23
CVEs
2
Critical
7
High
0
KEV
0
PoC
4
Unpatched C/H
65.2%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
7
MEDIUM
13
LOW
0
Monthly CVE Trend
Affected Products (30)
Fabric Operating System
73
Linux Kernel
48
Tcpreplay
45
Brocade Sannav
44
Fedora
43
Debian Linux
33
Android
29
Raid Controller Web Interface
22
Active Iq Unified Manager
22
Brocade Fabric Operating System Firmware
21
Cloud Backup
21
Ubuntu Linux
19
Java
16
Steelstore Cloud Integrated Storage
15
Sannav
14
Rabbitmq Server
13
Data Availability Services
12
Solidfire Baseboard Management Controller Firmware
12
E Series Santricity Os Controller
12
Opensuse
12
Leap
11
Windows
11
Symantec Critical System Protection
11
Solidfire Hci Management Node
11
Dx Netops Spectrum
10
Brocade Fabric Operating System
10
Ca Api Developer Portal
10
Hci Baseboard Management Controller
9
Privileged Access Manager
9
Fas Aff Baseboard Management Controller
8
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-64125 | Denial-of-service and memory corruption in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver occurs when RBUF_EEE_EN and RBUF_PM_EN are set in RBUF_ENERGY_CTRL and MAC Energy-Efficient Ethernet becomes active, silently halting the RX path while the link stays up and, on some boards, triggering a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. It affects Linux systems using Broadcom GENET NICs (e.g. Raspberry Pi 4B/BCM2711, Broadcom 4908-family SoCs), and is triggered by default now that phy_support_eee() enables EEE automatically, or on older kernels once TX LPI is enabled via ethtool. No public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile), and the CISA-KEV / attacker-controlled framing implied by the CVSS 9.8 does not match the local hardware-interaction nature of the bug. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-8370 | Local privilege escalation in Broadcom Automic Automation Agent versions prior to 24.4.4 HF1 allows authenticated low-privileged users on Unix-family systems (Linux x64, Linux Power 64 BE/LE, zLinux, AIX, Solaris x64, Solaris Sparc 64) to abuse the agent's elevated privileges and target programs running with higher rights. The CVSS 4.0 score of 8.5 reflects high confidentiality, integrity, and availability impact achievable from a local foothold, with no public exploit identified at time of analysis. | HIGH | 8.5 | 0.0% | 43 |
|
| CVE-2026-64583 | Use-after-free and NULL pointer dereference in the Linux kernel Broadcom BDC USB Device Controller driver expose systems to local privilege escalation during device teardown. The BDC driver's teardown sequence frees DMA-coherent memory and endpoint arrays while a shared IRQ handler remains live - a structural defect introduced when the driver adopted devm_request_irq(), whose LIFO devm release order creates a window where the interrupt handler dereferences freed or NULLed kernel structures. A separately unguarded delayed_work (func_wake_notify) compounds the issue with no cancellation path anywhere in the driver, allowing post-teardown callbacks against freed memory. No public exploit exists and the vulnerability is not in CISA KEV; it was identified by in-house static analysis with EPSS at the 5th percentile (0.16%), indicating negligible current exploitation activity. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-3991 | Elevation of privilege in Symantec Data Loss Prevention Windows Endpoint allows authenticated local users to gain SYSTEM-level access and compromise protected resources. Affects all versions prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, and 16.0 MP2 HF15. CVSS 7.8 (High) reflects the local attack vector but complete system compromise upon successful exploitation. No public exploit identified at time of analysis, though the CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) classification suggests potential DLL hijacking or similar trust boundary violations. | HIGH | 7.8 | 0.0% | 39 |
No patch
|
| CVE-2026-47881 | Uncontrolled resource consumption in Spring Batch's FlatFileItemReader allows denial-of-service against batch jobs that process externally-supplied flat files containing multi-line records. When a specially crafted file is fed to the reader - exploiting its logic for assembling logical records spread across multiple physical lines (e.g., quoted CSV fields with embedded newlines) - the job stalls or exhausts memory, disrupting batch processing pipelines. Affected are all actively maintained Spring Batch branches: 4.3.0-4.3.13, 5.2.0-5.2.6, and 6.0.0-6.0.4. No public exploit or active exploitation has been identified at time of analysis. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-41695 | Denial of service in Spring Data Commons 3.4.x, 3.5.x, and 4.0.x allows remote unauthenticated attackers to exhaust server resources by supplying crafted property path strings that the MappingContext resolves inefficiently. The flaw is reachable wherever applications expose property path parsing to untrusted input, and with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) it is trivially triggerable, though no public exploit identified at time of analysis and the issue is not on the CISA KEV list. | HIGH | 7.5 | 0.0% | 38 |
|
| CVE-2026-41716 | Denial-of-service in Spring Data Commons (versions 2.7.0-4.0.5) allows remote unauthenticated attackers to exhaust JVM heap memory by repeatedly submitting unique property-name strings that are permanently retained in an internal property-lookup cache. The flaw maps to CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) reflecting purely availability impact. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV. | HIGH | 7.5 | 0.0% | 38 |
