Patch Radar

November 2026 security updates: Microsoft Patch Tuesday, macOS and Linux

The Linux distributions released 2,221 fixes for 7,062 CVEs. Every November 2026 security update, ranked by whether its vulnerabilities are being exploited.

Updated November 7, 2026, 6:46 PM UTCCISA KEV catalog: 2026-11-06EPSS scores: 2026-11-07

Which of your machines are still exposed? Get a demo.

518

Exploited CVEs with a fix available

Added to CISA KEV in the last 30 days

179,476

Fixes tracked across four platforms

1,420

CVEs in October's Patch Tuesday

Looks up an exact CVE ID, a Microsoft KB number, or a Linux advisory ID (DSA, DLA, RHSA, RLSA, ALSA, ELSA, SUSE-SU, openSUSE-SU, FEDORA or ALAS2023), or searches product, update and vulnerability names. An exact ID goes straight to its page.

Updates by month

What Microsoft, Apple and the Linux distributions released in a calendar month. Each list is in priority order: exploited (KEV or vendor-confirmed) first, then by exploited CVEs closed, then by highest EPSS. Counts include every update released that month, supported products or not. Third-party apps follow below, by recent vulnerability.

7,062 CVEs fixed, 129 closing exploited CVEs

Microsoft

No Microsoft updates released in November 2026.

macOS

No macOS updates from Apple released in November 2026.

Linux

All Linux fixes for November 2026

Distribution	Fixes	CVEs fixed	Closing exploited CVEs	Patch now
Rocky Linux	338	701	14	14
Oracle Linux	335	1,377	18	18
Debian	333	333	1	1
AlmaLinux	313	687	16	16
Ubuntu	259	179	50	50
SUSE Linux Enterprise	228	2,949	12	12
Amazon Linux	193	1,781	7	7
openSUSE Leap	129	3,222	9	9
Fedora	56	182	2	2
Red Hat	37	204

Each row counts a CVE once for that distribution. The Linux total above counts it once overall, so a CVE fixed by more than one distribution makes the rows add up to more than the total.

Highest priority this month

Priority	Fix	Released	CVEs	Exploited	Max EPSS	Max CVSS
Patch now	ELSA-2026-87080 apcu-panel, libzip, libzip-devel and 34 more on ol 8	Nov 7, 2026	12	KEV2	1.0000	9.8
Patch now	SUSE-SU-2026:4853-1 apache2-mod_php7, php7, php7-embed and 3 more on sles 15.6, sles 15.7	Nov 7, 2026	12	KEV2	1.0000	9.8
Patch now	ALSA-2026:87080 apcu-panel, libzip, libzip-devel and 34 more on almalinux 8	Nov 7, 2026	12	KEV2	1.0000	9.8
Patch now	RLSA-2026:87080 libzip, php, php-pear and 4 more on rocky 8	Nov 7, 2026	12	KEV2	1.0000	9.8
Patch now	FEDORA-2026-D5F8446449 php, php-bcmath, php-bcmath-debuginfo and 55 more on Fedora 43	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ELSA-2026-87070 php, php-bcmath, php-cli and 22 more on ol 10	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ELSA-2026-87071 php8.4, php8.4-bcmath, php8.4-cli and 22 more on ol 10	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ELSA-2026-87079 apcu-panel, php-pecl-apcu, php-pecl-apcu-devel and 4 more on ol 9	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ELSA-2026-87151 php, php-bcmath, php-cli and 22 more on ol 9	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ELSA-2026-87073 php-pecl-xdebug3 on ol 8	Nov 7, 2026	3	KEV2	1.0000	9.8

Patch Tuesday, month by month

CVEs Microsoft released on each Patch Tuesday, counted by original release date and excluding Azure Linux, the same way the industry trackers count. Select a bar to see that month above.

