTS, Ubuntu 20.04 (focal) ESM, Ubuntu 18.04 (bionic) ESM, Ubuntu 16.04 (xenial) ESM
USN-8872-1 · 2 CVEs — Ubuntu libxmltok Updates Fix Two VulnerabilitiesRecorded remediation: bionic: libxmltok 1.2-4ubuntu0.18.04.1~esm7 / focal: libxmltok 1.2-4ubuntu0.20.04.1~esm7 / jammy: libxmltok 1.2-4ubuntu0.22.04.1~esm7 / noble: libxmltok 1.2-4.1ubuntu2.24.0.4.1+esm5 / xenial: libxmltok 1.2-3ubuntu0.1~esm1
Not provided by the authority · exploitation not stated
Red Hat · Red Hat Hardened Images Grafana 13.2 and 13.1 RPM images
RHSA-2026:76430 / RHSA-2026:76448 · 4 CVEs — Red Hat Hardened Grafana Images Address Four VulnerabilitiesRecorded remediation: grafana13.2 13.2.3-0.1.hum1 and grafana13.1 13.1.7-0.1.hum1 from Red Hat Hardened Images
Medium to High · exploitation not stated
Red Hat · Red Hat Enterprise Linux AI 3.4 disk and bootc images
RHSA-2026:76149 / RHSA-2026:76150 · 24 CVEs — Red Hat Enterprise Linux AI 3.4.5 Fixes 24 VulnerabilitiesRecorded remediation: Red Hat Enterprise Linux AI 3.4.5 disk and bootc images at the immutable digests listed in the advisories
Medium to Critical · exploitation not stated
Red Hat · Red Hat build of Kueue 1.4 operator images
RHSA-2026:76145 · 1 CVE — Red Hat Build of Kueue 1.4.3 Fixes a Go VulnerabilityRecorded remediation: Red Hat build of Kueue 1.4.3 at the architecture-specific immutable digests in RHSA-2026:76145
High · exploitation not stated
Red Hat · Red Hat Enterprise Linux 8.10 EUS BaseOS and CodeReady Builder libpcap packages
RHSA-2026:76045 · 1 CVE — Red Hat Fixes Important libpcap Flaw on RHEL 8.10 EUSRecorded remediation: libpcap 1.9.1-6.el8_10 for the advisory-listed RHEL 8.10 EUS architectures
High · exploitation not stated
Red Hat · Red Hat Single Sign-On 7.6.13 packages for RHEL 8 and 9 plus the OpenShift image
RHSA-2026:76132 / RHSA-2026:76134 / RHSA-2026:76129 / RHSA-2026:76130 · 27 CVEs — Red Hat Single Sign-On 7.6.13 Fixes 27 VulnerabilitiesRecorded remediation: Red Hat Single Sign-On 7.6.13 packages for RHEL 8 and 9 and the advisory-listed immutable OpenShift image digests
Medium to Critical · exploitation not stated
Ubuntu · Linux kernel (Raspberry Pi) vulnerabilities on Ubuntu 22.04 (jammy) LTS
USN-8871-1 · 21 CVEs — Ubuntu Raspberry Pi Kernel Updates Address Security FlawsRecorded remediation: jammy: linux-raspi 5.15.0-1110.113
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel (Azure) vulnerabilities on Ubuntu 18.04 (bionic) ESM
USN-8851-3 · 3 CVEs — Ubuntu Azure Kernel Updates Address Security FlawsRecorded remediation: bionic: linux-azure-5.4 5.4.0-1169.175~18.04.1
Not provided by the authority · exploitation not stated
Ubuntu · LibreOffice vulnerabilities on Ubuntu 26.04 (resolute) LTS, Ubuntu 24.04 (noble) LTS, Ubuntu 22.04 (jammy) LTS
USN-8868-1 · 8 CVEs — Ubuntu LibreOffice Updates Fix Multiple VulnerabilitiesRecorded remediation: jammy: libreoffice 1:7.3.7-0ubuntu0.22.04.13 / noble: libreoffice 4:24.2.7-0ubuntu0.24.04.7 / resolute: libreoffice 4:26.2.6.3-0ubuntu0.26.04.2
Not provided by the authority · exploitation not stated
Ubuntu · Ceph vulnerability on Ubuntu 26.04 (resolute) LTS, Ubuntu 22.04 (jammy) LTS, Ubuntu 20.04 (focal) ESM, Ubuntu 18.04 (bionic) ESM
USN-8867-1 · 1 CVE — Ubuntu Ceph Update Fixes a VulnerabilityRecorded remediation: bionic: ceph 12.2.13-0ubuntu0.18.04.11+esm3 / focal: ceph 15.2.17-0ubuntu0.20.04.6+esm2 / jammy: ceph 17.2.9-0ubuntu0.22.04.4 / resolute: ceph 20.2.0-0ubuntu2.1
Not provided by the authority · exploitation not stated
Red Hat · RHEL 8 standard and Real Time Linux kernel packages
RHSA-2026:75746 / RHSA-2026:75747 · 29 CVEs — Red Hat RHEL 8 Kernel Updates Fix 29 VulnerabilitiesRecorded remediation: kernel 4.18.0-553.171.1.el8_10 / kernel-rt 4.18.0-553.171.1.rt7.512.el8_10
Medium to High · exploitation not stated
Ubuntu · EDK II vulnerabilities on Ubuntu 26.04 (resolute) LTS, Ubuntu 24.04 (noble) LTS, Ubuntu 22.04 (jammy) LTS, Ubuntu 20.04 (focal) ESM, Ubuntu 18.04 (bionic) ESM, Ubuntu 16.04 (xenial) ESM
USN-8865-1 · 4 CVEs — Ubuntu EDK II Updates Fix Four VulnerabilitiesRecorded remediation: bionic: edk2 0~20180205.c0d9813c-2ubuntu0.3+esm3 / focal: edk2 0~20191122.bd85bf54-2ubuntu3.6+esm1 / jammy: edk2 2022.02-3ubuntu0.22.04.7 / noble: edk2 2024.02-2ubuntu0.10 / resolute: edk2 2025.11-3ubuntu7.3 / xenial: edk2 0~20160408.ffea0a2c-2ubuntu0.2+esm4
Not provided by the authority · exploitation not stated
Red Hat · gd graphics library packages on RHEL 8 and RHEL 10.0 Extended Support
RHSA-2026:75680 / RHSA-2026:80500 · 1 CVE — Red Hat gd Fixes Expand to RHEL 10.0 Extended SupportRecorded remediation: gd 2.2.5-8.el8_10 or 2.3.3-20.el10_0.1 for the matching branch
High · exploitation not stated
Red Hat · RHEL 8 and RHEL 9 MariaDB Connector/C packages
RHSA-2026:75674 / RHSA-2026:75673 · 1 CVE — Red Hat Fixes Critical MariaDB Connector Flaw on RHEL 8 and 9Recorded remediation: mariadb-connector-c 3.1.11-3.el8_10 / 3.2.6-2.el9_8
Critical · exploitation not stated
Red Hat · RHEL 10 Linux kernel packages
RHSA-2026:75576 · 2 CVEs — Red Hat RHEL 10 Kernel Update Fixes Two VulnerabilitiesRecorded remediation: kernel 6.12.0-211.62.1.el10_2
High · exploitation not stated
Red Hat · RHEL 7 Extended Life Cycle Support rhc-worker-script packages
RHSA-2026:75689 · 4 CVEs — Red Hat Updates rhc-worker-script for RHEL 7 ELSRecorded remediation: rhc-worker-script 0.12-1.el7_9
High · exploitation not stated
Red Hat · RHEL 10 libvirt virtualization packages
RHSA-2026:75583 · 2 CVEs — Red Hat Fixes Two libvirt Flaws on RHEL 10Recorded remediation: libvirt 11.10.0-12.9.el10_2
High · exploitation not stated
Red Hat · RHEL 10 BIND DNS server and utility packages
RHSA-2026:75577 · 5 CVEs — Red Hat BIND Update Fixes Five RHEL 10 FlawsRecorded remediation: bind 9.18.33-15.el10_2.12
High · exploitation not stated
Red Hat · Red Hat AI Base Images 3.5 CPU, Neuron, Rubin, CUDA 13, TPU, ROCm 7.14, and Spyre variants
RHSA-2026:75652 / RHSA-2026:75654 / RHSA-2026:75655 / RHSA-2026:75657 / RHSA-2026:75658 / RHSA-2026:75659 / RHSA-2026:75660 · 35 CVEs — Red Hat AI Base Images 3.5.2 Address Component VulnerabilitiesRecorded remediation: Red Hat AI Base Images 3.5.2 at the immutable image digests listed in each advisory
Low to High · exploitation not stated
Red Hat · RHEL 10 FreeRDP client and library packages
RHSA-2026:75570 · 11 CVEs — Red Hat FreeRDP Update Fixes 11 RHEL 10 FlawsRecorded remediation: freerdp 3.10.3-12.el10_2.14
Medium to High · exploitation not stated
Red Hat · RHEL 10 mod_auth_openidc packages
RHSA-2026:75581 · 1 CVE — Red Hat Fixes mod_auth_openidc on RHEL 10Recorded remediation: mod_auth_openidc 2.4.16.11-1.el10_2.1
High · exploitation not stated
Red Hat · RHEL 8 librabbitmq packages
RHSA-2026:75582 · 1 CVE — Red Hat Updates librabbitmq on RHEL 8Recorded remediation: librabbitmq 0.9.0-6.el8_10
Medium · exploitation not stated
Red Hat · RHEL 8 pki-core:10.6 module and Red Hat Certificate System components
RHSA-2026:75573 · 1 CVE — Red Hat Fixes Dogtag PKI Profile Import Code Execution on RHEL 8Recorded remediation: pki-core 10.15.1-3.module+el8.10.0+24994+a709cca8 package set
High · exploitation not stated
Red Hat · Red Hat Enterprise Linux 8, 9, and 10 sudo packages
RHSA-2026:75580 / RHSA-2026:75579 / RHSA-2026:75571 · 1 CVE — Red Hat Fixes Sudo Time-Window Authorization Bypass on RHEL 8–10Recorded remediation: sudo 1.9.5p2-2.el8_10 / 1.9.17p2-3.el9_8.3 / 1.9.17-10.p2.el10_2.7
High · exploitation not stated
Red Hat · Red Hat Enterprise Linux 10.0 EUS kernel, including Real Time and NFV EUS streams
RHSA-2026:75560 · 19 CVEs — Red Hat Updates the RHEL 10.0 EUS Kernel for 19 VulnerabilitiesRecorded remediation: kernel family 6.12.0-55.108.1.el10_0 from the entitled RHEL 10.0 EUS repositories
Medium to High · exploitation not stated
MediaTek · MediaTek modem, video, APU, display, connectivity, trusted-execution, and related chipset components listed in the October 2026 bulletin
MediaTek October 2026 Product Security Bulletin · 31 CVEs — MediaTek October 2026 Bulletin Fixes 31 Chipset VulnerabilitiesRecorded remediation: OEM-supplied security updates incorporating MediaTek's October 2026 patches; no universal public fixed build is stated
Critical (highest official severity; 2 Critical, 9 High, 20 Medium) · exploitation not publicly reported
Atlassian · Atlassian Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, and Crowd Data Center, plus Crucible and Fisheye
CVE-2026-21589 · 1 CVE — Atlassian Fixes Critical Arbitrary File Access Across Data Center ProductsRecorded remediation: Bitbucket 9.4.26 / 10.2.8 / 10.5.1; Confluence 9.2.26 / 10.2.19; Jira Service Management 5.12.40 / 10.3.26 / 11.3.12; Jira Software 9.12.40 / 10.3.26 / 11.3.12; Bamboo 10.2.24 / 12.1.12; Crowd 6.3.7 / 7.0.3 / 7.1.7 / 7.2.4; Crucible 4.9.15; Fisheye 4.9.15, or later supported releases
Critical · exploitation not stated
Citrix · Customer-managed NetScaler ADC and NetScaler Gateway configured as a SAML service provider or SAML identity provider
CTX697174 / CISA KEV 2026.10.04 · 1 CVE — Citrix NetScaler Updates Fix CVE-2026-88779Recorded remediation: NetScaler ADC and Gateway 14.1-73.41 / 13.1-64.28; NetScaler ADC 14.1-FIPS 14.1-73.41 FIPS; NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.282, or later supported releases
High · exploitation confirmed
Amazon Web Services (AWS) · Amazon SageMaker Unified Studio and SageMaker Distribution Studio Spaces
2026-125-AWS · 1 CVE — AWS Fixes SageMaker Studio Space Startup Command InjectionRecorded remediation: SageMaker Distribution 2.14.12 / 3.9.12 / 4.0.11 / 4.1.11 / 4.2.8 / 4.3.5 / 4.4.3 or 4.5.x
Not provided by the authority · exploitation not stated
Amazon Web Services (AWS) · Loom for AWS
2026-124-AWS · 3 CVEs — AWS Loom 1.7.0 Fixes Authentication and Outbound Request FlawsRecorded remediation: Loom for AWS 1.7.0
Not provided by the authority · exploitation not stated
Red Hat · FreeRDP on RHEL 10.2
RHSA-2026:73979 · 1 CVE — Red Hat FreeRDP Update Fixes Critical CVE-2026-91949 on RHEL 10Recorded remediation: freerdp 3.10.3-12.el10_2.13
Critical · exploitation not stated
Red Hat · Ruby on RHEL 10.2
RHSA-2026:72785 · 1 CVE — Red Hat Ruby Update Fixes CVE-2026-80212 on RHEL 10Recorded remediation: ruby 3.3.12-15.el10_2
High · exploitation not stated
Red Hat · GNU Awk on RHEL 8.10 EUS
RHSA-2026:73511 · 2 CVEs — Red Hat Updates GNU Awk on RHEL 8 for Two VulnerabilitiesRecorded remediation: gawk 4.2.1-5.el8_10
Medium · exploitation not stated
Red Hat · RHEL 10.2 kernel live patches
RHSA-2026:72831 · 3 CVEs — Red Hat Releases RHEL 10 Kernel Live Patches for Three VulnerabilitiesRecorded remediation: kpatch-patch-6_12_0-211_16_1 1-9.el10_2 / kpatch-patch-6_12_0-211_49_1 1-1.el10_2
High · exploitation not stated
Red Hat · Red Hat Hardened Images for Apache HTTP Server, Podman, Caddy, Python, Grafana, OpenTofu, and FreeType
RHSA-2026:74858 / RHSA-2026:74861 / RHSA-2026:74865 / RHSA-2026:74868 / RHSA-2026:74869 / RHSA-2026:74871 / RHSA-2026:74872 / RHSA-2026:74922 / RHSA-2026:74948 / RHSA-2026:74952 · 24 CVEs — Red Hat Hardened Images Updates Address 24 VulnerabilitiesRecorded remediation: advisory-listed signed images containing httpd 2.4.69, podman 6.1.3, Caddy 2.11.6, Python 3.10.22 or 3.12.15, Grafana 12.4.12, 13.1.6 or 13.2.1, OpenTofu 1.12.7, and FreeType 2.14.3
Low to High · exploitation not stated
Red Hat · Ghostscript on RHEL 9.8 EUS
RHSA-2026:74457 · 1 CVE — Red Hat Updates Ghostscript on RHEL 9 for CVE-2026-39919Recorded remediation: ghostscript/libgs 9.54.0-19.el9_8.1
High · exploitation not stated
Ubuntu · Ubuntu 14.04 ESM and 16.04 ESM Linux kernels
USN-8864-1 · 3 CVEs — Ubuntu Kernel Updates Fix Three Vulnerabilities on Trusty and XenialRecorded remediation: Ubuntu 14.04 ESM: linux-aws 4.4.0-1159.165 / Ubuntu 14.04 ESM: linux-lts-xenial 4.4.0-288.322~14.04.1 / Ubuntu 16.04 ESM: linux 4.4.0-288.322 / Ubuntu 16.04 ESM: linux-aws 4.4.0-1197.212 / Ubuntu 16.04 ESM: linux-fips 4.4.0-1129.136 / Ubuntu 16.04 ESM: linux-kvm 4.4.0-1160.171
Not provided by the authority · exploitation not stated
Ubuntu · Ubuntu 26.04 LTS GKE kernel
USN-8816-4 · 101 CVEs — Ubuntu GKE Kernel Update Fixes 101 VulnerabilitiesRecorded remediation: Ubuntu 26.04 LTS: linux-gke 7.0.0-1007.8
Not provided by the authority · exploitation not stated
Ubuntu · Ubuntu 22.04 LTS FIPS kernel
USN-8818-6 · 20 CVEs — Ubuntu FIPS Kernel Update Fixes Twenty VulnerabilitiesRecorded remediation: Ubuntu 22.04 LTS: linux-fips 5.15.0-194.204+fips1
Not provided by the authority · exploitation not stated
Ubuntu · Ubuntu 18.04 ESM Raspberry Pi kernel
USN-8851-2 · 3 CVEs — Ubuntu Linux Kernel Update for Raspberry Pi Fixes Three VulnerabilitiesRecorded remediation: Ubuntu 18.04 ESM: linux-raspi-5.4 5.4.0-1147.160~18.04.1
Not provided by the authority · exploitation not stated
Google · Google Chrome Stable for desktop and Android
Chrome 154 Stable Desktop 2026-10-01 / Chrome 154 Stable Android 2026-10-01 · 11 CVEs — Google Chrome 154 Stable Update Fixes Eleven VulnerabilitiesRecorded remediation: Chrome 154.0.8037.97/.98 for Windows and macOS / 154.0.8037.97 for Linux / 154.0.8037.126 for Android
Not provided by the authority · exploitation not stated
GitLab · GitLab Self-Hosted AI Gateway
CVE-2026-90970 · 1 CVE — GitLab AI Gateway Updates Fix Critical CVE-2026-90970Recorded remediation: GitLab AI Gateway 19.2.4 / 19.3.2 / 19.4.1
Critical · exploitation not stated
Red Hat · Performance Co-Pilot packages for RHEL 8.4 and 8.6 AUS/EUS Extension branches
RHSA-2026:74612 / RHSA-2026:74613 · 4 CVEs — Red Hat Updates Performance Co-Pilot on RHEL 8 for Four VulnerabilitiesRecorded remediation: pcp 5.2.5-8.el8_4.1 / pcp 5.3.5-10.el8_6.1
High · exploitation not stated
Red Hat · Red Hat JBoss Web Server 6.2 on RHEL 8, 9, and 10
RHSA-2026:73981 · 13 CVEs — Red Hat JBoss Web Server 6.2.5 Addresses Thirteen VulnerabilitiesRecorded remediation: Red Hat JBoss Web Server 6.2.5, including jws6-tomcat 10.1.49-16.redhat_00016.1 for the matching RHEL stream
Low to High · exploitation not stated
Red Hat · Red Hat Satellite 6.18 on RHEL 9 and Satellite 6.16 on RHEL 8 or 9
RHSA-2026:74504 / RHSA-2026:74506 · 24 CVEs — Red Hat Satellite 6.18.10 and 6.16.14 Address Critical VulnerabilitiesRecorded remediation: Red Hat Satellite 6.18.10 / 6.16.14
Medium to Critical · exploitation not stated
Red Hat · Red Hat Gatekeeper 3.20
RHSA-2026:74791 · 2 CVEs — Red Hat Gatekeeper 3.20.1 Fixes Two High-Severity VulnerabilitiesRecorded remediation: Gatekeeper v3.20.1 advisory-listed signed image digests
High · exploitation not stated
Red Hat · Red Hat OpenShift AI 3.5 Gaudi base image
RHSA-2026:74771 · 35 CVEs — Red Hat AI Base Images 3.5.2 Updates the Gaudi VariantRecorded remediation: Red Hat AI Base Images 3.5.2 Gaudi signed image digest
Low to High · exploitation not stated
Amazon Web Services (AWS) · Powertools for AWS Lambda (Python)
2026-123-AWS · 1 CVE — AWS Powertools for Lambda Fixes Data-Masking Fail-OpenRecorded remediation: Powertools for AWS Lambda (Python) 3.35.0
Not provided by the authority · exploitation not stated
Red Hat · Red Hat OpenShift AI 3.4 CPU, Gaudi, Neuron, Spyre, TPU, CUDA 12.9, CUDA 13.0, ROCm 6.4, and ROCm 7.1 base images
RHSA-2026:74674 / RHSA-2026:74677 / RHSA-2026:74678 / RHSA-2026:74679 / RHSA-2026:74681 / RHSA-2026:74683 / RHSA-2026:74685 / RHSA-2026:74687 / RHSA-2026:74688 · 83 CVEs — Red Hat AI Base Images 3.4.3 Fix Vulnerabilities Across Nine VariantsRecorded remediation: Red Hat AI Base Images 3.4.3 with each advisory-listed signed image digest
Low to High · exploitation not stated
Amazon Web Services (AWS) · Amazon Ion Python
2026-122-AWS · 1 CVE — AWS Updates Amazon Ion Python for Recursion Denial of ServiceRecorded remediation: Amazon Ion Python 0.15.0
Not provided by the authority · exploitation not stated
Amazon Web Services · AWS security-agent-mcp-server 0.1.1 through 0.1.x
2026-121-AWS · 1 CVE — AWS Fixes Diff-Scan Argument Injection in security-agent-mcp-serverRecorded remediation: security-agent-mcp-server 0.2.0
Not provided by the authority · exploitation not stated
Ubuntu · GStreamer Good Plugins on Ubuntu 16.04 ESM through Ubuntu 26.04 LTS
USN-8863-1 · 4 CVEs — Ubuntu USN-8863-1 Updates GStreamer Good Plugins for Four VulnerabilitiesRecorded remediation: Ubuntu 18.04 ESM: gst-plugins-good1.0 1.14.5-0ubuntu1~18.04.3+esm4 / Ubuntu 20.04 ESM: gst-plugins-good1.0 1.16.3-0ubuntu1.3+esm4 / Ubuntu 22.04 LTS: gst-plugins-good1.0 1.20.3-0ubuntu1.10 / Ubuntu 24.04 LTS: gst-plugins-good1.0 1.24.2-1ubuntu1.8 / Ubuntu 26.04 LTS: gst-plugins-good1.0 1.28.2-2ubuntu0.4 / Ubuntu 16.04 ESM: gst-plugins-good1.0 1.8.3-1ubuntu0.5+esm4
Not provided by the authority · exploitation not stated
Amazon Web Services (AWS) · Amazon EFS CSI Driver for Kubernetes
2026-120-AWS · 1 CVE — AWS EFS CSI Driver 3.5.0 Fixes Mount Option InjectionRecorded remediation: Amazon EFS CSI Driver 3.5.0
Not provided by the authority · exploitation not stated
Ubuntu · libXpm vulnerability on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy)
USN-8862-1 · 1 CVE — Ubuntu USN-8862-1 Fixes libXpm VulnerabilityRecorded remediation: jammy: libxpm 1:3.5.12-1ubuntu0.22.04.4 / noble: libxpm 1:3.5.17-1ubuntu0.24.04.2 / resolute: libxpm 1:3.5.17-1ubuntu0.26.04.2
Not provided by the authority · exploitation not stated
Ubuntu · OpenSSL vulnerabilities on Ubuntu 26.04 LTS (resolute)
USN-8861-1 · 2 CVEs — Ubuntu USN-8861-1 Fixes OpenSSL VulnerabilitiesRecorded remediation: resolute: openssl 3.5.5-1ubuntu3.7
Not provided by the authority · exploitation not stated
Apache Software Foundation · Apache HTTP Server 2.4.x
Apache HTTP Server 2.4.69 · 20 CVEs — Apache HTTP Server 2.4.69 Fixes Twenty VulnerabilitiesRecorded remediation: Apache HTTP Server 2.4.69
Low to Moderate · exploitation not stated
Ubuntu · OpenStack Designate vulnerability on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial)
USN-8860-1 · 1 CVE — Ubuntu USN-8860-1 Fixes OpenStack Designate VulnerabilityRecorded remediation: bionic: designate 1:6.0.1-0ubuntu1.2+esm1 / focal: designate 1:10.0.2-0ubuntu1+esm1 / jammy: designate 1:14.0.4-0ubuntu1.1 / noble: designate 1:18.0.0-0ubuntu1.1 / resolute: designate 1:22.0.0-0ubuntu2.1 / xenial: designate 1:2.1.0-0ubuntu1+esm1
Not provided by the authority · exploitation not stated
Ubuntu · KCoreAddons vulnerability on Ubuntu 26.04 LTS (resolute)
USN-8857-1 · 1 CVE — Ubuntu USN-8857-1 Fixes KCoreAddons VulnerabilityRecorded remediation: resolute: kf6-kcoreaddons 6.24.0-0ubuntu1.1
