9
CVEs
2
Critical
3
High
0
KEV
0
PoC
3
Unpatched C/H
44.4%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
3
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (30)
Fabric Operating System
73
Linux Kernel
48
Tcpreplay
45
Brocade Sannav
44
Fedora
43
Debian Linux
33
Android
29
Raid Controller Web Interface
22
Active Iq Unified Manager
22
Brocade Fabric Operating System Firmware
21
Cloud Backup
21
Ubuntu Linux
19
Java
16
Steelstore Cloud Integrated Storage
15
Sannav
14
Rabbitmq Server
13
Data Availability Services
12
Solidfire Baseboard Management Controller Firmware
12
E Series Santricity Os Controller
12
Opensuse
12
Leap
11
Windows
11
Symantec Critical System Protection
11
Solidfire Hci Management Node
11
Dx Netops Spectrum
10
Brocade Fabric Operating System
10
Ca Api Developer Portal
10
Hci Baseboard Management Controller
9
Privileged Access Manager
9
Fas Aff Baseboard Management Controller
8
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-64125 | Denial-of-service and memory corruption in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver occurs when RBUF_EEE_EN and RBUF_PM_EN are set in RBUF_ENERGY_CTRL and MAC Energy-Efficient Ethernet becomes active, silently halting the RX path while the link stays up and, on some boards, triggering a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. It affects Linux systems using Broadcom GENET NICs (e.g. Raspberry Pi 4B/BCM2711, Broadcom 4908-family SoCs), and is triggered by default now that phy_support_eee() enables EEE automatically, or on older kernels once TX LPI is enabled via ethtool. No public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile), and the CISA-KEV / attacker-controlled framing implied by the CVSS 9.8 does not match the local hardware-interaction nature of the bug. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-64583 | Use-after-free and NULL pointer dereference in the Linux kernel Broadcom BDC USB Device Controller driver expose systems to local privilege escalation during device teardown. The BDC driver's teardown sequence frees DMA-coherent memory and endpoint arrays while a shared IRQ handler remains live - a structural defect introduced when the driver adopted devm_request_irq(), whose LIFO devm release order creates a window where the interrupt handler dereferences freed or NULLed kernel structures. A separately unguarded delayed_work (func_wake_notify) compounds the issue with no cancellation path anywhere in the driver, allowing post-teardown callbacks against freed memory. No public exploit exists and the vulnerability is not in CISA KEV; it was identified by in-house static analysis with EPSS at the 5th percentile (0.16%), indicating negligible current exploitation activity. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-47881 | Uncontrolled resource consumption in Spring Batch's FlatFileItemReader allows denial-of-service against batch jobs that process externally-supplied flat files containing multi-line records. When a specially crafted file is fed to the reader - exploiting its logic for assembling logical records spread across multiple physical lines (e.g., quoted CSV fields with embedded newlines) - the job stalls or exhausts memory, disrupting batch processing pipelines. Affected are all actively maintained Spring Batch branches: 4.3.0-4.3.13, 5.2.0-5.2.6, and 6.0.0-6.0.4. No public exploit or active exploitation has been identified at time of analysis. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-47878 | Unsafe Java deserialization in Spring Batch's DefaultExecutionContextSerializer exposes the JDBC job repository to potential remote code execution via gadget-chain exploitation. The serializer passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter restricting instantiable types, creating a CWE-502 attack surface that any suitable gadget chain on the classpath can weaponize. Affected versions span Spring Batch 5.2.6 and earlier and 6.0.0 through 6.0.4; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. | HIGH | 7.3 | 0.2% | 37 |
No patch
|
| CVE-2026-47875 | Remote code execution in Spring Batch 5.2.0-5.2.6 and 6.0.0-6.0.4 arises because the JobParameterDeserializer fails to enforce the trusted-types allowlist when Jackson2ExecutionContextStringSerializer deserializes execution contexts from a job repository backed by an untrusted data source. An attacker who can plant crafted execution-context data can trigger known Jackson polymorphic deserialization gadgets to execute arbitrary code in the batch application's process. No public exploit identified at time of analysis; EPSS is low (0.25%, 16th percentile) and CISA SSVC lists exploitation status as none, so the 9.8 CVSS reflects worst-case impact rather than observed activity. | CRITICAL | 9.8 | 0.2% | 35 |
No patch
|
| CVE-2026-53093 | Error pointer dereference in the Linux kernel's brcmfmac Broadcom WiFi driver allows a local low-privilege attacker to crash the kernel via a NULL pointer dereference, resulting in denial of service. The function brcmf_chip_add_core() in brcmf_chip_recognition() can return an ERR_PTR sentinel value that is never validated before being dereferenced at five separate code sites (lines 1010-1022 of chip.c), as identified by Smatch static analysis. No public exploit or active exploitation has been identified; EPSS sits at 0.18% (7th percentile), consistent with a low-priority local DoS affecting only systems with Broadcom WiFi hardware. | MEDIUM | 5.5 | 0.2% | 28 |
|
| CVE-2026-15380 | Full SYSTEM-level code execution in Broadcom's Symantec IT Management Suite (ITMS) 8.7.3 is reachable by any non-administrator interactive user via a DCOM and Windows Task Scheduler logic chain, requiring no network access and no memory corruption. The attack is confined to the local host, meaning a standard user account with an interactive session on the ITMS server is sufficient to achieve unrestricted SYSTEM privileges. No public exploit has been identified at time of analysis, though Broadcom's advisory carries the highest urgency rating (U:Red) and the CVSS 4.0 supplemental metric AU:Y indicates the exploitation steps can be automated once understood. | MEDIUM | 5.1 | 0.1% | 26 |
No patch
|
| CVE-2026-15379 | Local privilege escalation via a misconfigured WMI provider in Broadcom's Symantec IT Management Suite (Altiris) exposes SYSTEM-readable files to any local standard user. The AltirisAgent_Stream WMI class fails to re-impersonate the calling user when servicing queries, reverting to the LocalSystem context instead - allowing unprivileged local users to bypass filesystem ACLs and read files that are restricted to SYSTEM or Administrator accounts, including configuration files, service logs, and stored secrets. No public exploit has been identified at time of analysis, though the technique is mechanically straightforward for any authenticated local user; the Broadcom advisory (SA 37995) is the authoritative disclosure source. | MEDIUM | 5.1 | 0.1% | 26 |
No patch
|
| CVE-2026-68304 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Based on wpa_auth as 1x_256 | – | 0.2% | 0 |
|