Microsoft CVEs per Patch Tuesday

Oct 2026: 1,420 CVEs in 51 security updates

Show as a table

Month	CVEs	Critical	Security updates	Exploited at release	Write-up
Oct 2026	1,420	80	51	1	Read
Sep 2026	1,004	113	57	2	Read
Aug 2026	710	84	58	1	Read
Jul 2026	574	57	56	3	Read
Jun 2026	246	30	28	0	Read
May 2026	114	15	40	0	Read
Apr 2026	176	7	50	2	Read
Mar 2026	78	3	39	0	Read
Feb 2026	53	2	29	6	Read
Jan 2026	116	8	26	1	Read
Dec 2025	72	0	29	1	Read
Nov 2025	64	4	31	1	None

Third-party apps

Apps with vulnerabilities published, or added to CISA's Known Exploited Vulnerabilities catalog, in the last 90 days, most urgent first. Install the latest version: it fixes every vulnerability counted here. "First fixed in" is the oldest version that closes the most urgent one, so you can tell whether a machine on an older build is still exposed to it.

Most affected Windows apps

Last 90 days, distinct CVEs by priority

Google Chrome Beta (EXE)

1,487 CVEs2 exploited
Google Chrome (EXE)

1,477 CVEs2 exploited
Google Chrome Dev (EXE)

1,477 CVEs2 exploited
Microsoft Edge

1,279 CVEs3 exploited
Microsoft Edge Beta

1,279 CVEs3 exploited
Microsoft Edge Dev

1,279 CVEs3 exploited
Microsoft Edge WebView2 Runtime

1,273 CVEs3 exploited
Mozilla Thunderbird (af)

240 CVEs
Mozilla Thunderbird (ar)

240 CVEs
Mozilla Thunderbird (ast)

240 CVEs

Patch nowUrgentHighRoutine

Most affected macOS apps

Last 90 days, distinct CVEs by priority

Google Chrome

1,442 CVEs2 exploited
Microsoft Edge

1,239 CVEs3 exploited
Mozilla Thunderbird

236 CVEs
Mozilla Firefox

230 CVEs
Microsoft Visual Studio Code

30 CVEs
PyCharm

4 CVEs
Docker Desktop

2 CVEs
KeePassXC

2 CVEs
VLC media player

2 CVEs
WebStorm

2 CVEs

Patch nowUrgentHighRoutine

Windows apps

All Windows app fixes

The 50 most urgent of 488 apps.

Priority	App	Latest version	CVEs	Exploited	Max EPSS	Max CVSS	First fixed in
Patch now	Microsoft Edge Microsoft	156.0.4314.58	1,279	KEV3	0.0981	9.8	154.0.4258.62
Patch now	Microsoft Edge Beta Microsoft	158.0.4370.7	1,279	KEV3	0.0981	9.8	127.0.2651.8
Patch now	Microsoft Edge Dev Microsoft	159.0.4378.0	1,279	KEV3	0.0981	9.8	152.0.4167.0
Patch now	Microsoft Edge WebView2 Runtime Microsoft	157.0.4341.42	1,273	KEV3	0.0981	9.8	154.0.4258.62
Patch now	Google Chrome Beta (EXE) Google	158.0.8127.18	1,487	KEV2	0.0351	9.8	154.0.8037.0
Patch now	Google Chrome (EXE) Google	157.0.8103.39	1,477	KEV2	0.0351	9.8	153.0.8010.37
Patch now	Google Chrome Dev (EXE) Google	159.0.8144.0	1,477	KEV2	0.0351	9.8	154.0.8013.2
Urgent	Microsoft .NET Windows Desktop Runtime 8.0 Microsoft	8.0.33	34	None	0.0166	9.8	8.0.32
Urgent	Microsoft .NET Windows Desktop Runtime 10.0 Microsoft	10.0.14	27	None	0.0166	9.8	10.0.14
Urgent	Microsoft ASP.NET Core Hosting Bundle 10.0 Microsoft	10.0.14	27	None	0.0166	9.8	10.0.14
Urgent	Microsoft .NET Windows Desktop Runtime 9.0 Microsoft	9.0.22	26	None	0.0166	9.8	9.0.21
Urgent	Microsoft ASP.NET Core Hosting Bundle 9.0 Microsoft	9.0.22	26	None	0.0166	9.8	9.0.21
Urgent	Microsoft ASP.NET Core Hosting Bundle 8.0 Microsoft	8.0.33	23	None	0.0166	9.8	8.0.32
Urgent	Microsoft Visual Studio Code Microsoft	1.143.1	30	None	0.0106	9.6	1.134.0
Urgent	Mozilla Thunderbird (af) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (ar) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (ast) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (be) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (bg) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (br) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (ca) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (cak) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (cs) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (cy) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (da) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (de) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (dsb) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (el) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (en-CA) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (en-GB) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (en-US) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (es-AR) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (es-ES) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (es-MX) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (et) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (eu) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (fi) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (fr) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (fy-NL) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (ga-IE) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (gd) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (gl) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (he) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (hr) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (hsb) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (hu) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (hy-AM) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (id) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (is) Mozilla	159.0	240	None	0.0096	10.0	141.0
Urgent	Mozilla Thunderbird (it) Mozilla	159.0	240	None	0.0096	10.0	141.0