Not provided by the authority · exploitation not stated
Monta · Monta monta.app charging-platform service
ICSA-26-274-02 · 4 CVEs — CISA Warns of Critical Authentication Gaps in Monta Charging ServicesRecorded remediation: No discrete fixed version is stated; enable OCPP 1.6 Security Profile 2, use TLS-authenticated connections, and confirm Monta's managed throttling controls
Medium to Critical · exploitation not stated
Meari · Meari IoT Cloud Platform OpenAPI Service
ICSA-26-274-06 · 2 CVEs — CISA Warns of Missing Authorization in Meari IoT Cloud PlatformRecorded remediation: No fix is planned; contact Meari support and apply CISA's exposure-reduction guidance
Medium to High · exploitation not stated
Johnson Controls · Johnson Controls EasyIO Neo Series EC and CW controllers
JCI-PSA-2026-19 / JCI-PSA-2026-20 / JCI-PSA-2026-30 / ICSA-26-274-04 / ICSA-26-274-05 · 4 CVEs — Johnson Controls Releases EasyIO Neo Firmware and Hardware FixesRecorded remediation: EC firmware V3.3b64 / CW firmware V3.3b26, plus revised hardware with SWD debug pins removed for the physical-debug findings
Low to Medium · exploitation not stated
CISA · CISA Malcolm before v26.06.0
ICSA-26-254-01 · 15 CVEs — CISA Malcolm Update Addresses Fifteen Security VulnerabilitiesRecorded remediation: CISA Malcolm September 2026 release or later, with KEYCLOAK_SSL_VERIFY explicitly enabled where certificate validation is required
Low to High · exploitation not stated
Armatura · Armatura One and Armatura One USA
ICSA-26-274-01 · 5 CVEs — Armatura One Updates Fix Critical Code Execution and Credential FlawsRecorded remediation: Armatura One 4.7.2 / Armatura One USA 4.6.1_USA
Medium to Critical · exploitation not stated
ABB · ABB Protection and Control IED Manager PCM600 through version 2.14
ICSA-26-274-03 · 2 CVEs — CISA Details ABB PCM600 Scheduler Privilege RisksRecorded remediation: No fixed release is stated; configure ABBPCMSchedulerService to use the same Windows account as PCM600 and follow ABB advisories 2NGA003170 and 2NGA003179
Medium · exploitation not stated
Tenable · Tenable Nessus 10.12.4 and earlier
TNS-2026-26 · 9 CVEs — Tenable Nessus 10.12.5 Fixes Nine VulnerabilitiesRecorded remediation: Tenable Nessus 10.12.5
Low to Critical · exploitation not stated
Johnson Controls · Johnson Controls EasyIO FG building-automation controllers
JCI-PSA-2026-12 · 2 CVEs — Johnson Controls Warns of High-Severity EasyIO FG VulnerabilitiesRecorded remediation: No fixed EasyIO FG firmware; migrate the end-of-life controller to a supported current-generation platform such as EasyIO Neo R1
High · exploitation not stated
Fortinet · FortiMail 8.0, 7.6, 7.4, and 7.2 release families in the advisory-listed ranges
FG-IR-26-175 · 1 CVE — Fortinet Warns of Exploited FortiMail Path TraversalRecorded remediation: FortiMail 8.0.2, 7.6.7, or 7.4.9; migrate 7.2 deployments to 7.4 or later
Critical · exploitation not stated
Apple · Supported iPhone and iPad devices and Mac systems covered by Apple's iOS, iPadOS, Tahoe, and Sequoia notices
CVE-2026-86950 · 1 CVE — CISA Adds Exploited Apple File-Processing Flaw to KEVRecorded remediation: iOS 26.7.1 / iPadOS 26.7.1 / macOS Tahoe 26.7.1 / macOS Sequoia 15.8.1
Not provided by the authority · exploitation CISA KEV
Amazon Web Services (AWS) · Thirty-five Amazon Linux 2023 kernel live-patch streams
ALAS2023LIVEPATCH-2026-389 / ALAS2023LIVEPATCH-2026-390 / ALAS2023LIVEPATCH-2026-391 / ALAS2023LIVEPATCH-2026-392 / ALAS2023LIVEPATCH-2026-393 / ALAS2023LIVEPATCH-2026-394 / ALAS2023LIVEPATCH-2026-395 / ALAS2023LIVEPATCH-2026-396 / ALAS2023LIVEPATCH-2026-397 / ALAS2023LIVEPATCH-2026-398 / ALAS2023LIVEPATCH-2026-399 / ALAS2023LIVEPATCH-2026-400 / ALAS2023LIVEPATCH-2026-401 / ALAS2023LIVEPATCH-2026-402 / ALAS2023LIVEPATCH-2026-403 / ALAS2023LIVEPATCH-2026-404 / ALAS2023LIVEPATCH-2026-405 / ALAS2023LIVEPATCH-2026-406 / ALAS2023LIVEPATCH-2026-407 / ALAS2023LIVEPATCH-2026-408 / ALAS2023LIVEPATCH-2026-409 / ALAS2023LIVEPATCH-2026-410 / ALAS2023LIVEPATCH-2026-411 / ALAS2023LIVEPATCH-2026-412 / ALAS2023LIVEPATCH-2026-413 / ALAS2023LIVEPATCH-2026-414 / ALAS2023LIVEPATCH-2026-415 / ALAS2023LIVEPATCH-2026-416 / ALAS2023LIVEPATCH-2026-417 / ALAS2023LIVEPATCH-2026-418 / ALAS2023LIVEPATCH-2026-419 / ALAS2023LIVEPATCH-2026-420 / ALAS2023LIVEPATCH-2026-421 / ALAS2023LIVEPATCH-2026-422 / ALAS2023LIVEPATCH-2026-423 · 1 CVE — Amazon Linux Publishes Thirty-Five Live Patches for CVE-2026-80521Recorded remediation: kernel-livepatch-6.1.175-219.359-1.0-9.amzn2023 / kernel-livepatch-6.1.176-220.358-1.0-9.amzn2023 / kernel-livepatch-6.1.176-220.360-1.0-8.amzn2023 / kernel-livepatch-6.1.176-221.360-1.0-8.amzn2023 / kernel-livepatch-6.1.176-221.367-1.0-8.amzn2023 / kernel-livepatch-6.1.176-223.369-1.0-6.amzn2023 / kernel-livepatch-6.1.177-224.371-1.0-6.amzn2023 / kernel-livepatch-6.1.180-225.360-1.0-6.amzn2023 / kernel-livepatch-6.1.182-227.379-1.0-6.amzn2023 / kernel-livepatch-6.1.186-228.374-1.0-4.amzn2023 / kernel-livepatch-6.1.186-228.376-1.0-2.amzn2023 / kernel-livepatch-6.1.188-233.385-1.0-2.amzn2023 / kernel-livepatch-6.12.100-125.179-1.0-6.amzn2023 / kernel-livepatch-6.12.103-127.188-1.0-4.amzn2023 / kernel-livepatch-6.12.103-129.197-1.0-2.amzn2023 / kernel-livepatch-6.12.110-135.201-1.0-2.amzn2023 / kernel-livepatch-6.12.92-122.168-1.0-9.amzn2023 / kernel-livepatch-6.12.94-123.174-1.0-9.amzn2023 / kernel-livepatch-6.12.94-123.176-1.0-8.amzn2023 / kernel-livepatch-6.12.94-123.180-1.0-8.amzn2023 / kernel-livepatch-6.12.94-123.190-1.0-8.amzn2023 / kernel-livepatch-6.12.94-123.192-1.0-6.amzn2023 / kernel-livepatch-6.12.95-124.187-1.0-6.amzn2023 / kernel-livepatch-6.18.35-68.129-1.0-9.amzn2023 / kernel-livepatch-6.18.36-69.134-1.0-9.amzn2023 / kernel-livepatch-6.18.36-69.136-1.0-8.amzn2023 / kernel-livepatch-6.18.36-69.138-1.0-8.amzn2023 / kernel-livepatch-6.18.38-73.137-1.0-8.amzn2023 / kernel-livepatch-6.18.38-76.139-1.0-6.amzn2023 / kernel-livepatch-6.18.39-79.141-1.0-6.amzn2023 / kernel-livepatch-6.18.41-94.142-1.0-6.amzn2023 / kernel-livepatch-6.18.44-99.149-1.0-4.amzn2023 / kernel-livepatch-6.18.48-107.148-1.0-4.amzn2023 / kernel-livepatch-6.18.48-109.150-1.0-2.amzn2023 / kernel-livepatch-6.18.51-120.162-1.0-2.amzn2023
Important · exploitation not stated
Amazon Web Services (AWS) · Amazon Linux 2023 kernel 6.1, 6.12, and 6.18 package streams
ALAS2023-2026-3146 / ALAS2023-2026-3147 / ALAS2023-2026-3148 · 1 CVE — Amazon Linux 2023 Kernel Updates Address CVE-2026-80521Recorded remediation: kernel-6.1.188-233.386.amzn2023 / kernel-debuginfo-6.1.188-233.386.amzn2023 / kernel-debuginfo-common-aarch64-6.1.188-233.386.amzn2023 / kernel-debuginfo-common-x86_64-6.1.188-233.386.amzn2023 / kernel-devel-6.1.188-233.386.amzn2023 / kernel-headers-6.1.188-233.386.amzn2023 / kernel-livepatch-6.1.188-233.386-1.0-0.amzn2023 / kernel-modules-extra-6.1.188-233.386.amzn2023 / kernel-modules-extra-common-6.1.188-233.386.amzn2023 / kernel-tools-6.1.188-233.386.amzn2023 / kernel-tools-debuginfo-6.1.188-233.386.amzn2023 / kernel-tools-devel-6.1.188-233.386.amzn2023 / kernel6.12-6.12.110-135.202.amzn2023 / kernel6.12-debuginfo-6.12.110-135.202.amzn2023 / kernel6.12-debuginfo-common-aarch64-6.12.110-135.202.amzn2023 / kernel6.12-debuginfo-common-x86_64-6.12.110-135.202.amzn2023 / kernel6.12-devel-6.12.110-135.202.amzn2023 / kernel6.12-headers-6.12.110-135.202.amzn2023 / kernel6.12-modules-extra-6.12.110-135.202.amzn2023 / kernel6.12-modules-extra-common-6.12.110-135.202.amzn2023 / kernel6.12-tools-6.12.110-135.202.amzn2023 / kernel6.12-tools-debuginfo-6.12.110-135.202.amzn2023 / kernel6.12-tools-devel-6.12.110-135.202.amzn2023 / kernel6.18-6.18.51-120.163.amzn2023 / kernel6.18-debuginfo-6.18.51-120.163.amzn2023 / kernel6.18-debuginfo-common-aarch64-6.18.51-120.163.amzn2023 / kernel6.18-debuginfo-common-x86_64-6.18.51-120.163.amzn2023 / kernel6.18-devel-6.18.51-120.163.amzn2023 / kernel6.18-headers-6.18.51-120.163.amzn2023 / kernel6.18-modules-extra-6.18.51-120.163.amzn2023 / kernel6.18-modules-extra-common-6.18.51-120.163.amzn2023 / kernel6.18-tools-6.18.51-120.163.amzn2023 / kernel6.18-tools-debuginfo-6.18.51-120.163.amzn2023 / kernel6.18-tools-devel-6.18.51-120.163.amzn2023
Important · exploitation not stated
Amazon Web Services (AWS) · Amazon Linux 2023 amazon-ssm-agent packages
ALAS2023-2026-3149 · 4 CVEs — Amazon Linux Updates SSM Agent for Four VulnerabilitiesRecorded remediation: amazon-ssm-agent-3.3.5226.0-1.amzn2023
Critical · exploitation not stated
Debian · Debian 13 (trixie) firefox-esr packages
DSA-6533-1 · 62 CVEs — Debian DSA-6533-1 Updates firefox-esr for Security VulnerabilitiesRecorded remediation: firefox-esr 153.4.0esr-1~deb13u1 for Debian 13 (trixie)
Not provided by the authority · exploitation not stated
Debian · Debian 13 (trixie) tor packages
DSA-6532-1 · CVE not listed — Debian DSA-6532-1 Updates tor for a Security VulnerabilityRecorded remediation: tor 0.4.9.13-0+deb13u1 for Debian 13 (trixie)
Not provided by the authority · exploitation not stated
Ubuntu · Authen::SASL vulnerability on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial), Ubuntu 14.04 ESM (trusty)
USN-8858-1 · 1 CVE — Ubuntu USN-8858-1 Fixes Authen::SASL VulnerabilityRecorded remediation: bionic: libauthen-sasl-perl 2.1600-1ubuntu0.18.04.1~esm1 / focal: libauthen-sasl-perl 2.1600-1ubuntu0.20.04.1~esm1 / jammy: libauthen-sasl-perl 2.1600-1.1ubuntu0.1 / noble: libauthen-sasl-perl 2.1700-1ubuntu0.1 / resolute: libauthen-sasl-perl 2.2000-1ubuntu0.1 / trusty: libauthen-sasl-perl 2.1500-1ubuntu0.1~esm1 / xenial: libauthen-sasl-perl 2.1600-1ubuntu0.16.04.1~esm1
Not provided by the authority · exploitation not stated
Ubuntu · ImageMagick vulnerabilities on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial), Ubuntu 14.04 ESM (trusty)
USN-8859-1 · 6 CVEs — Ubuntu USN-8859-1 Fixes ImageMagick VulnerabilitiesRecorded remediation: bionic: imagemagick 8:6.9.7.4+dfsg-16ubuntu6.15+esm18 / focal: imagemagick 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16 / jammy: imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16 / noble: imagemagick 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15 / resolute: imagemagick 8:7.1.2.18+dfsg1-1ubuntu0.1~esm4 / trusty: imagemagick 8:6.7.7.10-6ubuntu3.13+esm27 / xenial: imagemagick 8:6.8.9.9-7ubuntu5.16+esm26
Not provided by the authority · exploitation not stated
Ubuntu · GStreamer Bad Plugins vulnerability on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial), Ubuntu 14.04 ESM (trusty)
USN-8855-1 · 1 CVE — Ubuntu USN-8855-1 Fixes GStreamer Bad Plugins VulnerabilityRecorded remediation: bionic: gst-plugins-bad1.0 1.14.5-0ubuntu1~18.04.1+esm2 / focal: gst-plugins-bad1.0 1.16.3-0ubuntu1.1+esm2 / jammy: gst-plugins-bad1.0 1.20.3-0ubuntu1.1+esm3 / noble: gst-plugins-bad1.0 1.24.2-1ubuntu4+esm2 / resolute: gst-plugins-bad1.0 1.28.2-1ubuntu1.2 / trusty: gst-plugins-bad1.0 1.2.4-1~ubuntu1.1+esm1 / xenial: gst-plugins-bad1.0 1.8.3-1ubuntu0.2+esm2
Not provided by the authority · exploitation not stated
Ubuntu · Kdenlive, MLT vulnerability on Ubuntu 26.04 LTS (resolute)
USN-8856-1 · 1 CVE — Ubuntu USN-8856-1 Fixes Kdenlive, MLT VulnerabilityRecorded remediation: resolute: kdenlive 4:25.12.3-0ubuntu1.1 / resolute: mlt 7.36.1-1ubuntu3.1
Not provided by the authority · exploitation not stated
Ubuntu · GVfs vulnerabilities on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial)
USN-8845-1 · 2 CVEs — Ubuntu USN-8845-1 Fixes GVfs VulnerabilitiesRecorded remediation: bionic: gvfs 1.36.1-0ubuntu1.3.3+esm1 / focal: gvfs 1.44.1-1ubuntu1.2+esm1 / jammy: gvfs 1.48.2-0ubuntu1.2 / noble: gvfs 1.54.4-0ubuntu1~24.04.4 / resolute: gvfs 1.60.0-1ubuntu0.1 / xenial: gvfs 1.28.2-1ubuntu1~16.04.3+esm1
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel (Oracle) vulnerabilities on Ubuntu 24.04 LTS (noble)
USN-8816-3 · 101 CVEs — Ubuntu USN-8816-3 Fixes Linux kernel (Oracle) VulnerabilitiesRecorded remediation: noble: linux-oracle-7.0 7.0.0-1012.12~24.04.1
Not provided by the authority · exploitation not stated
Cisco · Cisco Catalyst SD-WAN Manager in all configurations
CVE-2026-76504 · 1 CVE — Cisco Fixes Exploited Catalyst SD-WAN Manager Authentication BypassRecorded remediation: 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1; Cloud Hosted 20.15.605
Critical · exploitation not stated
Debian · Debian 13 (trixie) openssl packages
DSA-6531-1 · 13 CVEs — Debian DSA-6531-1 Updates openssl for Security VulnerabilitiesRecorded remediation: openssl 3.5.7-1~deb13u3 for Debian 13 (trixie)
Not provided by the authority · exploitation not stated
Mozilla · Mozilla Thunderbird 157
MFSA 2026-101 · 76 CVEs — Mozilla MFSA 2026-101 Fixes Security Vulnerabilities in Thunderbird 157Recorded remediation: Thunderbird 157
High · exploitation not stated
Mozilla · Mozilla Thunderbird 140.17
MFSA 2026-102 · 44 CVEs — Mozilla MFSA 2026-102 Fixes Security Vulnerabilities in Thunderbird 140.17Recorded remediation: Thunderbird 140.17
High · exploitation not stated
Mozilla · Mozilla Thunderbird 153.4
MFSA 2026-103 · 63 CVEs — Mozilla MFSA 2026-103 Fixes Security Vulnerabilities in Thunderbird 153.4Recorded remediation: Thunderbird 153.4
High · exploitation not stated
Debian · Debian 13 (trixie) pcre2 packages
DSA-6530-1 · CVE not listed — Debian DSA-6530-1 Updates pcre2 for a Security VulnerabilityRecorded remediation: pcre2 10.46-1~deb13u3 for Debian 13 (trixie)
Not provided by the authority · exploitation not stated
Debian · Debian 13 (trixie) libwebsockets packages
DSA-6529-1 · 1 CVE — Debian DSA-6529-1 Updates libwebsockets for Security VulnerabilitiesRecorded remediation: libwebsockets 4.3.5-1+deb13u3 for Debian 13 (trixie)
Not provided by the authority · exploitation not stated
Google · Google Chrome Stable for Windows, macOS, and Linux
Chrome 154 Stable Desktop 2026-09-29 · 32 CVEs — Google Chrome 154 Stable Fixes Thirty-Two Security VulnerabilitiesRecorded remediation: Chrome 154.0.8037.92 or 154.0.8037.93 as provided for the operating system
Critical to Low · exploitation not stated
Amazon Web Services · Amazon GluonTS before 0.17.0
2026-119-AWS · 1 CVE — AWS Updates GluonTS for Unsafe Model DeserializationRecorded remediation: Amazon GluonTS 0.17.0
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel vulnerabilities on Ubuntu 20.04 ESM (focal)
USN-8818-3 · 20 CVEs — Ubuntu USN-8818-3 Updates Cloud and IoT Kernels for 20 VulnerabilitiesRecorded remediation: focal: linux-aws-5.15 5.15.0-1116.123~20.04.1 / focal: linux-azure-5.15 5.15.0-1122.131~20.04.1 / focal: linux-azure-fde-5.15 5.15.0-1121.130~20.04.1 / focal: linux-intel-iotg-5.15 5.15.0-1111.117~20.04.1
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel vulnerabilities on Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial), Ubuntu 14.04 ESM (trusty)
USN-8819-3 · 3 CVEs — Ubuntu USN-8819-3 Updates Azure and AWS Kernels for Three VulnerabilitiesRecorded remediation: bionic: linux-azure-4.15 4.15.0-1207.222 / trusty: linux-azure 4.15.0-1207.222~14.04.1 / xenial: linux-aws-hwe 4.15.0-1197.210~16.04.1
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel (NVIDIA) vulnerabilities on Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy)
USN-8842-1 · 18 CVEs — Ubuntu USN-8842-1 Updates NVIDIA Kernels for 18 VulnerabilitiesRecorded remediation: jammy: linux-nvidia-6.8 6.8.0-1063.66~22.04.1 / noble: linux-nvidia 6.8.0-1063.66 / noble: linux-nvidia-lowlatency 6.8.0-1063.66.1
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel (Oracle) vulnerabilities on Ubuntu 24.04 LTS (noble)
USN-8728-3 · 1417 CVEs — Ubuntu USN-8728-3 Updates the Oracle Kernel for 1,417 VulnerabilitiesRecorded remediation: noble: linux-oracle-7.0 7.0.0-1011.11~24.04.1
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel vulnerabilities on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble)
USN-8816-2 · 101 CVEs — Ubuntu USN-8816-2 Updates GCP and OEM Kernels for 101 VulnerabilitiesRecorded remediation: noble: linux-gcp-7.0 7.0.0-1013.13~24.04.1 / resolute: linux-gcp 7.0.0-1013.13 / resolute: linux-oem-7.0 7.0.0-1014.14
Not provided by the authority · exploitation not stated
Ubuntu · Linux kernel (AWS) vulnerabilities on Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy)
USN-8729-6 · 97 CVEs — Ubuntu USN-8729-6 Updates AWS Kernels for 97 VulnerabilitiesRecorded remediation: jammy: linux-aws-6.8 6.8.0-1064.67~22.04.1 / noble: linux-aws 6.8.0-1064.67
Not provided by the authority · exploitation not stated
Red Hat · cjose on entitled RHEL 9.2 and 9.4 SAP Solutions E4S streams
RHSA-2026:73017 / RHSA-2026:73018 · 1 CVE — Red Hat Updates cjose for CVE-2026-53938 Across RHEL 9 SAP Solutions BranchesRecorded remediation: cjose-0:0.6.1-13.el9_2.1.src / cjose-0:0.6.1-16.el9_4.1.src
High · exploitation not stated
Red Hat · FreeRDP on entitled RHEL 8.4 and 8.6 AUS or EUS Extension streams
RHSA-2026:73026 / RHSA-2026:73027 · 1 CVE — Red Hat Updates FreeRDP for CVE-2026-55193 Across RHEL 8.4 and 8.6 Extended BranchesRecorded remediation: freerdp-2:2.2.0-14.el8_4.4.src / freerdp-2:2.2.0-7.el8_6.13.src
High · exploitation not stated
Debian · Debian 13 (trixie) rsync packages
DSA-6527-1 · 33 CVEs — Debian Updates rsync for 33 Access, Disclosure, and Code-Execution FlawsRecorded remediation: rsync 3.5.0+ds1-0+deb13u1 for Debian 13 (trixie)
Not provided by the authority · exploitation not stated
2026 notice library
Use the filters to reach a specific CVE or product quickly. Twelve results are shown at a time to keep the page readable.
