58
CVEs
4
Critical
26
High
1
KEV
2
PoC
22
Unpatched C/H
32.8%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
26
MEDIUM
24
LOW
2
Monthly CVE Trend
Affected Products (30)
Fabric Operating System
73
Linux Kernel
48
Tcpreplay
45
Brocade Sannav
44
Fedora
43
Debian Linux
33
Android
29
Raid Controller Web Interface
22
Active Iq Unified Manager
22
Brocade Fabric Operating System Firmware
21
Cloud Backup
21
Ubuntu Linux
19
Java
16
Steelstore Cloud Integrated Storage
15
Sannav
14
Rabbitmq Server
13
Data Availability Services
12
Solidfire Baseboard Management Controller Firmware
12
E Series Santricity Os Controller
12
Opensuse
12
Leap
11
Windows
11
Symantec Critical System Protection
11
Solidfire Hci Management Node
11
Dx Netops Spectrum
10
Brocade Fabric Operating System
10
Ca Api Developer Portal
10
Hci Baseboard Management Controller
9
Privileged Access Manager
9
Fas Aff Baseboard Management Controller
8
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-22719 | VMware Aria Operations contains a command injection vulnerability (CVE-2026-22719, CVSS 8.1) that allows unauthenticated remote attackers to execute arbitrary commands during support-assisted product migration. KEV-listed with patches available, this vulnerability targets the infrastructure monitoring platform that has visibility into the entire virtualized environment. | HIGH | 8.1 | 7.4% | 98 |
KEV
|
| CVE-2025-51006 | Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxsll2/linuxsll2.c. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.1% | 59 |
PoC
|
| CVE-2025-51005 | A heap-buffer-overflow vulnerability exists in the tcpliveplay utility of the tcpreplay-4.5.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.2% | 58 |
PoC
No patch
|
| CVE-2026-64125 | Denial-of-service and memory corruption in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver occurs when RBUF_EEE_EN and RBUF_PM_EN are set in RBUF_ENERGY_CTRL and MAC Energy-Efficient Ethernet becomes active, silently halting the RX path while the link stays up and, on some boards, triggering a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. It affects Linux systems using Broadcom GENET NICs (e.g. Raspberry Pi 4B/BCM2711, Broadcom 4908-family SoCs), and is triggered by default now that phy_support_eee() enables EEE automatically, or on older kernels once TX LPI is enabled via ethtool. No public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile), and the CISA-KEV / attacker-controlled framing implied by the CVSS 9.8 does not match the local hardware-interaction nature of the bug. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2025-69269 | Broadcom DX NetOps Spectrum (23.3.6 and earlier) has unauthenticated OS command injection on both Windows and Linux platforms. As a network management system, compromise gives attackers visibility and control over the entire monitored infrastructure. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2025-69270 | Broadcom DX NetOps Spectrum (24.3.8 and earlier) exposes session tokens in URL query strings, enabling session hijacking through browser history, referer headers, or proxy logs. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2025-69276 | Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection.This issue affects DX NetOps Spectrum: 24.3.13 and earlier. [CVSS 8.8 HIGH] | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-0869 | Brocade Active Support Connectivity Gateway versions up to 3.4.0 contains a vulnerability that allows attackers to an unauthorized user to perform ASCG operations related to Brocade Support Link( (CVSS 8.8). | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2025-69274 | Authorization Bypass Through User-Controlled Key vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Privilege Escalation.This issue affects DX NetOps Spectrum: 24.3.10 and earlier. [CVSS 8.8 HIGH] | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-8370 | Local privilege escalation in Broadcom Automic Automation Agent versions prior to 24.4.4 HF1 allows authenticated low-privileged users on Unix-family systems (Linux x64, Linux Power 64 BE/LE, zLinux, AIX, Solaris x64, Solaris Sparc 64) to abuse the agent's elevated privileges and target programs running with higher rights. The CVSS 4.0 score of 8.5 reflects high confidentiality, integrity, and availability impact achievable from a local foothold, with no public exploit identified at time of analysis. | HIGH | 8.5 | 0.0% | 43 |
|
| CVE-2026-22720 | Stored XSS in VMware Aria Operations allows authenticated users with benchmark creation privileges to inject malicious scripts and execute arbitrary administrative actions within the platform. This vulnerability affects VMware, Broadcom, and Telco Cloud Infrastructure products with a CVSS score of 8.0, requiring user interaction to trigger the attack. Patches are available through VMSA-2026-0001. | HIGH | 8.0 | 0.1% | 40 |
|
| CVE-2026-64583 | Use-after-free and NULL pointer dereference in the Linux kernel Broadcom BDC USB Device Controller driver expose systems to local privilege escalation during device teardown. The BDC driver's teardown sequence frees DMA-coherent memory and endpoint arrays while a shared IRQ handler remains live - a structural defect introduced when the driver adopted devm_request_irq(), whose LIFO devm release order creates a window where the interrupt handler dereferences freed or NULLed kernel structures. A separately unguarded delayed_work (func_wake_notify) compounds the issue with no cancellation path anywhere in the driver, allowing post-teardown callbacks against freed memory. No public exploit exists and the vulnerability is not in CISA KEV; it was identified by in-house static analysis with EPSS at the 5th percentile (0.16%), indicating negligible current exploitation activity. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-3991 | Elevation of privilege in Symantec Data Loss Prevention Windows Endpoint allows authenticated local users to gain SYSTEM-level access and compromise protected resources. Affects all versions prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, and 16.0 MP2 HF15. CVSS 7.8 (High) reflects the local attack vector but complete system compromise upon successful exploitation. No public exploit identified at time of analysis, though the CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) classification suggests potential DLL hijacking or similar trust boundary violations. | HIGH | 7.8 | 0.0% | 39 |
No patch
|
| CVE-2026-0383 | Brocade Fabric OS contains a command injection vulnerability that allows authenticated local users with shell access to read sensitive files and command history due to insecure storage practices. An attacker with local privileges can exploit this to access confidential information stored on the system. No patch is currently available. | HIGH | 7.8 | 0.0% | 39 |
No patch
|
| CVE-2025-9711 | Fabric Operating System versions up to 9.2.1 contains a vulnerability that allows attackers to elevating the privileges of the local authenticated user to “root” using the exp (CVSS 7.8). | HIGH | 7.8 | 0.0% | 39 |
No patch
|