131
CVEs
22
Critical
63
High
0
KEV
19
PoC
6
Unpatched C/H
92.4%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
22
HIGH
63
MEDIUM
33
LOW
3
Monthly CVE Trend
Affected Products (30)
Ubuntu Linux
3427
Debian Linux
1883
Opensuse
1043
Enterprise Linux Server
699
Leap
696
Enterprise Linux Desktop
689
Enterprise Linux Workstation
686
Fedora
641
Linux Kernel
498
Enterprise Linux Server Aus
446
Enterprise Linux Server Tus
370
Enterprise Linux Eus
357
Firefox
350
MySQL
330
Enterprise Linux Server Eus
282
Enterprise Linux
277
Thunderbird
231
Linux Enterprise Server
228
Oncommand Workflow Automation
217
Active Iq Unified Manager
216
Linux Enterprise Desktop
205
Oncommand Insight
201
Snapcenter
172
MariaDB
163
Seamonkey
161
Linux Enterprise Software Development Kit
160
Java
147
Jdk
147
Jre
143
Imagemagick
141
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-48753 | Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a path-traversal-laden multipart upload ID and plant files anywhere the daemon (typically root) can write, escalating to remote code execution. The flaw lives in the local S3 storage backend's multipart upload handling, where the attacker-supplied uploadId is concatenated onto the uploads directory without sanitization. A complete working PoC exists that drops a /etc/cron.d job for root command execution; no CISA KEV listing or EPSS score is provided, so this is publicly available exploit code rather than confirmed active exploitation. | CRITICAL | 9.9 | 0.7% | 70 |
PoC
|
| CVE-2026-53727 | Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV. | HIGH | 8.9 | 0.5% | 65 |
PoC
|
| CVE-2026-50180 | Arbitrary file read in Langroid's SQLChatAgent (<= 0.63.0) lets an attacker who can influence the LLM-generated SQL exfiltrate files from the PostgreSQL host even under the strict default config (allow_dangerous_operations=False, allowed_statement_types=['SELECT']). The _validate_query blocklist enumerates dangerous functions by exact name and misses the pg_read_file/pg_stat_file/pg_ls_*/pg_current_logfile family (plus MSSQL OPENDATASOURCE and keyword-less SQLite ATTACH), so these SELECT-shaped payloads pass both the statement-type allowlist and the regex blocklist and reach the live SQLAlchemy engine. Publicly available exploit code exists (a working PoC ships in the GHSA advisory); no public exploit identified as actively exploited and this is not in CISA KEV. | HIGH | 8.7 | 0.7% | 64 |
PoC
|
| CVE-2026-55245 | SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provider request to reach internal network services - including cloud instance-metadata endpoints - by supplying IPv6 transition-form addresses (6to4, NAT64) or CGNAT addresses that the `isPublicIP` deny-list in `core/providers/utils/fetch.go` incorrectly classifies as routable public IPs. All releases of the `github.com/maximhq/bifrost/core` Go module prior to v1.5.17 are affected, confirmed on dev HEAD f415c14 (core/version 1.5.15). Publicly available exploit code exists in the GHSA advisory as a runnable Go test; no CISA KEV listing at time of analysis. | HIGH | 8.7 | 0.4% | 64 |
PoC
|
| CVE-2026-49852 | Authentication bypass in the joserfc Python JOSE/JWT library (PyPI, versions <= 1.6.7) lets unauthenticated attackers forge valid HS256/HS384/HS512 tokens whenever the application's verification secret resolves to an empty string or None. Because HMACAlgorithm.verify feeds a zero-length key straight into hmac.new(b"", ...) and OctKey.import_key only warned (never rejected) empty material, an attacker who knows no secret can reproduce the exact digest with HMAC(key=b"") and pass hmac.compare_digest. Publicly available exploit code exists (working PoC in the advisory); the flaw is fixed in 1.6.8. This is the cross-language sibling of ruby-jwt CVE-2026-45363. No EPSS score or CISA KEV listing was provided; no public exploit-in-the-wild is claimed. | HIGH | 8.7 | 0.2% | 64 |
PoC
|
| CVE-2026-52776 | URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud metadata services, loopback admin interfaces, and RFC 1918 internal networks by embedding IPv4-mapped IPv6 literals (e.g., [::ffff:169.254.169.254]) or the unspecified address 0.0.0.0 in OSCAL artifact import references processed by HTTPSFetcher or SFTPFetcher. Python's ipaddress module silently returns False - rather than raising TypeError - when comparing IPv6Address objects against IPv4Network ranges, so the validator's membership checks pass these forms through to requests.get unchanged. A publicly available proof-of-concept reproduces end-to-end IMDS credential exfiltration; no active exploitation is listed in CISA KEV and EPSS stands at 0.42%. | HIGH | 8.6 | 0.4% | 63 |