GHSA-p26c-h8c2-rwqj / CVE-2026-103502hex_core 0.20.0 Restores TLS Certificate Validationhexpm · Developer Tools & Supply ChainVendor advisorySeverity: MediumUSN-8914-1Ubuntu Google Guest Agents Fix Hostname-Validation BypassUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:80741Red Hat Python Tornado Update Addresses Three High-Severity FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:80764 / RHSA-2026:80765Red Hat Goose Updates Address Four High-Severity VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighUSN-8913-1Ubuntu libX11 Updates Address Four VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityGHSA-7gxc-w225-f7f3 / CVE-2026-105283ash_typescript 0.19.1 Redacts Internal RPC Error DetailsAsh Project · Developer Tools & Supply ChainVendor advisorySeverity: MediumRHSA-2026:80664Red Hat Environment Modules Update Addresses CVE-2026-85013Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:80675Red Hat libxml2 Update Fixes CVE-2026-86142Red Hat · Linux & Operating SystemsVendor advisorySeverity: MediumRHSA-2026:80663Red Hat TFTP Update Addresses CVE-2026-85234Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:80605Red Hat cjose Update Fixes Critical RHEL 10 VulnerabilityRed Hat · Linux & Operating SystemsVendor advisorySeverity: CriticalOSA-2026-10 / OSA-2026-11 / OSA-2026-12 / OSA-2026-13 / OSA-2026-14 / OSA-2026-15 / OSA-2026-16 / OSA-2026-17 / OSA-2026-18OTRS 2026.7.1 Addresses Nine Security VulnerabilitiesOTRS · Application Platforms & MiddlewareVendor advisorySeverity: Medium to CriticalCVE-2026-105407 / CVE-2026-105408 / CVE-2026-105409 / CVE-2026-105410 / CVE-2026-105411 / CVE-2026-105412Dassault Systèmes Publishes Six Tuleap Enterprise Security AdvisoriesDassault Systèmes · Application Platforms & MiddlewareVendor advisorySeverity: HighRHSA-2026:80511Red Hat Updates curl and libcurl on RHEL 9.8 EUSRed Hat · Linux & Operating SystemsVendor advisorySeverity: MediumRHSA-2026:80498Red Hat Flatpak Update Addresses Four RHEL 10 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:80495 / RHSA-2026:80496Red Hat Flatpak Builder Updates Fix CVE-2026-86320Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:80509Red Hat GIMP Update Addresses Thirteen RHEL 9 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighVU#162329CERT/CC Warns of Eleven Vulnerabilities in Thelia 2.6.0 and 2.6.1Thelia · Web Applications & E-CommerceVendor advisorySeverity: Not provided by the authorityGitLab Critical Patch Release 19.4.2 / 19.3.4 / 19.2.8GitLab Critical Patch Release Fixes 24 Security Vulnerabilities (24 CVEs)GitLab · Developer Tools & Supply ChainVendor advisorySeverity: Low to CriticalBOSCH-SA-069646Bosch Rexroth PRI7000 Updates Bundled 7-Zip for CVE-2026-14266Bosch Rexroth · Industrial & Operational TechnologyVendor advisorySeverity: Highngx_cache_purge 3.0.4 / CVE-2026-108981ngx_cache_purge 3.0.4 Restricts Symlink Traversalnginx-modules · Web & Application ServersVendor advisorySeverity: LowGHSA-5g9q-h8wq-rrf3 / GHSA-6gp4-cwf7-2vp8 / GHSA-6mcj-5jw8-ff36 / GHSA-84v8-vgp5-4vc9 / GHSA-rgw4-3qr8-pp36Zephyr Discloses Five Embedded and Bluetooth Availability FlawsZephyr Project · Embedded & IoTVendor advisorySeverity: Medium to HighGHSA-6c27-994x-c52f / CVE-2026-97853 / Decimal 3.1.2Decimal 3.1.2 Fixes Unbounded Rounding AllocationDecimal Project · Application Platforms & MiddlewareVendor advisorySeverity: MediumCVE-2026-103501 / CVE-2026-103513 / CVE-2026-103634 / CVE-2026-103635 / CVE-2026-103636 / Apache DataSketches C++ 5.3.0Apache DataSketches C++ 5.3.0 Hardens Five Deserialization PathsApache Software Foundation · Application Platforms & MiddlewareVendor advisorySeverity: Low to ModerateSA-202610-1743956 / SA-202610-1743919 / SA-202610-1743926 / SA-202610-1743952 / SA-202610-1743906ZTE Z80 Ultra Build B28MR2 Fixes Five Information-Disclosure FlawsZTE · Android & Mobile ComponentsVendor advisorySeverity: Low to MediumRHSA-2026:80217Red Hat Hardened Images Update OpenTelemetry Collector for AMQP Denial of ServiceRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:80172Red Hat Hardened Images Update Poppler for PDF Decryption OverflowRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium2026-133-AWSAWS Amplify Updates Fix Cross-Owner GraphQL Record AccessAmazon Web Services · Cloud & OrchestrationVendor advisorySeverity: Not provided by the authorityUSN-8911-1Ubuntu OEM Kernel Update Addresses 29 Vulnerabilities (29 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:79784Red Hat RHEL 9.6 EUS Kernel Update Fixes CVE-2026-74705Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:79782Red Hat RHEL 8.8 SAP and TUS Kernel Update Fixes Two VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:79783Red Hat RHEL 8.6 AUS and EUS Kernel Update Addresses Three VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighXSA-522Xen XSA-522 Patch Prevents Network Backend Guest CrashesXen Project · Virtualization & ContainersVendor advisorySeverity: Not provided by the authorityUSN-8887-3Ubuntu 7.0 Kernel Updates Address 1,050 Vulnerabilities (1050 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8875-2Ubuntu NVIDIA Kernel Update Addresses 951 Vulnerabilities (951 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8903-2Ubuntu Kernel Updates Address 232 Vulnerabilities (232 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8905-2Ubuntu GCP Kernel Update Addresses 233 Vulnerabilities (233 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:79778Red Hat RHEL 8.4 AUS and EUS Kernel Update Fixes Two VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighCVE-2026-87108 / CVE-2026-87109 / CVE-2026-87110MongoDB Ops Manager 8.0.27 Fixes Three Authorization and Availability VulnerabilitiesMongoDB · Databases & Data PlatformsVendor advisorySeverity: Low to MediumRHSA-2026:79717Red Hat Hardened Images gzip Update Fixes Two VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Low to MediumRHSA-2026:79575Red Hat Advanced Cluster Security 4.11.5 Fixes Two VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:79546Red Hat Quay 3.12.23 Addresses Fourteen VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:73866 / RHSA-2026:73864Red Hat OpenShift 4.14.75 Updates Address Eight VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:73851Red Hat OpenShift 4.16.72 RHCOS Update Fixes Three VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:79281Red Hat glibc Update Addresses Six RHEL 9 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: MediumCISA KEV: CVE-2023-22894CISA Adds Strapi Sensitive-Data Exposure to KEVStrapi · Web Applications & E-CommerceVendor advisorySeverity: Not provided by the authorityCISA KEV: CVE-2021-3199CISA Adds ONLYOFFICE Docs Path Traversal to KEVONLYOFFICE · Collaboration & ProductivityVendor advisorySeverity: Not provided by the authorityCISA KEV: CVE-2016-3081CISA Adds Apache Struts Command Injection to KEVApache · Application Platforms & MiddlewareVendor advisorySeverity: Not provided by the authorityCISA KEV: CVE-2015-5477CISA Adds ISC BIND TKEY Denial of Service to KEVISC · Network InfrastructureVendor advisorySeverity: Not provided by the authorityCISA KEV: CVE-2015-3306CISA Adds ProFTPD Arbitrary File Access to KEVProFTPD · Web Servers & InfrastructureVendor advisorySeverity: Not provided by the authorityUSN-8910-1Ubuntu libxml2 Updates Fix Six VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:79162Red Hat BIND Update Addresses Three RHEL 8 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: High2026-131-AWSAWS CDK 2.267.0 Restricts Symlinks in Docker Asset BundlingAmazon Web Services · Developer Tools & Supply ChainVendor advisorySeverity: Not provided by the authorityRHSA-2026:78951Red Hat kbd Update Fixes CVE-2026-72693 on RHEL 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:79160Red Hat BIND 9.16 Update Addresses Eight RHEL 8.8 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:74797Red Hat MicroShift 4.20.41 Fixes Five VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: High2026-130-AWSAWS databases-on-aws 1.7.1 Blocks Agent-Assisted Command InjectionAmazon Web Services · Artificial Intelligence & SaaSVendor advisorySeverity: Not provided by the authorityRHSA-2026:79371Red Hat Dovecot Update Addresses Eight RHEL 10 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: High to CriticalRHSA-2026:79378Red Hat Ansible Automation Platform 2.7 Addresses Thirteen VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: High to CriticalRHSA-2026:79376 / RHSA-2026:79377 / RHSA-2026:79379 / RHSA-2026:79380Red Hat Satellite 6.18 IOP Containers Address Three VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: High2026-129-AWSAWS Toolkit for VS Code 4.10.0 Secures Cached CodeCatalyst TokensAmazon Web Services · Developer Tools & Supply ChainVendor advisorySeverity: Not provided by the authorityRHSA-2026:79372 / RHSA-2026:79373Red Hat Satellite 6.19 IOP Containers Fix CVE-2026-78677Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighUSN-8909-1Ubuntu libde265 Update Fixes CVE-2026-88373Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:76739Red Hat RHEL 9 Kernel Update Addresses 38 Vulnerabilities (38 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:79368Red Hat OpenShift Tempo 3.11.2 Fixes Four VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:77689Red Hat RHEL 9.8 Kernel Update Addresses Fourteen VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighHCSEC-2026-44HashiCorp go-getter Updates Block S3 and GCS Path TraversalHashiCorp · Developer Tools & Supply ChainVendor advisorySeverity: Not provided by the authorityRHSA-2026:79217Red Hat Directory Server 11.5 Update Addresses Eight VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to CriticalRHSA-2026:79118Red Hat libxml2 Update Fixes CVE-2025-6170 on RHEL 9.2Red Hat · Linux & Operating SystemsVendor advisorySeverity: LowAA26-281ACISA AA26-281A: Chinese Government-Linked Campaign Targets Sensitive DataCISA · Threat Intelligence & Incident ResponseVendor advisorySeverity: Not provided by the authorityRHSA-2026:76918 / RHSA-2026:77396 / RHSA-2026:80510 / RHSA-2026:80514Red Hat OpenSSL Fixes Expand to RHEL Compatibility PackagesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:79114Red Hat dracut Update Addresses Two RHEL 6 ELS VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:79131 / RHSA-2026:79192Red Hat Hardened Images Updates Address HDF5 and libXtst VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:78952Red Hat TFTP Update Fixes CVE-2026-85234 on RHEL 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:77021 / RHSA-2026:77018 / RHSA-2026:77017Red Hat Python Updates Address Two Vulnerabilities on RHEL 9 and 10Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:76750Red Hat Node.js 22 Update Addresses Two RHEL 9 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:77219Red Hat RHEL 9.6 EUS Kernel Update Addresses Sixteen VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:77297 / RHSA-2026:80505Red Hat RESTEasy Fix Expands Across RHEL 9.4 and 9.6Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:76744Red Hat OpenTelemetry Collector Update Fixes CVE-2026-84445Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:79088Red Hat Developer Hub 1.10.5 Addresses 56 Vulnerabilities (56 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to CriticalRHSA-2026:77498Red Hat RHEL 8 Kernel Update Addresses Three VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:76755Red Hat FreeRDP Update Addresses Six RHEL 9 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:76760Red Hat Perl DBI Update Fixes CVE-2026-88815 on RHEL 9Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:77634Red Hat RHEL 10 EUS Kernel Update Addresses Ten VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:77631 / RHSA-2026:77627 / RHSA-2026:77632 / RHSA-2026:80503Red Hat Thunderbird 140.15 Fixes Expand to RHEL 9.6 EUSRed Hat · Linux & Operating SystemsVendor advisorySeverity: Low to HighRHSA-2026:78843 / RHSA-2026:78844Red Hat RHEL 7 ELS Kernel Updates Fix CVE-2025-40026Red Hat · Linux & Operating SystemsVendor advisorySeverity: MediumRHSA-2026:73854 / RHSA-2026:73853Red Hat OpenShift 4.16.72 Security Updates Address Ten VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: High to CriticalRHSA-2026:73870 / RHSA-2026:73869Red Hat OpenShift 4.14.75 Security Updates Address Eleven VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: High to CriticalICSA-26-281-03CISA ICSA-26-281-03: Satel Netco Design 2.1.7 Fixes Four VulnerabilitiesSatel · Industrial Control SystemsVendor advisorySeverity: Medium to HighICSA-26-281-02CISA ICSA-26-281-02: Patch openPDC and openHistorian OT Data SystemsGrid Protection Alliance · Industrial Control SystemsVendor advisorySeverity: Medium to CriticalICSA-26-281-01CISA ICSA-26-281-01: Update Red Lion N-Tron 700 Series SwitchesRed Lion Controls · Industrial Control SystemsVendor advisorySeverity: Medium to HighCVE-2023-22894Strapi Cleartext Storage of Sensitive Information VulnerabilityStrapi · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2021-3199ONLYOFFICE Docs Server Path Traversal VulnerabilityONLYOFFICE · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2016-3081Apache Struts Command Injection VulnerabilityApache · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2015-5477 ISC BIND Data Processing Errors VulnerabilityISC · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2015-3306ProFTPD Improper Access Control VulnerabilityProFTPD · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedHCSEC-2026-43HashiCorp Vault Updates Correct Non-Canonical ACL Policy EvaluationHashiCorp · Identity & Access ManagementVendor advisorySeverity: Not provided by the authorityHCSEC-2026-42HashiCorp Vault Enterprise Update Corrects Cross-Namespace ACL ResolutionHashiCorp · Identity & Access ManagementVendor advisorySeverity: Not provided by the authorityHCSEC-2026-41HashiCorp Vault Updates Block Snapshot-Restored Plugin Code ExecutionHashiCorp · Identity & Access ManagementVendor advisorySeverity: Not provided by the authorityHCSEC-2026-40HashiCorp Vault Updates Prevent Unverified ACME Certificate IdentitiesHashiCorp · Identity & Access ManagementVendor advisorySeverity: Not provided by the authority2026-128-AWSAWS Reports Remediated Athena Cross-Account Metadata ExposureAmazon Web Services · Cloud & OrchestrationVendor advisorySeverity: Not provided by the authorityUSN-8900-1Ubuntu Go Networking Update Fixes Eight VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityChromeOS LTC 150.0.7871.256Google ChromeOS LTC 150 Update Fixes 43 Security Issues (43 CVEs)Google Chrome · Web BrowsersVendor advisorySeverity: Not provided by the authorityRHSA-2026:77610Red Hat Firefox 140.15 Update Addresses Ten RHEL 10 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:76952Red Hat JBoss Web Server 7.0.2 Addresses Eleven Tomcat VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Low to HighRHSA-2026:77359Red Hat Vim Update Fixes Arbitrary Command Execution on RHEL 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:77500Red Hat Real-Time Kernel Update Addresses Three RHEL 8 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighLSN-0122-1Ubuntu Livepatch 122 Addresses 150 Kernel Vulnerabilities (150 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:77532Red Hat Service Telemetry Framework 1.5.7 Addresses Seven VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:77372 / RHSA-2026:77370 / RHSA-2026:77371Red Hat mod_auth_openidc Updates Fix CVE-2026-53938 on RHEL 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:77484Red Hat Hardened Images GnuPG Update Fixes CVE-2026-105712Red Hat · Linux & Operating SystemsVendor advisorySeverity: LowRHSA-2026:77301Red Hat RHEL 8.8 SAP and TUS Kernel Update Addresses 18 Vulnerabilities (18 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:77218Red Hat RHEL 9.4 SAP Kernel Update Addresses 21 Vulnerabilities (21 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:74435 / RHSA-2026:74434 / RHSA-2026:74433Red Hat OpenShift 4.19.50 Addresses Seventeen Vulnerabilities (17 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:77215Red Hat RHEL 9.2 SAP Kernel Update Addresses Ten VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:77214Red Hat Real-Time Kernel Update Addresses Ten VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:76993Red Hat OpenSSH Update Addresses Six RHEL 9 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:76877Red Hat Ghostscript Update Fixes CVE-2026-39919 on RHEL 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:76945Red Hat Python 3.9 Update Addresses Three RHEL 9 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:76762Red Hat Perl DBI Update Fixes CVE-2026-88815 on RHEL 10Red Hat · Linux & Operating SystemsVendor advisorySeverity: High2026-127-AWSAWS Fixes Code Injection and SSRF in Bedrock AgentCore Starter ToolkitAmazon Web Services · Cloud & OrchestrationVendor advisorySeverity: Not provided by the authorityUSN-8892-1Ubuntu Pro for WSL Update Protects Attach TokensUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:74796Red Hat MicroShift 4.21.36 Addresses Five VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighESA-2026-194Elastic Agent and Endpoint Update Prevents Windows Protection CrashesElastic · Search & AnalyticsVendor advisorySeverity: MediumESA-2026-187 / ESA-2026-191 / ESA-2026-193Elastic Kibana Updates Address Three Fleet Security IssuesElastic · Search & AnalyticsVendor advisorySeverity: Medium to HighESA-2026-185 / ESA-2026-188 / ESA-2026-189 / ESA-2026-190 / ESA-2026-192 / ESA-2026-195 / ESA-2026-196 / ESA-2026-197 / ESA-2026-198 / ESA-2026-199Elastic Publishes Ten Elasticsearch Security AdvisoriesElastic · Search & AnalyticsVendor advisorySeverity: Medium to HighRHSA-2026:76894 / RHSA-2026:76895Red Hat Firefox 140.15 Updates Address Ten VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:77004Red Hat Hardened Images Update Fixes CVE-2026-58649Red Hat · Linux & Operating SystemsVendor advisorySeverity: MediumRHSA-2026:74380 / RHSA-2026:74377Red Hat OpenShift 4.20.41 Addresses Ten VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:76844Red Hat firewalld Update Fixes CVE-2026-4948 on RHEL 9Red Hat · Linux & Operating SystemsVendor advisorySeverity: MediumRHSA-2026:76763Red Hat Dovecot Update Addresses Eight RHEL 8 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: High to CriticalChrome 155 Stable 2026-10-06Google Chrome 155 Stable Update Fixes 247 Security Issues (247 CVEs)Google Chrome · Web BrowsersVendor advisorySeverity: Not provided by the authorityUSN-8890-1Ubuntu libsoup Updates Address Eight VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8887-1 / USN-8888-1 / USN-8889-1Ubuntu 7.0 Kernel Updates Address Broad Vulnerability Sets (1151 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:76748Red Hat OpenSSH Update Fixes Seven RHEL 10 EUS FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:76747Red Hat FreeRDP Update Fixes Six RHEL 8 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:76743Red Hat Updates OpenTelemetry Collector on RHEL 10Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:76746 / RHSA-2026:76741 / RHSA-2026:76740 / RHSA-2026:76742Red Hat Firefox 140.15 Updates Extended RHEL BranchesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:76734 / RHSA-2026:76733Red Hat Updates rpm-sequoia on RHEL 9 and 10Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighUSN-8882-1Ubuntu Tesseract Updates Fix Ten VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:75768Red Hat Fixes an Important Vim Flaw on RHEL 9Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighUSN-8881-1Ubuntu FreeType Update Fixes CVE-2026-95512Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8880-1Ubuntu FreeRDP Updates Address Multiple Security IssuesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8874-1Ubuntu sg3_utils Update Fixes CVE-2026-16313Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8878-1 / USN-8879-1 / USN-8875-1Ubuntu 5.15 Kernel Updates Address Broad Vulnerability Sets (973 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityDjango security releases 2026-10-06Django 6.1.2, 6.0.9, and 5.2.18 Fix Four Security IssuesDjango · Application Platforms & MiddlewareVendor advisorySeverity: Low to ModerateICSA-26-279-02CISA Warns of Critical Savannah lwIP SMTP Client Buffer OverflowSavannah lwIP · Industrial Control SystemsVendor advisorySeverity: CriticalRHSA-2026:74384 / RHSA-2026:74430 / RHSA-2026:74383 / RHSA-2026:74429 / RHSA-2026:74427Red Hat OpenShift 4.21.36 and 4.22.17 Address Ten VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighMFSA 2026-104Mozilla Firefox 157.0.1 Fixes a File-Handling Mitigation BypassMozilla · Web BrowsersVendor advisorySeverity: ModerateUSN-8872-1Ubuntu libxmltok Updates Fix Two VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:76430 / RHSA-2026:76448Red Hat Hardened Grafana Images Address Four VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:76149 / RHSA-2026:76150Red Hat Enterprise Linux AI 3.4.5 Fixes 24 Vulnerabilities (24 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to CriticalRHSA-2026:76145Red Hat Build of Kueue 1.4.3 Fixes a Go VulnerabilityRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:76045Red Hat Fixes Important libpcap Flaw on RHEL 8.10 EUSRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:76132 / RHSA-2026:76134 / RHSA-2026:76129 / RHSA-2026:76130Red Hat Single Sign-On 7.6.13 Fixes 27 Vulnerabilities (27 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to CriticalUSN-8871-1Ubuntu Raspberry Pi Kernel Updates Address Security Flaws (21 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8851-3Ubuntu Azure Kernel Updates Address Security FlawsUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8868-1Ubuntu LibreOffice Updates Fix Multiple VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8867-1Ubuntu Ceph Update Fixes a VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:75746 / RHSA-2026:75747Red Hat RHEL 8 Kernel Updates Fix 29 Vulnerabilities (29 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighUSN-8865-1Ubuntu EDK II Updates Fix Four VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:75680 / RHSA-2026:80500Red Hat gd Fixes Expand to RHEL 10.0 Extended SupportRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:75674 / RHSA-2026:75673Red Hat Fixes Critical MariaDB Connector Flaw on RHEL 8 and 9Red Hat · Linux & Operating SystemsVendor advisorySeverity: CriticalRHSA-2026:75576Red Hat RHEL 10 Kernel Update Fixes Two VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:75689Red Hat Updates rhc-worker-script for RHEL 7 ELSRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:75583Red Hat Fixes Two libvirt Flaws on RHEL 10Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:75577Red Hat BIND Update Fixes Five RHEL 10 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:75652 / RHSA-2026:75654 / RHSA-2026:75655 / RHSA-2026:75657 / RHSA-2026:75658 / RHSA-2026:75659 / RHSA-2026:75660Red Hat AI Base Images 3.5.2 Address Component Vulnerabilities (35 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Low to HighRHSA-2026:75570Red Hat FreeRDP Update Fixes 11 RHEL 10 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:75581Red Hat Fixes mod_auth_openidc on RHEL 10Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:75582Red Hat Updates librabbitmq on RHEL 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: MediumRHSA-2026:75573Red Hat Fixes Dogtag PKI Profile Import Code Execution on RHEL 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:75580 / RHSA-2026:75579 / RHSA-2026:75571Red Hat Fixes Sudo Time-Window Authorization Bypass on RHEL 8–10Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:75560Red Hat Updates the RHEL 10.0 EUS Kernel for 19 Vulnerabilities (19 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighMediaTek October 2026 Product Security BulletinMediaTek October 2026 Bulletin Fixes 31 Chipset Vulnerabilities (31 CVEs)MediaTek · Android & Mobile ComponentsVendor advisorySeverity: Critical (highest official severity; 2 Critical, 9 High, 20 Medium)CVE-2026-21589Atlassian Fixes Critical Arbitrary File Access Across Data Center ProductsAtlassian · Collaboration & DevOpsVendor advisorySeverity: CriticalCVE-2026-88779Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCitrix · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCTX697174 / CISA KEV 2026.10.04Citrix NetScaler Updates Fix CVE-2026-88779Citrix · Network Security & AccessVendor advisorySeverity: High2026-125-AWSAWS Fixes SageMaker Studio Space Startup Command InjectionAmazon Web Services (AWS) · Artificial Intelligence & SaaSVendor advisorySeverity: Not provided by the authority2026-124-AWSAWS Loom 1.7.0 Fixes Authentication and Outbound Request FlawsAmazon Web Services (AWS) · Cloud & Application SecurityVendor advisorySeverity: Not provided by the authorityRHSA-2026:73979Red Hat FreeRDP Update Fixes Critical CVE-2026-91949 on RHEL 10Red Hat · Linux & Operating SystemsVendor advisorySeverity: CriticalRHSA-2026:72785Red Hat Ruby Update Fixes CVE-2026-80212 on RHEL 10Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:73511Red Hat Updates GNU Awk on RHEL 8 for Two VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: MediumRHSA-2026:72831Red Hat Releases RHEL 10 Kernel Live Patches for Three VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:74858 / RHSA-2026:74861 / RHSA-2026:74865 / RHSA-2026:74868 / RHSA-2026:74869 / RHSA-2026:74871 / RHSA-2026:74872 / RHSA-2026:74922 / RHSA-2026:74948 / RHSA-2026:74952Red Hat Hardened Images Updates Address 24 Vulnerabilities (24 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Low to HighRHSA-2026:74457Red Hat Updates Ghostscript on RHEL 9 for CVE-2026-39919Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighUSN-8864-1Ubuntu Kernel Updates Fix Three Vulnerabilities on Trusty and XenialUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8816-4Ubuntu GKE Kernel Update Fixes 101 Vulnerabilities (101 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8818-6Ubuntu FIPS Kernel Update Fixes Twenty Vulnerabilities (20 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8851-2Ubuntu Linux Kernel Update for Raspberry Pi Fixes Three VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityChrome 154 Stable Desktop 2026-10-01 / Chrome 154 Stable Android 2026-10-01Google Chrome 154 Stable Update Fixes Eleven VulnerabilitiesGoogle · Web BrowsersVendor advisorySeverity: Not provided by the authorityCVE-2026-90970GitLab AI Gateway Updates Fix Critical CVE-2026-90970GitLab · Artificial Intelligence & SaaSVendor advisorySeverity: CriticalCVE-2026-102490Zammad GmbH Zammad Improper Privilege Management VulnerabilityZammad GmbH · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-102489Zammad GmbH Zammad Session Fixation VulnerabilityZammad GmbH · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedRHSA-2026:74612 / RHSA-2026:74613Red Hat Updates Performance Co-Pilot on RHEL 8 for Four VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:73981Red Hat JBoss Web Server 6.2.5 Addresses Thirteen VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Low to HighRHSA-2026:74504 / RHSA-2026:74506Red Hat Satellite 6.18.10 and 6.16.14 Address Critical Vulnerabilities (24 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to CriticalRHSA-2026:74791Red Hat Gatekeeper 3.20.1 Fixes Two High-Severity VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:74771Red Hat AI Base Images 3.5.2 Updates the Gaudi Variant (35 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Low to High2026-123-AWSAWS Powertools for Lambda Fixes Data-Masking Fail-OpenAmazon Web Services (AWS) · Developer Tools & Supply ChainVendor advisorySeverity: Not provided by the authorityRHSA-2026:74674 / RHSA-2026:74677 / RHSA-2026:74678 / RHSA-2026:74679 / RHSA-2026:74681 / RHSA-2026:74683 / RHSA-2026:74685 / RHSA-2026:74687 / RHSA-2026:74688Red Hat AI Base Images 3.4.3 Fix Vulnerabilities Across Nine Variants (83 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Low to High2026-122-AWSAWS Updates Amazon Ion Python for Recursion Denial of ServiceAmazon Web Services (AWS) · Developer Tools & Supply ChainVendor advisorySeverity: Not provided by the authority2026-121-AWSAWS Fixes Diff-Scan Argument Injection in security-agent-mcp-serverAmazon Web Services · Cloud & Application SecurityVendor advisorySeverity: Not provided by the authorityUSN-8863-1Ubuntu USN-8863-1 Updates GStreamer Good Plugins for Four VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authority2026-120-AWSAWS EFS CSI Driver 3.5.0 Fixes Mount Option InjectionAmazon Web Services (AWS) · Cloud & OrchestrationVendor advisorySeverity: Not provided by the authorityUSN-8862-1Ubuntu USN-8862-1 Fixes libXpm VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8861-1Ubuntu USN-8861-1 Fixes OpenSSL VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityApache HTTP Server 2.4.69Apache HTTP Server 2.4.69 Fixes Twenty Vulnerabilities (20 CVEs)Apache Software Foundation · Web Servers & InfrastructureVendor advisorySeverity: Low to ModerateUSN-8860-1Ubuntu USN-8860-1 Fixes OpenStack Designate VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8857-1Ubuntu USN-8857-1 Fixes KCoreAddons VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityJCI-PSA-2026-19 / JCI-PSA-2026-20 / JCI-PSA-2026-30 / ICSA-26-274-04 / ICSA-26-274-05Johnson Controls Releases EasyIO Neo Firmware and Hardware FixesJohnson Controls · Operational Technology & ICSVendor advisorySeverity: Low to MediumICSA-26-274-06CISA Warns of Missing Authorization in Meari IoT Cloud PlatformMeari · Operational Technology & ICSVendor advisorySeverity: Medium to HighICSA-26-274-03CISA Details ABB PCM600 Scheduler Privilege RisksABB · Operational Technology & ICSVendor advisorySeverity: MediumICSA-26-274-02CISA Warns of Critical Authentication Gaps in Monta Charging ServicesMonta · Operational Technology & ICSVendor advisorySeverity: Medium to CriticalICSA-26-274-01Armatura One Updates Fix Critical Code Execution and Credential FlawsArmatura · Operational Technology & ICSVendor advisorySeverity: Medium to CriticalICSA-26-254-01CISA Malcolm Update Addresses Fifteen Security VulnerabilitiesCISA · Operational Technology & ICSVendor advisorySeverity: Low to HighTNS-2026-26Tenable Nessus 10.12.5 Fixes Nine VulnerabilitiesTenable · Vulnerability ManagementVendor advisorySeverity: Low to CriticalJCI-PSA-2026-12Johnson Controls Warns of High-Severity EasyIO FG VulnerabilitiesJohnson Controls · Operational Technology & ICSVendor advisorySeverity: HighFG-IR-26-175Fortinet Warns of Exploited FortiMail Path TraversalFortinet · Email SecurityVendor advisorySeverity: CriticalCVE-2026-86950CISA Adds Exploited Apple File-Processing Flaw to KEVApple · Endpoint Operating SystemsVendor advisorySeverity: Not provided by the authorityCVE-2026-104286Fortinet FortiMail Path Traversal VulnerabilityFortinet · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedALAS2023LIVEPATCH-2026-389 / ALAS2023LIVEPATCH-2026-390 / ALAS2023LIVEPATCH-2026-391 / ALAS2023LIVEPATCH-2026-392 / ALAS2023LIVEPATCH-2026-393 / ALAS2023LIVEPATCH-2026-394 / ALAS2023LIVEPATCH-2026-395 / ALAS2023LIVEPATCH-2026-396 / ALAS2023LIVEPATCH-2026-397 / ALAS2023LIVEPATCH-2026-398 / ALAS2023LIVEPATCH-2026-399 / ALAS2023LIVEPATCH-2026-400 / ALAS2023LIVEPATCH-2026-401 / ALAS2023LIVEPATCH-2026-402 / ALAS2023LIVEPATCH-2026-403 / ALAS2023LIVEPATCH-2026-404 / ALAS2023LIVEPATCH-2026-405 / ALAS2023LIVEPATCH-2026-406 / ALAS2023LIVEPATCH-2026-407 / ALAS2023LIVEPATCH-2026-408 / ALAS2023LIVEPATCH-2026-409 / ALAS2023LIVEPATCH-2026-410 / ALAS2023LIVEPATCH-2026-411 / ALAS2023LIVEPATCH-2026-412 / ALAS2023LIVEPATCH-2026-413 / ALAS2023LIVEPATCH-2026-414 / ALAS2023LIVEPATCH-2026-415 / ALAS2023LIVEPATCH-2026-416 / ALAS2023LIVEPATCH-2026-417 / ALAS2023LIVEPATCH-2026-418 / ALAS2023LIVEPATCH-2026-419 / ALAS2023LIVEPATCH-2026-420 / ALAS2023LIVEPATCH-2026-421 / ALAS2023LIVEPATCH-2026-422 / ALAS2023LIVEPATCH-2026-423Amazon Linux Publishes Thirty-Five Live Patches for CVE-2026-80521Amazon Web Services (AWS) · Linux & Operating SystemsVendor advisorySeverity: ImportantALAS2023-2026-3149Amazon Linux Updates SSM Agent for Four VulnerabilitiesAmazon Web Services (AWS) · Linux & Operating SystemsVendor advisorySeverity: CriticalALAS2023-2026-3146 / ALAS2023-2026-3147 / ALAS2023-2026-3148Amazon Linux 2023 Kernel Updates Address CVE-2026-80521Amazon Web Services (AWS) · Linux & Operating SystemsVendor advisorySeverity: ImportantDSA-6533-1Debian DSA-6533-1 Updates firefox-esr for Security Vulnerabilities (62 CVEs)Debian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityDSA-6532-1Debian DSA-6532-1 Updates tor for a Security VulnerabilityDebian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8858-1Ubuntu USN-8858-1 Fixes Authen::SASL VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8859-1Ubuntu USN-8859-1 Fixes ImageMagick VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8855-1Ubuntu USN-8855-1 Fixes GStreamer Bad Plugins VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8856-1Ubuntu USN-8856-1 Fixes Kdenlive, MLT VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8845-1Ubuntu USN-8845-1 Fixes GVfs VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8816-3Ubuntu USN-8816-3 Fixes Linux kernel (Oracle) Vulnerabilities (101 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityCVE-2026-76504Cisco Fixes Exploited Catalyst SD-WAN Manager Authentication BypassCisco · Network InfrastructureVendor advisorySeverity: CriticalDSA-6531-1Debian DSA-6531-1 Updates openssl for Security VulnerabilitiesDebian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityMFSA 2026-103Mozilla MFSA 2026-103 Fixes Security Vulnerabilities in Thunderbird 153.4 (63 CVEs)Mozilla · Email & CollaborationVendor advisorySeverity: HighMFSA 2026-102Mozilla MFSA 2026-102 Fixes Security Vulnerabilities in Thunderbird 140.17 (44 CVEs)Mozilla · Email & CollaborationVendor advisorySeverity: HighMFSA 2026-101Mozilla MFSA 2026-101 Fixes Security Vulnerabilities in Thunderbird 157 (76 CVEs)Mozilla · Email & CollaborationVendor advisorySeverity: HighDSA-6530-1Debian DSA-6530-1 Updates pcre2 for a Security VulnerabilityDebian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityDSA-6529-1Debian DSA-6529-1 Updates libwebsockets for Security VulnerabilitiesDebian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityChrome 154 Stable Desktop 2026-09-29Google Chrome 154 Stable Fixes Thirty-Two Security Vulnerabilities (32 CVEs)Google · Web BrowsersVendor advisorySeverity: Critical to Low2026-119-AWSAWS Updates GluonTS for Unsafe Model DeserializationAmazon Web Services · Cloud & Application SecurityVendor advisorySeverity: Not provided by the authorityUSN-8818-3Ubuntu USN-8818-3 Updates Cloud and IoT Kernels for 20 Vulnerabilities (20 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8819-3Ubuntu USN-8819-3 Updates Azure and AWS Kernels for Three VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8842-1Ubuntu USN-8842-1 Updates NVIDIA Kernels for 18 Vulnerabilities (18 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8728-3Ubuntu USN-8728-3 Updates the Oracle Kernel for 1,417 Vulnerabilities (1417 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8816-2Ubuntu USN-8816-2 Updates GCP and OEM Kernels for 101 Vulnerabilities (101 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8729-6Ubuntu USN-8729-6 Updates AWS Kernels for 97 Vulnerabilities (97 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:73017 / RHSA-2026:73018Red Hat Updates cjose for CVE-2026-53938 Across RHEL 9 SAP Solutions BranchesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:73026 / RHSA-2026:73027Red Hat Updates FreeRDP for CVE-2026-55193 Across RHEL 8.4 and 8.6 Extended BranchesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighDSA-6527-1Debian Updates rsync for 33 Access, Disclosure, and Code-Execution Flaws (33 CVEs)Debian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8487-2Ubuntu USN-8487-2 Corrects the curl CVE-2026-8927 FixUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityDSA-6526-1Debian Updates Dovecot for 25 Mail-Server Vulnerabilities (25 CVEs)Debian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityDSA-6525-1Debian Updates WordPress for XSS, Privilege Escalation, and RCEDebian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityDSA-6524-1Debian Updates Flatpak for Eight Sandbox VulnerabilitiesDebian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityCVE-2026-101891 / CVE-2026-86102 / CVE-2026-87969WatchGuard AP 3.4.8 Fixes Three Access and Command-Injection VulnerabilitiesWatchGuard · Network Security & MonitoringVendor advisorySeverity: High to CriticalUSN-8839-1Ubuntu USN-8839-1 Fixes Atril VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8838-1Ubuntu USN-8838-1 Fixes catdoc VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8837-1Ubuntu USN-8837-1 Fixes pdfminer VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8835-1Ubuntu USN-8835-1 Fixes Emacs VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8832-1Ubuntu USN-8832-1 Fixes Booth VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8830-1Ubuntu USN-8830-1 Fixes phpseclib VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8829-1Ubuntu USN-8829-1 Fixes Plasma Workspace VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8828-1Ubuntu USN-8828-1 Fixes dracut VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8827-1Ubuntu USN-8827-1 Fixes Erlang Vulnerabilities (19 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8836-1Ubuntu USN-8836-1 Fixes FreeRDP VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8834-1Ubuntu USN-8834-1 Fixes Exim VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8833-1Ubuntu USN-8833-1 