On 29 September 2026, OpenSSL fixed CVE-2026-84782, an out-of-bounds read in DTLS retransmission that can expose heap memory as plaintext or crash the program. Upgrade to 4.0.3, 3.6.5, 3.5.9 or 3.4.8, then audit every binary that bundles its own OpenSSL.

An out-of-bounds write in the Linux kernel’s IPv6 UDP fragment handling, rated CVSS 7.8, lets a local attacker escalate privileges and is already being exploited — CISA added it to the KEV catalog on 27 August 2026. Patch the kernel before 30 August and treat IPv6 as something you monitor, not just route.