macOS apps

13 apps.

Priority	App	Latest version	CVEs	Exploited	Max EPSS	Max CVSS	First fixed in
Patch now	Microsoft Edge Microsoft	157.0.4341.42	1,239	KEV3	0.0981	9.8	154.0.4258.62
Patch now	Google Chrome Google	157.0.8103.39	1,442	KEV2	0.0351	9.8	153.0.8010.37
Urgent	Microsoft Visual Studio Code Microsoft	1.145.2	30	None	0.0106	9.6	1.133.0
Urgent	Mozilla Thunderbird Mozilla	159.0	236	None	0.0096	10.0	154.0
Urgent	Mozilla Firefox Mozilla	159.0.1	230	None	0.0096	10.0	153.5.0
Urgent	PyCharm JetBrains	2026.3	4	None	0.0029	9.0	2026.2.4
Urgent	WebStorm JetBrains	2026.3	2	None	0.0029	9.0	2026.2.4
High	Docker Desktop Docker	4.98.0	2	None	0.0044	8.8	4.86.0
High	VLC media player VideoLAN	3.0.24	2	None	0.0024	7.3	3.0.24
High	Parallels Desktop Parallels	27.1.0	1	None	0.0017	7.8	26.4.1
Routine	Microsoft Defender Microsoft	101.26092.0012	1	None	0.0048	5.5	101.26042.0020
Routine	OneDrive Microsoft	26.189.0928	1	None	0.0039	6.7	26.098.0524
Routine	KeePassXC KeePassXC	2.8.0	2	None	0.0014	4.3	2.8.0

All fixes

One row per thing you install: a Microsoft KB, an app version, a macOS update or a Linux advisory. Sorted by priority, then by exploited CVEs closed, then by highest EPSS. Showing fixes released in the last 90 days; pick another range under Released.