Fixes libvirt VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8831-1Ubuntu USN-8831-1 Fixes libvirt VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityDSA-6523-1Debian Updates libheif for Seven Image-Processing VulnerabilitiesDebian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8826-1Ubuntu USN-8826-1 Fixes LXC VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:72277 / RHSA-2026:72278Red Hat RRDtool Updates Fix RHEL 9 Memory-Safety FlawRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:72280Red Hat Tesseract Update Fixes RHEL 9 Parsing FlawRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:72287Red Hat Libreswan Update Fixes Four RHEL 8 Network FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:72276Red Hat Updates Git LFS for Twelve RHEL 9 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:67857Red Hat OpenShift 4.15.69 Addresses Seventeen Vulnerabilities (17 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to Critical3ADR011566ABB Automation Builder 2.9.1 Fixes Project File Code ExecutionABB · Industrial & Operational TechnologyVendor advisorySeverity: High3ADR011565ABB AC500 V3 Firmware Fixes Web Visualization Denial of ServiceABB · Industrial & Operational TechnologyVendor advisorySeverity: High2NGA003179ABB PCM600 Hotfix Blocks Project-Import Path TraversalABB · Industrial & Operational TechnologyVendor advisorySeverity: Medium2NGA003170ABB PCM600 Scheduler Service Requires Privilege-Escalation WorkaroundABB · Industrial & Operational TechnologyVendor advisorySeverity: MediumGCP-2026-064 / GCP-2026-065 / GCP-2026-066Google Cloud Patches Three Application Integration VulnerabilitiesGoogle Cloud · Cloud & OrchestrationVendor advisorySeverity: High to CriticalDSA-6522-1Debian Updates Exim for SMTP Smuggling and Code Execution FlawsDebian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:70754 / RHSA-2026:72199 / RHSA-2026:72264Red Hat Unbound Updates Expand Across RHEL 7 and 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: CriticalDSA-6521-1Debian Updates Ruby Oj for Eleven Parser VulnerabilitiesDebian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityDSA-6520-1Debian Updates Lemonldap::NG for Three Access-Control FlawsDebian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityhMailServer 6.3.4hMailServer 6.3.4 Fixes Pre-Authentication Script InjectionProgressive Robot Ltd · Collaboration & CommunicationsVendor advisorySeverity: CriticalCTX697096 / CISA KEV 2026.09.27Citrix NetScaler Fixes Eight Flaws; Exploitation ObservedCitrix · Network Security & AccessVendor advisorySeverity: High to CriticalCVE-2026-88772Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCitrix · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-88771Citrix NetScaler Improper Input Validation VulnerabilityCitrix · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCISA KEV: CVE-2026-87902 / GHSA-7hp8-65ch-5whpCISA Adds WordPress Core Remote File Inclusion to KEVWordPress · Web Applications & E-CommerceVendor advisorySeverity: CriticalCISA KEV: CVE-2026-67279CISA Adds MikroTik RouterOS SSH Bypass to KEVMikroTik · Routing, Switching & Wi-FiVendor advisorySeverity: MediumCISA KEV: CVE-2026-65660CISA Adds Microsoft SharePoint Code Injection to KEVMicrosoft · Collaboration & ProductivityVendor advisorySeverity: HighUSN-8729-5Ubuntu Updates AWS FIPS Kernels for Multiple Vulnerabilities (97 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8819-2Ubuntu Updates AWS and GCP Kernels for Three VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8818-2Ubuntu Updates IBM Kernels for Multiple Vulnerabilities (20 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8730-6Ubuntu Fixes Intel IoTG Kernel VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8824-1Ubuntu Fixes libpcap Instruction Validation FlawUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityESA-2026-170 / ESA-2026-176 / ESA-2026-179 / ESA-2026-180 / ESA-2026-182 / ESA-2026-183 / ESA-2026-184Elastic Updates Elasticsearch for Seven Resource-Consumption FlawsElastic · Application Platforms & MiddlewareVendor advisorySeverity: MediumESA-2026-85 / ESA-2026-103 / ESA-2026-139 / ESA-2026-181Elastic Kibana Updates Address Authorization, Privilege, and Availability RisksElastic · Application Platforms & MiddlewareVendor advisorySeverity: Medium to HighwolfSSL 5.9.4wolfSSL 5.9.4 Fixes Eleven TLS and Certificate Validation FlawswolfSSL · Application Platforms & MiddlewareVendor advisorySeverity: Low to HighCVE-2026-87902WordPress Core Remote File Inclusion VulnerabilityWordPress · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-67279Mikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityMikroTik · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-65660Microsoft SharePoint Code Injection VulnerabilityMicrosoft · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedGHSA-pg57-6jwg-q645containerd Updates Bound OCI Image Graph Processingcontainerd · Cloud & OrchestrationVendor advisorySeverity: Medium2026-118-AWSAWS Updates pgcollection to Address Type-Confusion Remote Code ExecutionAmazon Web Services (AWS) · Application Platforms & MiddlewareVendor advisorySeverity: Not provided by the authority2026-117-AWSAWS Kiro IDE 1.0.242 Restricts Agentic Writes from Untrusted WorkspacesAmazon Web Services (AWS) · Developer Tools & Supply ChainVendor advisorySeverity: Not provided by the authorityICSA-26-267-02Eufy Omni C20 and X10 Pro Firmware Update Addresses Three VulnerabilitiesEufy · Internet of Things & Smart DevicesVendor advisorySeverity: Medium to CriticalCVE-2026-71362Adobe Commerce and Magento Incorrect Authorization Vulnerability Adobe · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-5430WSO2 Multiple Products Path Traversal Vulnerability WSO2 · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedRHSA-2026:70797Red Hat RHEL 8.6 Kernel Update Addresses CVE-2026-53266Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighCVE-2026-92419WEBCON BPS Updates Fix Vacation-Data Authorization BypassWEBCON · Web Applications & E-CommerceVendor advisorySeverity: MediumGHSA-gxrg-x694-283wSolspace Freeform 5.10.14 Blocks Twig Template InjectionSolspace Freeform · Web Applications & E-CommerceVendor advisorySeverity: MediumGHSA-5mmc-8pc9-wgggWPGraphQL 2.22.2 Restores Post Capability EnforcementWPGraphQL · Web Applications & E-CommerceVendor advisorySeverity: MediumGHSA-mf2p-wjp4-99pq / GHSA-w998-qmw9-mf4m / GHSA-m8r3-22v6-g877REDAXO 5.21.2 Fixes CSRF and Stored XSS FlawsREDAXO · Web Applications & E-CommerceVendor advisorySeverity: MediumGHSA-j43x-5hjq-rgxfPlug Updates Prevent Parameter-Decoding Denial of ServicePlug · Application Platforms & MiddlewareVendor advisorySeverity: HighGHSA-6cp7-3m3c-5x5c / GHSA-5vjj-2r48-q622Zapros 0.14.0 Bounds Decompression ProcessingZapros · Developer Tools & Supply ChainVendor advisorySeverity: Medium to HighGHSA-rr49-f9g6-c9r5Plone Portlets Updates Fix Critical TALES InjectionPlone · Web Applications & E-CommerceVendor advisorySeverity: CriticalCVE-2026-86677 / CVE-2026-86678 / CVE-2026-86679 / CVE-2026-86681 / CVE-2026-86683 / CVE-2026-86708ManageEngine Applications Manager Updates Address Six VulnerabilitiesManageEngine · Network Security & MonitoringVendor advisorySeverity: High to CriticalCVE-2026-95676WatchGuard AuthPoint 7.5.1 Fixes LDAP Authentication BypassWatchGuard · Identity & Access ManagementVendor advisorySeverity: HighCVE-2026-86243 / CVE-2026-86246 / CVE-2026-86247Apache Tomcat Native Updates Address Three TLS FlawsApache Tomcat · Application Platforms & MiddlewareVendor advisorySeverity: Moderate to ImportantTR-26-1160Global IT Weoll Update Fixes SSRF Token DisclosureGlobal IT · Web Applications & E-CommerceVendor advisorySeverity: MediumRHSA-2026:70630Red Hat IBM Java 8 Update Addresses Four VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Low to MediumTR-26-1159Abis Technology AVESIS Update Fixes Open RedirectAbis Technology · Web Applications & E-CommerceVendor advisorySeverity: MediumCVE-2026-12974Forcepoint Security Engine Updates Fix Policy BypassForcepoint · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-12370 / CVE-2026-14913 / CVE-2026-15358 / CVE-2026-19599 / CVE-2026-75825 / CVE-2026-76978 / CVE-2026-76979 / CVE-2026-76980 / CVE-2026-84787 / CVE-2026-84789 / CVE-2026-84791ManageEngine ITOM Updates Address Eleven VulnerabilitiesManageEngine · Network Security & MonitoringVendor advisorySeverity: High to CriticalCVE-2026-73581 / CVE-2026-75973 / CVE-2026-76183 / CVE-2026-77756 / CVE-2026-77762 / CVE-2026-77791 / CVE-2026-78383 / CVE-2026-78437 / CVE-2026-79677 / CVE-2026-86248 / CVE-2026-86350 / CVE-2026-87022Apache Tomcat Updates Address Twelve Security FlawsApache Tomcat · Application Platforms & MiddlewareVendor advisorySeverity: Low to ImportantCVE-2026-94243 / CVE-2026-94251Apache Sling Security Bundle Updates Address Two Filter BypassesApache Sling · Application Platforms & MiddlewareVendor advisorySeverity: LowCVE-2026-73192 / CVE-2026-91852 / CVE-2026-91928 / CVE-2026-91999 / CVE-2026-92001Apache Sling XSS 2.4.12 Addresses Five Sanitization and Resource FlawsApache Sling · Application Platforms & MiddlewareVendor advisorySeverity: Low to ModerateCVE-2026-31377 / CVE-2026-96443Apache Doris Updates Address Authentication Bypass and JDBC Code ExecutionApache Doris · Application Platforms & MiddlewareVendor advisorySeverity: Moderate to ImportantCVE-2026-15027Changing NHIServiSign Update Fixes OS Command InjectionChanging · Desktop ApplicationsVendor advisorySeverity: HighRHSA-2026:70639 / RHSA-2026:70596Red Hat libxml2 Updates Address CVE-2025-6170Red Hat · Linux & Operating SystemsVendor advisorySeverity: LowFoxit September 23, 2026 Security UpdatesFoxit PDF Reader and Editor Updates Address 31 Vulnerabilities (31 CVEs)Foxit · Desktop ApplicationsVendor advisorySeverity: Moderate to ImportantRHSA-2026:70562 / RHSA-2026:70561Red Hat Qt 5 Updates Address CVE-2026-9499Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighCPE2026-055uniFLOW Online 2026.3 Fixes Legacy UI Session RetentionCanon / NT-ware · Application Platforms & MiddlewareVendor advisorySeverity: MediumCVE-2026-82331Apache BuildStream 2.8.1 Blocks Tar Extraction EscapeApache BuildStream · Developer Tools & Supply ChainVendor advisorySeverity: ModerateRHSA-2026:70391Red Hat CNI Plugins Update Addresses Five RHEL 9 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:70482 / RHSA-2026:70483Red Hat RHEL 9.2 SAP Kernel Updates Address Seven FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighGHSA-4ghv-53cq-7wp3 / GHSA-wx4m-69m9-gx3mHome Assistant Security Update Addresses 2 VulnerabilitiesHome Assistant · Internet of Things & Smart DevicesVendor advisorySeverity: Medium to CriticalGHSA-8fcf-v89g-xpg6Traefik Security Update Addresses 1 VulnerabilityTraefik · Cloud & OrchestrationVendor advisorySeverity: MediumGHSA-gfjv-gqf2-c888Gardener Security Update Addresses 1 VulnerabilityGardener · Cloud & OrchestrationVendor advisorySeverity: MediumGHSA-xj3h-wwxq-gfcj / GHSA-w89x-c962-c44g / GHSA-jvh5-97xg-v99fCloudreve Security Update Addresses 3 VulnerabilitiesCloudreve · Cloud & OrchestrationVendor advisorySeverity: Low to HighGHSA-4825-p4xm-pcf2Spree Security Update Addresses 1 VulnerabilitySpree · Web Applications & E-CommerceVendor advisorySeverity: HighICSA-26-265-09OpenPLC Runtime v4 Replaces Vulnerable End-of-Life v3Autonomy Logic · Industrial & Operational TechnologyVendor advisorySeverity: MediumGHSA-hrmj-7rvj-4hg8 / GHSA-c759-cx9p-mrwq / GHSA-frch-4w6v-q5xx / GHSA-vv3m-f8x4-7377 / GHSA-xpjq-3w4w-w5wrLightRAG Security Update Addresses 5 VulnerabilitiesLightRAG · Artificial Intelligence & SaaSVendor advisorySeverity: Medium to CriticalGHSA-56v6-2fhr-wxgq / GHSA-q4c5-2j6f-r476Nautobot Security Update Addresses 2 VulnerabilitiesNautobot · Network Security & MonitoringVendor advisorySeverity: MediumGHSA-hxp9-w8x3-p566Autobahn Python Security Update Addresses 1 VulnerabilityAutobahn Python · Application Platforms & MiddlewareVendor advisorySeverity: MediumGHSA-vxg7-f2jj-jmqm / GHSA-jpf4-98qj-qr67 / GHSA-xhmx-w2j4-rw3q / GHSA-qgw5-7j4f-fg97 / GHSA-jpvm-9frm-hjcqNuclei Security Update Addresses 5 VulnerabilitiesNuclei · Network Security & MonitoringVendor advisorySeverity: Medium to HighGHSA-456h-ww26-f758 / GHSA-328g-jx67-v94g / GHSA-9xhm-w3wj-xhqhTinyauth Security Update Addresses 3 VulnerabilitiesTinyauth · Identity & Access ManagementVendor advisorySeverity: Medium to HighGHSA-444v-8vxr-p36h / GHSA-59w7-v8rr-pr4p / GHSA-34fc-gh42-pj53 / GHSA-xp3c-3jw3-4vcrOpenBao Security Update Addresses 4 VulnerabilitiesOpenBao · Identity & Access ManagementVendor advisorySeverity: Low to CriticalGHSA-m3c6-2p7h-cfr3 / GHSA-9vm9-pqxx-x83v / GHSA-gfw4-49f9-cp25 / GHSA-5jpj-293f-rhvjKubeEdge Security Update Addresses 4 VulnerabilitiesKubeEdge · Cloud & OrchestrationVendor advisorySeverity: Medium to HighGHSA-cc5h-2pwp-pvcc / GHSA-wv8v-v4c5-v75j / GHSA-w66g-j6c4-hcfc / GHSA-vc25-24vv-fxxm / GHSA-2xj6-xx86-cwwc / GHSA-3r68-hf9h-887v / GHSA-mrq8-fv7v-hhjg / GHSA-f4p7-qx46-wc5j / GHSA-h7wj-5v37-59r2 / GHSA-mfv2-4wvm-9pgp / GHSA-49xv-9743-pw8w / GHSA-f26r-j276-ggg4 / GHSA-6529-c226-h328 / GHSA-6cr4-ccf3-x7h4 / GHSA-4596-2p6p-28cv / GHSA-p6hp-93wp-fh6p / GHSA-g2r2-3j32-j27x / GHSA-5wf4-jqxh-8gm3 / GHSA-6vmq-24h2-pj7j / GHSA-hgcf-4mq8-5266 / GHSA-wrhw-j3f9-8vc6 / GHSA-f6pj-qv47-g96w / GHSA-v9m3-wfh8-5646 / GHSA-g5xv-mhgm-v5f6 / GHSA-93xw-j965-9mx3MCP Atlassian Security Update Addresses 25 Vulnerabilities (25 CVEs)MCP Atlassian · Artificial Intelligence & SaaSVendor advisorySeverity: Medium to CriticalGHSA-7hvx-28gp-mf6j / GHSA-8xcj-9hfr-fh9j / GHSA-5ffh-6f9q-5hhr / GHSA-72h8-wp98-7hchUnleash Security Update Addresses 4 VulnerabilitiesUnleash · Application Platforms & MiddlewareVendor advisorySeverity: Low to HighGHSA-8gr3-5j6f-25gpNovu Security Update Addresses 1 VulnerabilityNovu · Application Platforms & MiddlewareVendor advisorySeverity: MediumGHSA-m9c2-85gv-8xr5Graylog Security Update Addresses 1 VulnerabilityGraylog · Network Security & MonitoringVendor advisorySeverity: MediumGHSA-5vvx-3h34-f3gj / GHSA-7952-gx68-cjqrMPXJ Security Update Addresses 2 VulnerabilitiesMPXJ · Developer Tools & Supply ChainVendor advisorySeverity: Medium to HighGHSA-fq95-v8xc-jm3vFabio Security Update Addresses 1 VulnerabilityFabio · Cloud & OrchestrationVendor advisorySeverity: MediumMMSA-2026-00776 / MMSA-2026-00775Mattermost Updates Fix OAuth SSRF and Plugin Route Denial of ServiceMattermost · Collaboration & CommunicationsVendor advisorySeverity: MediumGHSA-727h-3vm5-qwq6 / GHSA-vc9j-9wph-qghjmppx Security Update Addresses 2 Vulnerabilitiesmppx · Developer Tools & Supply ChainVendor advisorySeverity: MediumGHSA-fjwv-jf2v-j499 / GHSA-g26x-m427-f48f / GHSA-9q4h-f4x5-ffq8 / GHSA-992g-9cr3-vm5xHatchet Security Update Addresses 4 VulnerabilitiesHatchet · Application Platforms & MiddlewareVendor advisorySeverity: Low to MediumGHSA-3mqq-hv9c-85hcWeblate wlc Security Update Addresses 1 VulnerabilityWeblate wlc · Developer Tools & Supply ChainVendor advisorySeverity: LowRHSA-2026:70402 / RHSA-2026:70403Red Hat RHEL 8 Kernel Updates Address Multiple Flaws (20 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighIBM Support 7288830IBM Concert Software 3.0.1.1 Addresses Multiple Vulnerabilities (367 CVEs)IBM · Artificial Intelligence & SaaSVendor advisorySeverity: Low to CriticalGHSA-pg59-5vwg-4jxq / GHSA-8h6x-h86x-75whSIPGO Security Update Addresses 2 VulnerabilitiesSIPGO · Collaboration & CommunicationsVendor advisorySeverity: HighGHSA-89vx-jh4q-vg3wdeepstream.io Security Update Addresses 1 Vulnerabilitydeepstream.io · Application Platforms & MiddlewareVendor advisorySeverity: HighGHSA-r3r9-wp5j-pq5gRequest Filtering Agent Security Update Addresses 1 VulnerabilityRequest Filtering Agent · Developer Tools & Supply ChainVendor advisorySeverity: HighGHSA-cqxr-jxr2-85pq / GHSA-65gg-g7rw-6cpcDasel Security Update Addresses 2 VulnerabilitiesDasel · Developer Tools & Supply ChainVendor advisorySeverity: MediumICSA-26-265-01 / ICSA-26-265-02lwIP Fixes MQTT and API Memory-Corruption VulnerabilitieslwIP · Industrial & Operational TechnologyVendor advisorySeverity: High to CriticalGHSA-ch3g-4xvr-674qOpenCVE Security Update Addresses 1 VulnerabilityOpenCVE · Network Security & MonitoringVendor advisorySeverity: MediumGHSA-8q6g-vjhf-jp8mpsd-tools Security Update Addresses 1 Vulnerabilitypsd-tools · Developer Tools & Supply ChainVendor advisorySeverity: HighGHSA-m8f5-rh7h-vgg3Microsandbox Security Update Addresses 1 VulnerabilityMicrosandbox · Cloud & OrchestrationVendor advisorySeverity: MediumRHSA-2026:70390Red Hat tar Update Fixes Four RHEL 8 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: MediumCVE-2026-28324 / CVE-2026-28325SolarWinds Observability 2026.2.3 Fixes Two Remote Code Execution FlawsSolarWinds · Network Security & MonitoringVendor advisorySeverity: High to CriticalAPSB26-157Adobe Premiere Pro Update Addresses 1 VulnerabilityAdobe · Desktop ApplicationsVendor advisorySeverity: CriticalAPSB26-155Adobe Substance 3D Modeler Update Addresses 4 VulnerabilitiesAdobe · Desktop ApplicationsVendor advisorySeverity: CriticalAPSB26-151Adobe AEM Forms on JEE Update Addresses 6 VulnerabilitiesAdobe · Application Platforms & MiddlewareVendor advisorySeverity: CriticalAPSB26-150Adobe Connect Update Addresses 9 VulnerabilitiesAdobe · Collaboration & CommunicationsVendor advisorySeverity: Important to CriticalAPSB26-148Adobe Bridge Update Addresses 7 VulnerabilitiesAdobe · Desktop ApplicationsVendor advisorySeverity: Important to CriticalAPSB26-147Adobe Content Credentials SDK Update Addresses 7 VulnerabilitiesAdobe · Application Platforms & MiddlewareVendor advisorySeverity: Important to CriticalSecurity Advisory Bulletin 069Ubiquiti UniFi Gateway Updates Fix Six Denial-of-Service FlawsUbiquiti · Routing, Switching & Wi-FiVendor advisorySeverity: HighAPSB26-145Adobe InDesign Update Addresses 2 VulnerabilitiesAdobe · Desktop ApplicationsVendor advisorySeverity: ImportantRHSA-2026:70392 / RHSA-2026:70393 / RHSA-2026:70394 / RHSA-2026:70395Red Hat Web Terminal Operator Updates Address Five FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRTI-SB-2026-09RTI Connext Updates Address Nineteen Vulnerabilities (19 CVEs)RTI · Industrial & Operational TechnologyVendor advisorySeverity: Low to CriticalRHSA-2026:70264Red Hat GStreamer Good Update Fixes Three RHEL 7 