2
CVEs
1
Critical
0
High
1
KEV
1
PoC
0
Unpatched C/H
50.0%
Patch Rate
0.6%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
0
MEDIUM
0
LOW
1
Monthly CVE Trend
Affected Products (30)
Eos
25
Ng Firewall
20
Debian Linux
15
Cloudvision Portal
8
C 65 Firmware
7
C 75 Firmware
7
Ubuntu Linux
7
Enterprise Linux Server
7
W 68 Firmware
7
O 90 Firmware
7
Enterprise Linux Server Aus
6
Linux Enterprise Server
6
Enterprise Linux Workstation
6
Metamako Operating System
6
Enterprise Linux Server Tus
5
C 230 Firmware
5
Virtualization
5
Fedora
5
C 130 Firmware
5
C 110 Firmware
5
C 260 Firmware
5
C 250 Firmware
5
C 235 Firmware
5
C 120 Firmware
5
O 105 Firmware
5
Enterprise Linux Eus
5
W 118 Firmware
5
Enterprise Linux Desktop
5
C 100 Firmware
5
C 200 Firmware
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-16812 | Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to access internal functionality and fully compromise the host system, impacting data managed by the orchestrator. This issue is known to be actively exploited. Hosted and Dedicated VCO versions have been pre-emptively patched. | CRITICAL | 10.0 | 1.0% | 121 |
KEV
PoC
|
| CVE-2026-75945 | Arista EOS 4.36.0 through 4.36.1F contains a race condition in IEEE 802.1X port-based Network Access Control that can leave a supplicant in an authorized state after an administrator explicitly issues the 'clear dot1x host all' deauthorization command. The flaw (CWE-459: Incomplete Cleanup) means that a device intended to be removed from the network may retain valid access, undermining the administrative action entirely. No public exploit code exists and SSVC exploitation status is confirmed as none; however, the integrity gap created - a device that should be denied access remaining authorized - is the primary concern for network access control posture. | LOW | 2.1 | 0.1% | 10 |
No patch
|