3
CVEs
1
Critical
2
High
0
KEV
0
PoC
3
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
2
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Fabric Operating System
73
Linux Kernel
48
Tcpreplay
45
Brocade Sannav
44
Fedora
43
Debian Linux
33
Android
29
Raid Controller Web Interface
22
Active Iq Unified Manager
22
Brocade Fabric Operating System Firmware
21
Cloud Backup
21
Ubuntu Linux
19
Java
16
Steelstore Cloud Integrated Storage
15
Sannav
14
Rabbitmq Server
13
Data Availability Services
12
Solidfire Baseboard Management Controller Firmware
12
E Series Santricity Os Controller
12
Opensuse
12
Leap
11
Windows
11
Symantec Critical System Protection
11
Solidfire Hci Management Node
11
Dx Netops Spectrum
10
Brocade Fabric Operating System
10
Ca Api Developer Portal
10
Hci Baseboard Management Controller
9
Privileged Access Manager
9
Fas Aff Baseboard Management Controller
8
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-47881 | Uncontrolled resource consumption in Spring Batch's FlatFileItemReader allows denial-of-service against batch jobs that process externally-supplied flat files containing multi-line records. When a specially crafted file is fed to the reader - exploiting its logic for assembling logical records spread across multiple physical lines (e.g., quoted CSV fields with embedded newlines) - the job stalls or exhausts memory, disrupting batch processing pipelines. Affected are all actively maintained Spring Batch branches: 4.3.0-4.3.13, 5.2.0-5.2.6, and 6.0.0-6.0.4. No public exploit or active exploitation has been identified at time of analysis. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-47878 | Unsafe Java deserialization in Spring Batch's DefaultExecutionContextSerializer exposes the JDBC job repository to potential remote code execution via gadget-chain exploitation. The serializer passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter restricting instantiable types, creating a CWE-502 attack surface that any suitable gadget chain on the classpath can weaponize. Affected versions span Spring Batch 5.2.6 and earlier and 6.0.0 through 6.0.4; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. | HIGH | 7.3 | 0.2% | 37 |
No patch
|
| CVE-2026-47875 | Remote code execution in Spring Batch 5.2.0-5.2.6 and 6.0.0-6.0.4 arises because the JobParameterDeserializer fails to enforce the trusted-types allowlist when Jackson2ExecutionContextStringSerializer deserializes execution contexts from a job repository backed by an untrusted data source. An attacker who can plant crafted execution-context data can trigger known Jackson polymorphic deserialization gadgets to execute arbitrary code in the batch application's process. No public exploit identified at time of analysis; EPSS is low (0.25%, 16th percentile) and CISA SSVC lists exploitation status as none, so the 9.8 CVSS reflects worst-case impact rather than observed activity. | CRITICAL | 9.8 | 0.2% | 35 |
No patch
|