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighHPSBGN04141HP Support Assistant 9.55.10.0 Fixes Local Privilege EscalationHP · Endpoint SecurityVendor advisorySeverity: HighGHSA-798p-78g2-v556CKAN MCP Server 0.4.108 Completes SSRF ValidationCKAN MCP Server · Artificial Intelligence & SaaSVendor advisorySeverity: MediumGHSA-274f-6w77-8qm9 / GHSA-92cr-jxw4-5wjg / GHSA-jx63-h26r-8cph / GHSA-29hq-23m2-2j47Sync-in Server Updates Fix 2FA, ReDoS, and Login Enumeration FlawsSync-in · Application Platforms & MiddlewareVendor advisorySeverity: Medium to HighGHSA-jjhp-8crj-mppqNotebookLM MCP 2.0.3 Restricts Vault File WritesNotebookLM MCP · Artificial Intelligence & SaaSVendor advisorySeverity: HighRHSA-2026:70201Red Hat Podman Update Addresses Eleven RHEL 10 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighK000162605F5 BIG-IP APM Hotfixes Address Critical OAuth VulnerabilityF5 · Firewalls & VPNVendor advisorySeverity: CriticalTR-26-1146TR-CERT Warns of Critical SQL Injection in Unsupported KarelIPSKarel Electronics · Network Security & MonitoringVendor advisorySeverity: CriticalUSN-8802-1Ubuntu USN-8802-1 Fixes Linux kernel (Oracle) Vulnerabilities (98 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8728-2Ubuntu USN-8728-2 Fixes Linux kernel (Azure) Vulnerabilities (1417 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8726-4Ubuntu USN-8726-4 Fixes Linux kernel Vulnerabilities (551 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8729-4Ubuntu USN-8729-4 Fixes Linux kernel (Low Latency) Vulnerabilities (97 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8730-5Ubuntu USN-8730-5 Fixes Linux kernel VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8793-2Ubuntu USN-8793-2 Fixes Linux kernel (Azure CVM) VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityMMSA-2026-00771Mattermost Updates Bound Bulk Reactions RequestsMattermost · Collaboration & CommunicationsVendor advisorySeverity: MediumRHSA-2026:70229 / RHSA-2026:70228 / RHSA-2026:70230Red Hat JBoss EAP 8.1.8 Addresses 36 Vulnerabilities (36 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighCVE-2026-74849 / CVE-2026-75791ManageEngine ADSelfService Plus 7001 Fixes RCE and Authentication BypassManageEngine · Identity & Access ManagementVendor advisorySeverity: High to CriticalRHSA-2026:69964Red Hat coreutils Update Fixes an RHEL 8 File DisclosureRed Hat · Linux & Operating SystemsVendor advisorySeverity: MediumUSN-8661-5Ubuntu USN-8661-5 Fixes Linux kernel (Raspberry Pi) Vulnerabilities (21 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:70103Red Hat rhc-worker-playbook Update Fixes Five RHEL 10 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighUSN-8760-2Ubuntu USN-8760-2 Fixes Linux kernel (NVIDIA) Vulnerabilities (550 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8801-1Ubuntu USN-8801-1 Fixes Linux kernel (Azure CVM) VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:69998 / RHSA-2026:70006 / RHSA-2026:70027 / RHSA-2026:70047Red Hat OpenShift Virtualization Updates Address Four FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighUSN-8800-1Ubuntu USN-8800-1 Fixes Linux kernel (NVIDIA BaseOS) Vulnerabilities (552 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:69876 / RHSA-2026:69923 / RHSA-2026:69914 / RHSA-2026:70186 / RHSA-2026:70602 / RHSA-2026:70559Red Hat PostgreSQL Updates Expand Across RHEL 8, 9, and 10Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighINCIBE-CERT CVE-2026-93556INCIBE-CERT Reports Critical Tankuam Places Account Takeover FlawKompini · Web Application SecurityVendor advisorySeverity: CriticalRHSA-2026:69927 / RHSA-2026:69929 / RHSA-2026:69930 / RHSA-2026:69931 / RHSA-2026:69932 / RHSA-2026:69933 / RHSA-2026:69934 / RHSA-2026:69935Red Hat AI Base Images 3.4.2 Address Eight FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighGHSA-rgxr-4g4w-j875 / GHSA-qghx-23m5-r55m / GHSA-qhcm-px9c-rvfhErlang/OTP Updates Fix TLS Authentication and Denial-of-Service FlawsErlang/OTP · Application Platforms & MiddlewareVendor advisorySeverity: High to CriticalRHSA-2026:69925 / RHSA-2026:69942 / RHSA-2026:69928 / RHSA-2026:69945Red Hat OpenShift Builds Updates Address Ten FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:69917Red Hat Source-to-Image 1.6.4 Addresses Seven FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:69874 / RHSA-2026:69906 / RHSA-2026:69908Red Hat Kernel Updates Protect Extended-Support RHEL StreamsRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighSecurity Advisory 0183Arista Warns of Exploited VeloCloud Orchestrator RCEArista Networks · Routing, Switching & Wi-FiVendor advisorySeverity: CriticalRHSA-2026:69863 / RHSA-2026:70598 / RHSA-2026:70599Red Hat libsoup Updates Expand Across RHEL 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:69866 / RHSA-2026:70260Red Hat GStreamer Base Updates Fix RHEL 7 and 8 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:68547 / RHSA-2026:68553 / RHSA-2026:68546 / RHSA-2026:68552 / RHSA-2026:69922 / RHSA-2026:68543 / RHSA-2026:68538 / RHSA-2026:68541 / RHSA-2026:68550Red Hat OpenShift 4.20–4.22 Updates Address Multiple Flaws (24 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:69862 / RHSA-2026:69861Red Hat Redis Updates Fix Two RHEL 9 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:69712 / RHSA-2026:69713 / RHSA-2026:69719 / RHSA-2026:69715 / RHSA-2026:69717 / RHSA-2026:69720 / RHSA-2026:69718Red Hat mod_auth_openidc Updates Protect Extended-Support RHELRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighSAP Security Note 3680888SAP Fiori Launchpad Update Addresses Information DisclosureSAP · Enterprise ApplicationsVendor advisorySeverity: MediumRHSA-2026:69609Red Hat OpenEXR Update Fixes an RHEL 10 Memory FlawRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighNVIDIA Security Bulletin 5885NVIDIA NeMo Speech 3.0 Fixes Five Code Execution FlawsNVIDIA · Artificial Intelligence & SaaSVendor advisorySeverity: HighNVIDIA Security Bulletin 5879NVIDIA Infrastructure Controller 2.0 Fixes Fourteen FlawsNVIDIA · Cloud & OrchestrationVendor advisorySeverity: Medium to CriticalCVE-2026-94127F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityF5 · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-93952Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityArista · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-93616Check Point Multiple Products Path Traversal VulnerabilityCheck Point · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-85102Check Point Multiple Products Improper Certificate Validation VulnerabilityCheck Point · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedRHSA-2026:69553Red Hat libarchive Update Fixes Two RHEL 10 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: LowRHSA-2026:69698Red Hat PostgreSQL 15 Update Addresses Nine RHEL 9 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:69655Red Hat libxml2 Update Fixes an RHEL 8 Parsing FlawRed Hat · Linux & Operating SystemsVendor advisorySeverity: MediumRHSA-2026:69541 / RHSA-2026:69540Red Hat rsyslog Updates Fix an RHEL Denial of ServiceRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighOSSA-2026-039OpenStack Octavia Fixes HAProxy Configuration InjectionOpenStack · Cloud & OrchestrationVendor advisorySeverity: Not provided by the authorityCVE-2026-7273CISA Adds Zyxel GS1900 Command Execution Flaw to KEVZyxel · Routing, Switching & Wi-FiVendor advisorySeverity: Not provided by the authorityUSN-8798-1Ubuntu USN-8798-1 Fixes GStreamer Good Plugins VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:69293Red Hat osbuild-composer Update Addresses Five RHEL 9 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:69461 / RHSA-2026:69462Red Hat Firefox 140.16 Updates RHEL 9 and 10 (28 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighUSN-8797-1Ubuntu USN-8797-1 Fixes GStreamer Base Plugins VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:69542 / RHSA-2026:69533 / RHSA-2026:69534 / RHSA-2026:69521 / RHSA-2026:69520Red Hat Redis Updates Address Four RHEL VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:69531Red Hat GStreamer Base Update Fixes an RHEL 8 Media FlawRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighCVE-2026-94301Apache MINA Corrects an Incomplete Deserialization FixApache Software Foundation · Application Platforms & MiddlewareVendor advisorySeverity: CriticalCVE-2026-75158 / CVE-2026-82355 / CVE-2026-86473Apache Airflow 3.3.2 Fixes Authorization and Token HandlingApache Software Foundation · Cloud & OrchestrationVendor advisorySeverity: Not provided by the authorityRHSA-2026:69297Red Hat libsoup Update Fixes Two RHEL 9 Network FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighTC-2026-01Thinkst Patches Canary Redis Denial of ServiceThinkst · Network Security & MonitoringVendor advisorySeverity: LowUSN-8793-1Ubuntu USN-8793-1 Fixes Linux kernel (Azure CVM) VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8668-2Ubuntu USN-8668-2 Fixes Linux kernel (Raspberry Pi) Vulnerabilities (763 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8726-3Ubuntu USN-8726-3 Fixes Linux kernel (IBM) Vulnerabilities (551 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8729-3Ubuntu USN-8729-3 Fixes Linux kernel Vulnerabilities (97 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8761-3Ubuntu USN-8761-3 Fixes Linux kernel (Azure) Vulnerabilities (95 CVEs)Ubuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8730-4Ubuntu USN-8730-4 Fixes Linux kernel VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8792-1Ubuntu USN-8792-1 Fixes Memcached VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8791-1Ubuntu USN-8791-1 Fixes Ghostscript VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8787-1Ubuntu USN-8787-1 Fixes libxml2 VulnerabilitiesUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityUSN-8786-1Ubuntu USN-8786-1 Fixes rsyslog VulnerabilityUbuntu · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityRHSA-2026:69285Red Hat libkcapi Update Addresses Three RHEL 10 FlawsRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighCVE-2026-84285Dassault Systèmes Warns of Tuleap Command InjectionDassault Systèmes · Application Platforms & MiddlewareVendor advisorySeverity: HighRHSA-2026:69278Red Hat Corosync Update Protects RHEL 8.8 ClustersRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:69292Red Hat Fixes a Second libtiff Flaw on RHEL 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighCVE-2026-91863 / CVE-2026-91864 / CVE-2026-91865 / CVE-2026-91866 / CVE-2026-91867Apache Neethi 3.2.4 Addresses Five Policy Processing FlawsApache Software Foundation · Application Platforms & MiddlewareVendor advisorySeverity: Not provided by the authorityCVE-2026-16651 / CVE-2026-16652 / CVE-2026-65651 / CVE-2026-65652 / CVE-2026-65653 / CVE-2026-65654 / CVE-2026-87858 / CVE-2026-89139Temporal Discloses Eight Authorization and Availability FlawsTemporal · Application Platforms & MiddlewareVendor advisorySeverity: Medium to HighINCIBE-2026-651INCIBE-CERT Reports Fixed 1millionbot Chatbot XSS1millionbot · Artificial Intelligence & SaaSVendor advisorySeverity: MediumRHSA-2026:69255Red Hat Quay 3.16.6 Addresses 42 Vulnerabilities (42 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to CriticalRHSA-2026:69248Red Hat Developer Hub 1.9.9 Addresses 30 Vulnerabilities (30 CVEs)Red Hat · Linux & Operating SystemsVendor advisorySeverity: Low to HighCVE-2026-47321Apache MINA Releases Bound Zlib DecompressionApache Software Foundation · Application Platforms & MiddlewareVendor advisorySeverity: HighGHSA-f55q-5m46-rmxcOpen VSX 1.2.0 Blocks Marketplace Cache PoisoningEclipse Foundation · Developer Tools & Supply ChainVendor advisorySeverity: CriticalRHSA-2026:69129 / RHSA-2026:69266Red Hat OpenSSH Updates Protect RHEL 8 and 10Red Hat · Linux & Operating SystemsVendor advisorySeverity: Low to HighRHSA-2026:69232 / RHSA-2026:70803 / RHSA-2026:70584Red Hat GStreamer Updates Expand Across RHEL 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighCVE-2026-90860Canva Fixes HarmonyOS Mobile Session ExposureCanva · Mobile ApplicationsVendor advisorySeverity: HighRHSA-2026:69120Red Hat Updates Unbound Resolver on RHEL 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: MediumRHSA-2026:69112Red Hat Perl DBI Update Fixes RHEL 8 SQL Handling FlawRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:69113Red Hat Updates APR-util on RHEL 8 for Four VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:69097 / RHSA-2026:69109Red Hat Rust Updates Fix Git Repository Handling on RHEL 9Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:69114Red Hat Fixes Two libvirt Flaws on RHEL 7 ELSRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:69115 / RHSA-2026:69117 / RHSA-2026:69121Red Hat ABRT Fixes Expand to RHEL 7 ELSRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:69095Red Hat libtiff Update Blocks Crafted-TIFF Code Execution on RHEL 8Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:69124Red Hat Fixes sg3_utils udev Injection in RHEL 10.0 EUSRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:69105 / RHSA-2026:69104 / RHSA-2026:69107 / RHSA-2026:69258Red Hat rhc Updates Expand Across RHEL 8 and 9Red Hat · Linux & Operating SystemsVendor advisorySeverity: HighRHSA-2026:69128Red Hat Updates RHEL 6 ELS Vim for 13 VulnerabilitiesRed Hat · Linux & Operating SystemsVendor advisorySeverity: Medium to HighRHSA-2026:69119 / RHSA-2026:69118Red Hat Dracut Updates Protect RHEL 8.4 and 8.6 Network BootRed Hat · Linux & Operating SystemsVendor advisorySeverity: HighGHSA-8grh-q73j-ffrcnvm 0.40.8 Blocks Malicious .nvmrc Path Traversalnvm · Developer Tools & Supply ChainVendor advisorySeverity: MediumDLA-4789-1Debian 12 libde265 Update Fixes 12 H.265 Decoder CVEsDebian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authoritySA-202609-1732793 / SA-202609-1732788 / SA-202609-1732784 / SA-202609-1731629ZTE SmartLife 2.8.4 Addresses Four Account-Security VulnerabilitiesZTE · Android & Mobile ComponentsVendor advisorySeverity: Medium / High / Medium / MediumSA-202609-1573076ZTE Z80 Ultra Update Restricts Wi-Fi MAC Address DisclosureZTE · Android & Mobile ComponentsVendor advisorySeverity: LowDSA-6508-1Debian Chromium Update Fixes 16 Security VulnerabilitiesDebian · Browsers & Web ComponentsVendor advisorySeverity: Not provided by the authoritysk1000171Check Point Revises Management Server RCE Advisory for Active ExploitationCheck Point · Firewalls & VPNVendor advisorySeverity: CriticalDLA-4788-1Debian 12 Linux 6.12 Update Addresses 414 Kernel CVEs (414 CVEs)Debian · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityGHSA-rj5m-69wp-cxq9Elixir Mint 1.10.1 Fixes HTTP Response-Smuggling Parsing FlawElixir Mint · Browsers & Web ComponentsVendor advisorySeverity: MediumALAS2023LIVEPATCH-2026-360–388Amazon Linux 2023 Live Patches Address Four Kernel Network-Stack VulnerabilitiesAmazon Web Services (AWS) · Linux & Operating SystemsVendor advisorySeverity: Not provided by the authorityCVE-2026-53266Linux Kernel Out-of-Bounds Write VulnerabilityLinux · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-39964Linux Kernel Race Condition VulnerabilityLinux · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-39682Linux Kernel Improper Check for Unusual or Exceptional Conditions VulnerabilityLinux · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-87886Acronis Backup Incorrect Default Permissions VulnerabilityAcronis · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-76460Cisco ISE authentication bypass is actively exploitedCisco · Identity & AccessCISA KEVSeverity: Not capturedCVE-2026-76451Cisco Identity Services Engine Certificate Management SQL Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76450Cisco Identity Services Engine SQL Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76449Cisco Identity Services Engine SQL Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76448Cisco Identity Services Engine SQL Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76447Cisco ISE Certificate Reload VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76446Cisco ISE External Entity Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76444Cisco ISE Information Disclosure VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76439Cisco ISE Remote Code Execution VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76438Cisco BroadWorks CommPilot Application Software Authorization Bypass VulnerabilityCisco · Collaboration & MessagingVendor advisorySeverity: MediumCVE-2026-76434Cisco ISE Arbitrary File Read VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76433Cisco ISE Information Disclosure VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76432Cisco ISE Arbitrary File Write VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76431Cisco ISE Arbitrary File Deletion VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76428Cisco ISE Profiler SQL Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76427Cisco ISE XML External Entity Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76426Cisco ISE REST API SQL Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-76425Cisco ISE SQL Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: HighCVE-2026-76424Cisco ISE Arbitrary File Access VulnerabilityCisco · Identity & AccessVendor advisorySeverity: HighCVE-2026-76423Cisco ISE REST API Authentication Bypass VulnerabilityCisco · Identity & AccessVendor advisorySeverity: CriticalCVE-2026-76420Cisco Secure FMC Software Peer Impersonation VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: CriticalCVE-2026-76413Cisco Secure FMC Single Sign-On Token Forgery Account VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-76412Cisco Secure FMC Software Privilege Escalation to root VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-76409Cisco Nexus Dashboard hardening: Improper Limitation of a PathnameCisco · Network Management & ObservabilityVendor advisorySeverity: HighCVE-2026-58704Pixel cellular-modem privilege escalationGoogle · Android & Mobile ComponentsCISA KEVSeverity: Not capturedCVE-2026-20361Cisco Nexus Dashboard hardening: SQL InjectionCisco · Network Management & ObservabilityVendor advisorySeverity: HighCVE-2026-20360Cisco Nexus Dashboard hardening: Information Exposure & Insecure HandlingCisco · Network Management & ObservabilityVendor advisorySeverity: HighCVE-2026-20352Cisco Identity Services Engine RADIUS Denial of Service VulnerabilityCisco · Identity & AccessVendor advisorySeverity: HighCVE-2026-20350Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection VulnerabilityCisco · Network Management & ObservabilityVendor advisorySeverity: MediumCVE-2026-20344Cisco Secure FMC Software SQL Injection VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20343Cisco Secure FMC Software Information Disclosure and Disk DoS VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20342Cisco Secure FMC Software Arbitrary File Download VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20341Cisco Secure FMC Software sftunnel Deserialization Root Command Execution VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: CriticalCVE-2026-20340Cisco Secure FMC Software Deserialization Arbitrary Root Command Execution VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20336Cisco ASA, FTD, and FMC hardening: Resource Lifetime Management VulnerabilitiesCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20335Cisco ASA, FTD, and FMC hardening: Incorrect Calculation VulnerabilitiesCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20334Cisco ASA, FTD, and FMC hardening: Coding Standards VulnerabilitiesCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20333Cisco ASA, FTD, and FMC hardening: Incorrect Comparison VulnerabilitiesCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20332Cisco ASA, FTD, and FMC hardening: Improper Access Control VulnerabilitiesCisco · Firewalls & VPNVendor advisorySeverity: CriticalCVE-2026-20331Cisco ASA, FTD, and FMC hardening: Protection Mechanism Failure VulnerabilitiesCisco · Firewalls & VPNVendor advisorySeverity: CriticalCVE-2026-20330Cisco ASA, FTD, and FMC hardening: Improper Neutralization VulnerabilitiesCisco · Firewalls & VPNVendor advisorySeverity: CriticalCVE-2026-20329Cisco ASA, FTD, and FMC hardening: Exceptional Conditions Handling VulnerabilitiesCisco · Firewalls & VPNVendor advisorySeverity: CriticalCVE-2026-20326Cisco Nexus Dashboard hardening: Missing Authentication for Critical FunctionCisco · Network Management & ObservabilityVendor advisorySeverity: CriticalCVE-2026-20325Cisco Nexus Dashboard hardening: Improper Neutralization of Special Elements used in a CommandCisco · Network Management & ObservabilityVendor advisorySeverity: CriticalCVE-2026-20324Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Execution VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: CriticalCVE-2026-20323Cisco Secure FMC Software and Secure FTD Software sftunnel Unauthorized Authentication Bypass VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20322Cisco Nexus Dashboard hardening: Improper Access ControlCisco · Network Management & ObservabilityVendor advisorySeverity: CriticalCVE-2026-20309Cisco Identity Services Engine Cross-Site Scripting VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-20307Cisco ISE Remote Code Execution VulnerabilityCisco · Identity & AccessVendor advisorySeverity: CriticalCVE-2026-20306Cisco ISE Command Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: CriticalCVE-2026-20305Cisco ISE Command Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: CriticalCVE-2026-20300Cisco ISE SQL Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: HighCVE-2026-20295Cisco Secure FMC Software and Secure FTD Software sftunnel Memory Exhaustion DoS VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20290Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: MediumCVE-2026-20287Cisco ISE hardening: Improper Privilege Management VulnerabilitiesCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-20286Cisco ISE Authorization Bypass vulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-20285Cisco ISE Authorization Bypass vulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-20284Cisco ISE SXP REST API SQL Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: CriticalCVE-2026-20283Cisco ISE IPsec Open API Command Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-20282Cisco ISE Authenticated Write VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-20250Cisco Secure Firewall ASA and FTD for Firepower 3100 and 4200 Series DTLS Denial of Service VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20249Cisco Secure Firewall ASA and FTD IKEv2 Certificate Authentication Denial of Service VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20248Cisco Secure Firewall ASA and FTD TCP DNS Denial of Service VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: MediumCVE-2026-20247Cisco ISE Unauthenticated SQL Injection VulnerabilityCisco · Identity & AccessVendor advisorySeverity: HighCVE-2026-20242Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: CriticalCVE-2026-20237Cisco ISE hardening: Input Validation VulnerabilitiesCisco · Identity & AccessVendor advisorySeverity: CriticalCVE-2026-20235Cisco Identity Services Engine Information Disclosure VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-20234Cisco ISE hardening: Insufficiently Protected Credential VulnerabilitiesCisco · Identity & AccessVendor advisorySeverity: CriticalCVE-2026-20222Cisco Secure Firewall ASA and FTD EIGRP Denial of Service VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20211Cisco ISE Remote Code Execution VulnerabilityCisco · Identity & AccessVendor advisorySeverity: CriticalCVE-2026-20194Cisco ISE hardening: Incorrect Resource Transfer VulnerabilitiesCisco · Identity & AccessVendor advisorySeverity: CriticalCVE-2026-20192Cisco ISE hardening: Access Control VulnerabilitiesCisco · Identity & AccessVendor advisorySeverity: CriticalCVE-2026-20176Cisco ISE Remote Code Execution VulnerabilityCisco · Identity & AccessVendor advisorySeverity: CriticalCVE-2026-20154Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software Logging Denial of ServiceCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20135Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service VulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-20130Cisco ISE hardening: Improper Neutralization VulnerabilitiesCisco · Identity & AccessVendor advisorySeverity: CriticalCVE-2026-20121Cisco FTD Bypass Access ListCisco · Firewalls & VPNVendor advisorySeverity: MediumCVE-2026-20120Cisco FTD ACL bypass vulnerabilityCisco · Firewalls & VPNVendor advisorySeverity: MediumCVE-2026-20072Cisco ISE Information Disclosure VulnerabilityCisco · Identity & AccessVendor advisorySeverity: MediumCVE-2026-20071Cisco ISE Session Takeover VulnerabilityCisco · Identity & AccessVendor advisorySeverity: LowCVE-2026-76461Cisco Secure Email Gateway crafted-email root command executionCisco · Collaboration & MessagingCISA KEVSeverity: Not capturedCVE-2026-85706GitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityGitLab · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-84869ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization VulnerabilityConnectWise · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-42018JFrog Artifactory Improper Authentication VulnerabilityJFrog · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-42016JFrog Artifactory Incorrect Authorization VulnerabilityJFrog · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-86060MikroTik RouterOS MikroTrick policy-mask privilege escalationMikroTik · Routing, Switching & Wi-FiCISA KEVSeverity: Not capturedCVE-2026-67277MikroTik RouterOS btest unauthenticated memory disclosure and denial of serviceMikroTik · Routing, Switching & Wi-FiCISA KEVSeverity: Not capturedsk1000117Check Point Confirms Active Exploitation of VPN RCE CVE-2026-85102Check Point · Firewalls & VPNVendor advisorySeverity: CriticalCVE-2026-0307Palo Alto Networks Revises GlobalProtect Privilege Escalation FixesPalo Alto Networks · Firewalls & VPNVendor advisorySeverity: HighCVE-2026-87491Google Chromium V8 Out of Bounds Write VulnerabilityGoogle · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-20079Cisco FMC unauthenticated authentication bypass to rootCisco · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-19490NetScaler Gateway and AAA authentication bypassCitrix · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2025-25249Fortinet Multiple Products Heap-based Buffer Overflow VulnerabilityFortinet · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-86218N-able N-central Static Code Injection VulnerabilityN-able · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-85880Windows ALPC local privilege escalationMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2026-81963Windows Update Stack privilege escalation to SYSTEMMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2026-75650Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityAdobe · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-85046Google Chromium V8 Type Confusion VulnerabilityGoogle · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-9586Sangoma Switchvox SQL Injection VulnerabilitySangoma · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-83549SonicWall SMA1000 administrator command injection and RCESonicWall · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-83548SonicWall SMA1000 pre-authentication SSRF and proxy bypassSonicWall · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-82329JFrog Artifactory Improper Authentication VulnerabilityJFrog · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-59822BerriAI LiteLLM Improper Authentication VulnerabilityBerriAI · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-49869Kestra OSS OS Command Injection VulnerabilityKestra · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-48710Kludex Starlette HTTP Request/Response Smuggling VulnerabilityKludex · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-82078PaperCut NG/MF Unsafe Reflection VulnerabilityPaperCut · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-81578PaperCut NG/MF Missing Authentication for Critical Function VulnerabilityPaperCut · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-66384JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory VulnerabilityJFrog · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-53362Linux Kernel Unspecified VulnerabilityLinux · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2023-49105ownCloud Improper Authentication VulnerabilityownCloud · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-8452NetScaler memory-bounds flaw can cause denial of serviceCitrix · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2022-0995Linux Kernel Out-of-Bounds Write VulnerabilityLinux · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2021-23758Ajax.NET Professional Deserialization of Untrusted Data VulnerabilityAjax.NET Professional · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2019-1068SQL Server remote code executionMicrosoft · DatabasesCISA KEVSeverity: Not capturedCVE-2015-5287Red Hat Automatic Bug Reporting Tool Privilege Escalation VulnerabilityRed Hat · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2015-3246Red Hat Libuser Race Condition VulnerabilityRed Hat · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-60004Gitea Code Injection VulnerabilityGitea · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-21962Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control VulnerabilityOracle · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-73570Zimbra Collaboration Suite (ZCS) OS Command Injection VulnerabilitySynacor · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-72530TrueConf Server Code Injection VulnerabilityTrueConf · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-72529TrueConf Server Missing Authentication for Critical Function VulnerabilityTrueConf · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-64849MLflow Server-Side Request Forgery VulnerabilityMLflow · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-65400macOS Screen Sharing authentication bypassApple · Apple PlatformsCISA KEVSeverity: Not capturedCVE-2026-59310Broadcom VMware vCenter Path Traversal VulnerabilityBroadcom · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-55040SharePoint authentication bypassMicrosoft · Collaboration & MessagingCISA KEVSeverity: Not capturedCVE-2026-33824Windows IKEv2 remote code executionMicrosoft · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2025-62593Ray-Project Ray Code Injection VulnerabilityRay-Project · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-72898Metabase SQL Injection VulnerabilityMetabase · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-68820Windows WinSock AFD local privilege escalationMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2026-20349Cisco ASA and FTD remote-access VPN denial of serviceCisco · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-8037Progress LoadMaster Command Injection VulnerabilityProgress · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-63077JetBrains TeamCity Deserialization of Untrusted Data VulnerabilityJetBrains · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-9198IBM Langflow Code Injection VulnerabilityIBM · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-34486Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityApache · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-18556N-able N-central Authentication Bypass Using an Alternate Path or Channel VulnerabilityN-able · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-18577N-able N-central Authentication Bypass Using an Alternate Path or Channel VulnerabilityN-able · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-20316Cisco FMC static credential is exploited and ransomware-linkedCisco · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-16812Arista VeloCloud Orchestrator unauthenticated command injectionArista · Network Management & ObservabilityCISA KEVSeverity: Not capturedCVE-2025-68686Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityFortinet · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-50522SharePoint unauthenticated remote code executionMicrosoft · Collaboration & MessagingCISA KEVSeverity: Not capturedCVE-2026-16232Check Point SmartConsole token bypass to full administratorCheck Point · Network Management & ObservabilityCISA KEVSeverity: Not capturedCVE-2026-63030WordPress Core Interpretation Conflict VulnerabilityWordPress · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-60137WordPress Core SQL Injection VulnerabilityWordPress · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-0770Langflow Inclusion of Functionality from Untrusted Control Sphere VulnerabilityLangflow · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2021-27137DD-WRT Stack-Based Buffer Overflow VulnerabilityDD-WRT · Routing, Switching & Wi-FiCISA KEVSeverity: Not capturedCVE-2026-58644SharePoint unauthenticated deserialization RCEMicrosoft · Collaboration & MessagingCISA KEVSeverity: Not capturedCVE-2026-39808FortiSandbox unauthenticated command injectionFortinet · Security InfrastructureCISA KEVSeverity: Not capturedCVE-2026-25089FortiSandbox second-order command injectionFortinet · Security InfrastructureCISA KEVSeverity: Not capturedCVE-2026-46817Oracle E-Business Suite Improper Privilege Management VulnerabilityOracle · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2023-4346KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism VulnerabilityKNX Association · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-56164SharePoint missing-authentication privilege escalationMicrosoft · Collaboration & MessagingCISA KEVSeverity: Not capturedCVE-2026-56155AD FS local privilege escalationMicrosoft · Identity & AccessCISA KEVSeverity: Not capturedCVE-2026-15410SonicWall SMA1000 administrator code injectionSonicWall · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-15409SonicWall SMA1000 unauthenticated WorkPlace SSRFSonicWall · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2008-4128Cisco IOS Cross-Site Request Forgery VulnerabilityCisco · Routing, Switching & Wi-FiCISA KEVSeverity: Not capturedCVE-2026-56291Balbooa Forms Unrestricted Upload of File with Dangerous Type VulnerabilityBalbooa · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-48939iCagenda Unrestricted Upload of File with Dangerous Type VulnerabilityiCagenda · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-56290Joomlack Page Builder Improper Access Control VulnerabilityJoomlack · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-55255Langflow Authorization Bypass Through User-Controlled Key VulnerabilityLangflow · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-48908JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type VulnerabilityJoomShaper · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-48282Adobe ColdFusion Path Traversal VulnerabilityAdobe · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-45659SharePoint authenticated remote code executionMicrosoft · Collaboration & MessagingCISA KEVSeverity: Not capturedCVE-2026-48558SimpleHelp Authentication Bypass VulnerabilitySimpleHelp · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-20230Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) VulnerabilityCisco · Collaboration & MessagingCISA KEVSeverity: Not capturedCVE-2026-12569PTC Windchill and FlexPLM Improper Input Validation VulnerabilityPTC · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-34910UniFi OS input-validation flawUbiquiti · Routing, Switching & Wi-FiCISA KEVSeverity: Not capturedCVE-2026-34909UniFi OS path traversalUbiquiti · Routing, Switching & Wi-FiCISA KEVSeverity: Not capturedCVE-2026-34908UniFi OS improper access control allows unauthorized system changesUbiquiti · Routing, Switching & Wi-FiCISA KEVSeverity: Not capturedCVE-2025-67038Lantronix EDS5000 Code Injection VulnerabilityLantronix · Routing, Switching & Wi-FiCISA KEVSeverity: Not capturedCVE-2026-20253Splunk Enterprise Missing Authentication for Critical Function VulnerabilitySplunk · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-48907Widget Factory Joomla Content Editor Improper Access Control VulnerabilityWidget Factory · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-54420LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following VulnerabilityLiteSpeed · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-20262Cisco Catalyst SD-WAN Manager arbitrary file writeCisco · Network Management & ObservabilityCISA KEVSeverity: Not capturedCVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function VulnerabilityOracle · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-10520Ivanti Sentry