Priority	Fix	Platform	Released	CVEs	Exploited	Max EPSS	Max CVSS
Patch now	Google Chrome 156.0.8078.80 Google Chrome	Windows apps	Oct 29, 2026	204	KEV4	0.5496	9.8
Patch now	Google Chrome Beta 158.0.8127.2 Google Chrome Beta	Windows apps	Oct 28, 2026	201	KEV4	0.5496	9.8
Patch now	Google Chrome Dev 159.0.8130.0 Google Chrome Dev	Windows apps	Oct 30, 2026	174	KEV3	0.1374	9.8
Patch now	OPENSUSE-SU-2026:20460-1 chromium on opensuse-leap 16.0	Linux	Aug 31, 2026	86	KEV3	0.1374	9.6
Patch now	ELSA-2026-87080 apcu-panel, libzip, libzip-devel and 34 more on ol 8	Linux	Nov 7, 2026	12	KEV2	1.0000	9.8
Patch now	SUSE-SU-2026:4853-1 apache2-mod_php7, php7, php7-embed and 3 more on sles 15.6, sles 15.7	Linux	Nov 7, 2026	12	KEV2	1.0000	9.8
Patch now	ALSA-2026:87080 apcu-panel, libzip, libzip-devel and 34 more on almalinux 8	Linux	Nov 7, 2026	12	KEV2	1.0000	9.8
Patch now	RLSA-2026:87080 libzip, php, php-pear and 4 more on rocky 8	Linux	Nov 7, 2026	12	KEV2	1.0000	9.8
Patch now	RHSA-2026:87080 apcu-panel, libzip, libzip-devel and 34 more on RHEL 8	Linux	Oct 24, 2026	12	KEV2	1.0000	9.8
Patch now	FEDORA-2026-D5F8446449 php, php-bcmath, php-bcmath-debuginfo and 55 more on Fedora 43	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ELSA-2026-87070 php, php-bcmath, php-cli and 22 more on ol 10	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ELSA-2026-87071 php8.4, php8.4-bcmath, php8.4-cli and 22 more on ol 10	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ELSA-2026-87079 apcu-panel, php-pecl-apcu, php-pecl-apcu-devel and 4 more on ol 9	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ELSA-2026-87151 php, php-bcmath, php-cli and 22 more on ol 9	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ELSA-2026-87073 php-pecl-xdebug3 on ol 8	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ALSA-2026:87079 apcu-panel, php-pecl-apcu, php-pecl-apcu-devel and 4 more on almalinux 9	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ALSA-2026:87073 php-pecl-xdebug3 on almalinux 8	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ALSA-2026:87070 php, php-bcmath, php-cli and 22 more on almalinux 10	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	ALSA-2026:87071 php8.4, php8.4-bcmath, php8.4-cli and 21 more on almalinux 10	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	RLSA-2026:87079 php-pecl-apcu, php-pecl-redis6, php-pecl-rrd and 2 more on rocky 9	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	RLSA-2026:87151 php on rocky 9	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	RLSA-2026:87070 php on rocky 10	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	RLSA-2026:87071 php8.4 on rocky 10	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	RLSA-2026:87073 libzip, php, php-pear and 4 more on rocky 8	Linux	Nov 7, 2026	3	KEV2	1.0000	9.8
Patch now	RHSA-2026:87071 php8.4 on RHEL 10	Linux	Oct 24, 2026	3	KEV2	1.0000	9.8

How priority is set

Four tiers with published rules, the same rules the Patchblox Vulnerability Hub uses. A fix takes the highest tier of any CVE it closes.

Patch now

Exploited in the wild: the vendor reports exploitation, or the CVE is in CISA's Known Exploited Vulnerabilities catalog.

Urgent

The vendor rates exploitation as more likely, or rates the CVE Critical.

High

CVSS 7.0 or higher, or rated High by the vendor when no CVSS score is published.

Routine

Everything else. Still worth installing on your normal schedule.

EPSS is shown as context and breaks ties within a tier. It does not move a CVE between tiers: a probability model should not outrank a confirmed exploitation report.

Where the data comes from

Microsoft Security Response CenterCVEs, KBs, affected products, exploitation and disclosure status

CISA Known Exploited VulnerabilitiesDate added, remediation due date, known ransomware use

FIRST EPSSExploit prediction scores and percentiles. EPSS data provided by FIRST.org

Apple security releasesmacOS updates, components and actively exploited flags

Linux distribution advisoriesDebian, Ubuntu, Red Hat, Rocky Linux, AlmaLinux, Oracle Linux, SUSE Linux Enterprise, openSUSE Leap, Fedora and Amazon Linux fixed package versions

Patchblox catalogWindows and macOS application versions and the CVEs each version fixes

For tools and AI agents

Every Patch Radar page also comes as Markdown and JSON, with the same data as the page. Each CVE, fix and product page links its own versions. Free to use, including at work and in your own tools, with attribution: how to credit Patch Radar.

FeedRSS · JSON Feed: fixes for newly exploited vulnerabilities, and CVEs newly added to CISA KEV

Overviewpatch-radar.md: Patch Now, the months covered, Patch Tuesday totals and the most urgent apps

November 2026JSON · Markdown: everything released that month

Guide for AI agentsllms.txt: the URL pattern for every CVE, fix, product and month file

Every pageSitemap: every CVE, fix, product and month page

This list is everyone's. Yours is shorter.

The tracker tells you what's exploited and what fixes it. Patchblox tells you which of your machines are still exposed, on every platform, and deploys the fix on Windows and Linux.

Get a demo See the platform

Works from the Intune, Entra and Azure Update Manager data you already have
Matches every installed app and OS build to the fix that closes its CVEs
Deploys through rings with validation, then confirms the exposure closed

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.