|
| CVE-2026-47878 | Unsafe Java deserialization in Spring Batch's DefaultExecutionContextSerializer exposes the JDBC job repository to potential remote code execution via gadget-chain exploitation. The serializer passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter restricting instantiable types, creating a CWE-502 attack surface that any suitable gadget chain on the classpath can weaponize. Affected versions span Spring Batch 5.2.6 and earlier and 6.0.0 through 6.0.4; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. | HIGH | 7.3 | 0.2% | 37 |
No patch
|
| CVE-2026-47875 | Remote code execution in Spring Batch 5.2.0-5.2.6 and 6.0.0-6.0.4 arises because the JobParameterDeserializer fails to enforce the trusted-types allowlist when Jackson2ExecutionContextStringSerializer deserializes execution contexts from a job repository backed by an untrusted data source. An attacker who can plant crafted execution-context data can trigger known Jackson polymorphic deserialization gadgets to execute arbitrary code in the batch application's process. No public exploit identified at time of analysis; EPSS is low (0.25%, 16th percentile) and CISA SSVC lists exploitation status as none, so the 9.8 CVSS reflects worst-case impact rather than observed activity. | CRITICAL | 9.8 | 0.2% | 35 |
No patch
|
| CVE-2026-41719 | SpEL (Spring Expression Language) injection in Spring Data KeyValue and Spring Data Redis allows a network-accessible, low-privileged attacker to execute arbitrary SpEL expressions when applications pass unsanitized user-controlled Sort parameters directly to repository query methods delegating to SpelPropertyComparator. Affected versions span eight major release lines from 2.7.x through 4.0.x, making the exposure surface broad across Spring-based Java ecosystems. No public exploit identified at time of analysis and no CISA KEV listing, but the high confidentiality impact rating and network attack vector warrant prompt patching for any application that surfaces Sort query parameters to end users. | MEDIUM | 6.4 | 0.0% | 32 |
|
| CVE-2026-41008 | Spring Authorization Server's authorization endpoint fails to adequately validate the OAuth2/OIDC `request_uri` parameter, enabling unauthenticated remote attackers to craft authorization requests that bypass redirect URI validation entirely. Affected deployments running Spring Authorization Server 1.5.0-1.5.7 or Spring Security 7.0.0-7.0.5 can be exploited to redirect authenticated users to attacker-controlled destinations, a particularly elevated risk given that victims inherently trust the authorization server's domain during OAuth login flows. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | MEDIUM | 6.1 | 0.0% | 31 |
|
| CVE-2026-41721 | Uncontrolled resource consumption in Spring Data Commons exposes applications to a remote Denial of Service condition when two specific features are active simultaneously. An unauthenticated remote attacker can send a specially crafted HTTP request to any endpoint backed by a @ProjectedPayload-annotated controller method, triggering unbounded memory allocation that exhausts the JVM heap and crashes the application. The vulnerability spans eight major release lines (2.7.x through 4.0.x), making the potential blast radius broad across Spring-based Java backends. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS attack complexity rating of High reflects non-trivial preconditions that meaningfully limit opportunistic exploitation. | MEDIUM | 5.9 | 0.2% | 30 |
|
| CVE-2026-41711 | Denial of Service in Spring Data Commons affects applications that parse Sort parameters, triggering a StackOverflowException via crafted input. All major supported and legacy branches from 2.7.x through 4.0.x are affected, making the blast radius exceptionally broad across the Spring ecosystem. CVSS rates this Medium (5.9) with a high attack complexity qualifier (AC:H), unauthenticated network access (PR:N), and full availability impact (A:H); no active exploitation is confirmed and no public exploit code has been identified at time of analysis. | MEDIUM | 5.9 | 0.1% | 30 |
|
| CVE-2026-40991 | XXE injection in Spring REST Docs exposes developer machines and CI runners to file disclosure when documentation-generating tests process responses from a remote API. Versions 4.0.0, 3.0.0-3.0.5, and 2.0.0.RELEASE-2.0.8.RELEASE of the spring-restdocs-webtestclient and spring-restdocs-restassured modules fail to disable XML external entity processing, allowing an attacker who controls the documented API endpoint to serve a malicious XML response. No confirmed active exploitation exists (not in CISA KEV), and no public exploit has been identified at time of analysis; however, the High confidentiality impact against developer and CI environments warrants prompt patching. | MEDIUM | 5.9 | 0.0% | 30 |
|
| CVE-2026-44839 | Stored cross-site scripting (XSS) in the RabbitMQ Management Plugin web UI allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser of another administrative user viewing the affected page. Affected deployments span RabbitMQ Server 3.7.0 through 4.0.12 and 4.1.0-alpha through 4.1.1. No public exploit code or active exploitation has been identified at time of analysis; however, successful exploitation can result in high confidentiality impact, consistent with session token theft or credential harvesting within the management console. | MEDIUM | 5.6 | 0.0% | 28 |
|