OS Command Injection VulnerabilityIvanti · Endpoint & Device ManagementCISA KEVSeverity: Not capturedCVE-2026-7473Arista EOS tunnel decapsulation validation flawArista · Routing, Switching & Wi-FiCISA KEVSeverity: Not capturedCVE-2026-20245Cisco Catalyst SD-WAN authenticated root privilege escalationCisco · Network Management & ObservabilityCISA KEVSeverity: Not capturedCVE-2026-11645Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityGoogle · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-50751Check Point deprecated IKEv1 VPN authentication bypassCheck Point · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-42271BerriAI LiteLLM Command Injection VulnerabilityBerriAI · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-28318SolarWinds Serv-U Uncontrolled Resource Consumption VulnerabilitySolarWinds · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-45247Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data VulnerabilityMirasvit · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-48595Android Framework privilege escalationAndroid · Android & Mobile ComponentsCISA KEVSeverity: Not capturedCVE-2022-0492Linux Kernel Improper Authentication VulnerabilityLinux · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2024-21182Oracle WebLogic Server Unspecified VulnerabilityOracle · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-0257PAN-OS GlobalProtect authentication bypassPalo Alto Networks · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-8398Daemon Tools Lite Embedded Malicious Code VulnerabilityDaemon · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-48027Nx Console Embedded Malicious Code VulnerabilityNx · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-45321TanStack Unspecified VulnerabilityTanStack · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-48172LiteSpeed cPanel Plugin Privilege Escalation VulnerabilityLiteSpeed · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-9082Drupal Core SQL Injection VulnerabilityDrupal · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-34926Trend Micro Apex One (On-Premise) Directory Traversal VulnerabilityTrend Micro · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-34291Langflow Origin Validation Error VulnerabilityLangflow · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-45498Microsoft Defender local denial of serviceMicrosoft · Endpoint & Device ManagementCISA KEVSeverity: Not capturedCVE-2026-41091Microsoft Malware Protection Engine privilege escalationMicrosoft · Endpoint & Device ManagementCISA KEVSeverity: Not capturedCVE-2010-0806Legacy Internet Explorer use-after-free RCEMicrosoft · Browsers & Web ComponentsCISA KEVSeverity: Not capturedCVE-2010-0249Legacy Internet Explorer use-after-free RCEMicrosoft · Browsers & Web ComponentsCISA KEVSeverity: Not capturedCVE-2009-3459Adobe Acrobat and Reader Heap-Based Buffer Overflow VulnerabilityAdobe · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2009-1537Legacy DirectShow QuickTime parsing RCEMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2008-4250Legacy Windows Server Service RPC remote code executionMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2026-42897Exchange Outlook Web Access cross-site scriptingMicrosoft · Collaboration & MessagingCISA KEVSeverity: Not capturedCVE-2026-20182Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco · Network Management & ObservabilityCISA KEVSeverity: Not capturedCVE-2026-42208BerriAI LiteLLM SQL Injection VulnerabilityBerriAI · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-6973Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation VulnerabilityIvanti · Endpoint & Device ManagementCISA KEVSeverity: Not capturedCVE-2026-0300PAN-OS User-ID Authentication Portal unauthenticated root RCEPalo Alto Networks · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-31431Linux Kernel Incorrect Resource Transfer Between Spheres VulnerabilityLinux · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-41940WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityWebPros · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-32202Windows Shell spoofing vulnerabilityMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2024-1708ConnectWise ScreenConnect Path Traversal VulnerabilityConnectWise · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-29635D-Link DIR-823X authenticated command injection on an end-of-life routerD-Link · Routing, Switching & Wi-FiCISA KEVSeverity: Not capturedCVE-2024-7399Samsung MagicINFO 9 Server Path Traversal VulnerabilitySamsung · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2024-57728SimpleHelp Path Traversal VulnerabilitySimpleHelp · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2024-57726SimpleHelp Missing Authorization VulnerabilitySimpleHelp · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-39987Marimo Remote Code Execution VulnerabilityMarimo · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-33825Microsoft Defender local privilege escalationMicrosoft · Endpoint & Device ManagementCISA KEVSeverity: Not capturedCVE-2026-20133Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCisco · Network Management & ObservabilityCISA KEVSeverity: Not capturedCVE-2026-20128Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format VulnerabilityCisco · Network Management & ObservabilityCISA KEVSeverity: Not capturedCVE-2026-20122Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs VulnerabilityCisco · Network Management & ObservabilityCISA KEVSeverity: Not capturedCVE-2025-48700Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilitySynacor · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-32975Quest KACE Systems Management Appliance (SMA) Improper Authentication VulnerabilityQuest · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-2749Kentico Xperience Path Traversal VulnerabilityKentico · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2024-27199JetBrains TeamCity Relative Path Traversal VulnerabilityJetBrains · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2023-27351PaperCut NG/MF Improper Authentication VulnerabilityPaperCut · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-34197Apache ActiveMQ Improper Input Validation VulnerabilityApache · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-32201SharePoint unauthenticated spoofing vulnerabilityMicrosoft · Collaboration & MessagingCISA KEVSeverity: Not capturedCVE-2009-0238Legacy Microsoft Excel file remote code executionMicrosoft · Productivity ApplicationsCISA KEVSeverity: Not capturedCVE-2026-34621Adobe Acrobat and Reader Prototype Pollution VulnerabilityAdobe · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-21643Fortinet FortiClient EMS SQL Injection VulnerabilityFortinet · Endpoint & Device ManagementCISA KEVSeverity: Not capturedCVE-2025-60710Windows link-following privilege escalationMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2023-36424Windows Common Log File System privilege escalationMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2023-21529Exchange Server authenticated deserialization RCEMicrosoft · Collaboration & MessagingCISA KEVSeverity: Not capturedCVE-2020-9715Adobe Acrobat Use-After-Free VulnerabilityAdobe · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2012-1854Legacy VBA insecure library loading RCEMicrosoft · Productivity ApplicationsCISA KEVSeverity: Not capturedCVE-2026-1340Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityIvanti · Endpoint & Device ManagementCISA KEVSeverity: Not capturedCVE-2026-35616FortiClient EMS unauthenticated access-control bypass to code executionFortinet · Endpoint & Device ManagementCISA KEVSeverity: Not capturedCVE-2026-3502TrueConf Client Download of Code Without Integrity Check VulnerabilityTrueConf · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-5281Google Dawn Use-After-Free VulnerabilityGoogle · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-3055Citrix NetScaler Out-of-Bounds Read VulnerabilityCitrix · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2025-53521F5 BIG-IP APM unauthenticated remote code executionF5 · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-33634Aquasecurity Trivy Embedded Malicious Code VulnerabilityAquasecurity · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-33017Langflow Code Injection VulnerabilityLangflow · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-54068Laravel Livewire Code Injection VulnerabilityLaravel · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-43520Apple kernel memory write or system crashApple · Apple PlatformsCISA KEVSeverity: Not capturedCVE-2025-43510Apple shared-memory kernel corruptionApple · Apple PlatformsCISA KEVSeverity: Not capturedCVE-2025-32432Craft CMS Code Injection VulnerabilityCraft CMS · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-31277Apple WebKit memory corruptionApple · Browsers & Web ComponentsCISA KEVSeverity: Not capturedCVE-2026-20131Cisco FMC unauthenticated Java deserialization RCE as rootCisco · Firewalls & VPNCISA KEVSeverity: Not capturedCVE-2026-20963SharePoint unauthenticated deserialization RCEMicrosoft · Collaboration & MessagingCISA KEVSeverity: Not capturedCVE-2025-66376Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting VulnerabilitySynacor · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-47813Wing FTP Server Information Disclosure VulnerabilityWing FTP Server · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-3910Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer VulnerabilityGoogle · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-3909Skia out-of-bounds write exploited through crafted web contentGoogle · Browsers & Web ComponentsCISA KEVSeverity: Not capturedCVE-2025-68613n8n Improper Control of Dynamically-Managed Code Resources Vulnerabilityn8n · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-1603Ivanti Endpoint Manager (EPM) Authentication Bypass VulnerabilityIvanti · Endpoint & Device ManagementCISA KEVSeverity: Not capturedCVE-2025-26399SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilitySolarWinds · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2021-22054Omnissa Workspace ONE Server-Side Request ForgeryOmnissa · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2023-43000Apple WebKit use-after-free memory corruptionApple · Browsers & Web ComponentsCISA KEVSeverity: Not capturedCVE-2023-41974iPhone and iPad kernel privilege escalationApple · Apple PlatformsCISA KEVSeverity: Not capturedCVE-2021-30952Apple WebKit arbitrary code executionApple · Browsers & Web ComponentsCISA KEVSeverity: Not capturedCVE-2021-22681Rockwell Multiple Products Insufficient Protected Credentials VulnerabilityRockwell · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2017-7921Hikvision Multiple Products Improper Authentication VulnerabilityHikvision · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-22719Broadcom VMware Aria Operations Command Injection VulnerabilityBroadcom · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-21385Qualcomm graphics memory corruptionQualcomm · Android & Mobile ComponentsCISA KEVSeverity: Not capturedCVE-2026-20127Cisco Catalyst SD-WAN controller authentication bypass to fabric administrationCisco · Network Management & ObservabilityCISA KEVSeverity: Not capturedCVE-2022-20775Cisco SD-WAN authenticated local path traversal to rootCisco · Routing, Switching & Wi-FiCISA KEVSeverity: Not capturedCVE-2026-25108Soliton Systems K.K FileZen OS Command Injection VulnerabilitySoliton Systems K.K · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-68461RoundCube Webmail Cross-site Scripting VulnerabilityRoundcube · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-49113RoundCube Webmail Deserialization of Untrusted Data VulnerabilityRoundcube · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-22769Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials VulnerabilityDell · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2021-22175GitLab Server-Side Request Forgery (SSRF) VulnerabilityGitLab · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-2441Google Chromium CSS Use-After-Free VulnerabilityGoogle · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2024-7694TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type VulnerabilityTeamT5 · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2020-7796Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery VulnerabilitySynacor · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2008-0015Legacy Windows Video ActiveX Control RCEMicrosoft · Browsers & Web ComponentsCISA KEVSeverity: Not capturedCVE-2026-1731BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection VulnerabilityBeyondTrust · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-20700Apple dyld arbitrary code execution in a targeted exploit chainApple · Apple PlatformsCISA KEVSeverity: Not capturedCVE-2025-40536SolarWinds Web Help Desk Security Control Bypass VulnerabilitySolarWinds · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-15556Notepad++ Download of Code Without Integrity Check VulnerabilityNotepad++ · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2024-43468Configuration Manager unauthenticated SQL injectionMicrosoft · Endpoint & Device ManagementCISA KEVSeverity: Not capturedCVE-2026-21533Windows Remote Desktop Services local privilege escalationMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2026-21525Windows Remote Access Connection Manager denial of serviceMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2026-21519Desktop Window Manager local privilege escalationMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2026-21514Microsoft Word OLE protection bypassMicrosoft · Productivity ApplicationsCISA KEVSeverity: Not capturedCVE-2026-21513Windows MSHTML security-feature bypassMicrosoft · Browsers & Web ComponentsCISA KEVSeverity: Not capturedCVE-2026-21510Windows Shell and SmartScreen warning bypassMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2026-24423SmarterTools SmarterMail Missing Authentication for Critical Function VulnerabilitySmarterTools · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-11953React Native Community CLI OS Command Injection VulnerabilityReact Native Community · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-64328Sangoma FreePBX OS Command Injection VulnerabilitySangoma · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-40551SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilitySolarWinds · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2021-39935GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) VulnerabilityGitLab · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2019-19006 Sangoma FreePBX Improper Authentication VulnerabilitySangoma · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-1281Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityIvanti · Endpoint & Device ManagementCISA KEVSeverity: Not capturedCVE-2026-24858FortiCloud SSO cross-account authentication bypassFortinet · Identity & AccessCISA KEVSeverity: Not capturedCVE-2026-24061GNU InetUtils Argument Injection VulnerabilityGNU · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-23760SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel VulnerabilitySmarterTools · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-21509Microsoft Office OLE security-feature bypassMicrosoft · Productivity ApplicationsCISA KEVSeverity: Not capturedCVE-2025-52691SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type VulnerabilitySmarterTools · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2018-14634Linux Kernel Integer Overflow VulnerabilityLinux · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2024-37079Broadcom VMware vCenter Server Out-of-bounds Write VulnerabilityBroadcom · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-68645Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion VulnerabilitySynacor · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-54313Prettier eslint-config-prettier Embedded Malicious Code VulnerabilityPrettier · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-34026Versa Concerto Improper Authentication VulnerabilityVersa · Network Management & ObservabilityCISA KEVSeverity: Not capturedCVE-2025-31125Vite Vitejs Improper Access Control VulnerabilityVite · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2026-20045Cisco Unified Communications Products Code Injection VulnerabilityCisco · Collaboration & MessagingCISA KEVSeverity: Not capturedCVE-2026-20805Desktop Window Manager local information disclosureMicrosoft · Windows PlatformCISA KEVSeverity: Not capturedCVE-2025-8110Gogs Path Traversal VulnerabilityGogs · CISA KEV · 2026 additionCISA KEVSeverity: Not capturedCVE-2025-37164HPE OneView unauthenticated remote code executionHewlett Packard Enterprise (HPE) · Network Management & ObservabilityCISA KEVSeverity: Not capturedCVE-2009-0556Legacy PowerPoint file code executionMicrosoft · Productivity ApplicationsCISA KEVSeverity: Not capturedCVE-2024-20260Cisco ASA and FTD SSL VPN denial-of-service scope expansionCisco · Firewalls & VPNVendor advisorySeverity: HighHow to use this center
Match the asset, version, enabled feature, deployment role, management exposure, and advisory revision.
Retain relevant evidence, restrict unnecessary exposure, and use the current vendor-supported fix or mitigation.
Confirm the resulting version, service behavior, access controls, logging, monitoring, and accountable owner.
Evidence is not applicability. CISA KEV indicates confirmed exploitation; CVSS describes technical severity; neither proves a particular asset is vulnerable or compromised. For federal civilian agencies, the controlling directive and current CISA guidance determine required actions and dates. Other government and commercial organizations should apply their governing policy, contract, authorization boundary, and risk process.
The internal discovery registry currently covers 125 official endpoints across 122 publishers. It is broad but not exhaustive. Product scope and remediation are always controlled by the current vendor advisory.
Public-resource notice: This center is situational-awareness guidance, not a complete vulnerability inventory, managed detection service, legal advice, or authorization to access or test a system. Verify the current primary source and your exact environment before changing production.