PoC
|
| CVE-2026-71309 | Path traversal in rclone's `serve restic` REST API allows any attacker with network access to the endpoint to read, create, overwrite, or delete objects outside the operator-configured backend directory. The flaw spans rclone v1.40 through v1.74.4 and affects WebDAV, FTP, SFTP, HTTP, and Memory backends - but not S3-compatible or local filesystem backends, which encode `..` as literal filename characters. A fully functional, step-by-step proof of concept has been publicly released; no CISA KEV listing exists at time of analysis. | HIGH | 8.6 | 0.3% | 63 |
PoC
|
| CVE-2026-24791 | Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth grants to read and modify private account resources via `/api/v1/user/...` self routes, despite the public-only flag being designed to restrict tokens to public data. The flaw is a systemic scope-boundary failure across many self routes (SSH keys, emails, OAuth apps, Actions secrets/variables/runners, private repos, webhooks), publicly available exploit code exists in the form of reproducible Go PoCs in the advisory, and the issue represents an incomplete fix of CVE-2025-68941 in a different route family. | HIGH | 8.1 | 0.2% | 61 |
PoC
|
| CVE-2026-54071 | Arbitrary Python code execution in BabelDOC (funstory-ai, pip package `babeldoc`) prior to 0.6.3 allows an attacker to run code in the context of the translation process by having a victim process a crafted PDF. The vendored pdfminer CMap loader (`cmapdb.py::_load_data`) strips only NUL bytes from a PDF-controlled CMap/Encoding name and passes it to `pickle.loads()`, so a hex-encoded absolute path in the PDF's `/Encoding` name redirects deserialization to an attacker-planted `.pickle.gz` file. A detailed, working proof-of-concept exists (publicly available exploit code exists); there is no CISA KEV listing and no public evidence of active exploitation at time of analysis. | HIGH | 7.8 | 0.1% | 59 |
PoC
|
| CVE-2026-54550 | Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources. | HIGH | 7.4 | 0.4% | 57 |
PoC
|
| CVE-2026-48816 | Timestamp forgery in sigstore-js allows an attacker supplying a crafted bundle v0.2 to manipulate certificate validity window checks by controlling the `integratedTime` field in an inclusionProof-only tlog entry. Because the inclusionProof-only code path in `@sigstore/verify` does not cryptographically bind `integratedTime` (unlike the signed inclusionPromise/set path), a low-privileged attacker who can present an untrusted bundle can cause the verifier to accept expired or not-yet-valid signing certificates as currently valid. A publicly available proof-of-concept exists; this vulnerability is not in CISA KEV. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
|
| CVE-2026-63294 | Privilege escalation to host root in Canonical LXD occurs when the container manager unpacks crafted image or backup archives, because it follows a symbolic link where the backup.yaml metadata file should be and then processes attacker-controlled configuration outside its intended confinement. A low-privileged LXD user who can import a malicious archive can execute arbitrary commands as root on the underlying host, breaking the container/host trust boundary (scope change). Rated CVSS 9.9; no public exploit identified at time of analysis and not listed in CISA KEV, but the fix is coordinated through GitHub advisory GHSA-fv82-v4fj-mm4m. | CRITICAL | 9.9 | 1.0% | 51 |
|
| CVE-2026-66897 | Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an attacker with container edit permissions - or any user who launches a maliciously crafted image - overwrite arbitrary root-owned files on the host. The root cause is a validate-then-open mismatch: LXD checks template target paths against a confined os.Root handle but then creates the file via os.Create using the raw, unconfined string path. No public exploit has been identified at time of analysis, but the CVSS 9.9 rating and container-to-host scope change make this a critical container-escape. | CRITICAL | 9.9 | 0.6% | 50 |
|
| CVE-2026-63293 | Arbitrary host file read and write in Canonical LXD occurs because the image import/unpack routine does not verify whether the bundled metadata.yaml entry is a symbolic link, letting an authenticated user with image-import rights supply a crafted archive whose symlinked metadata.yaml resolves to sensitive host paths. Rated CVSS 9.9 with a scope change (S:C), successful exploitation crosses the container/management boundary to read or overwrite files as the LXD daemon (typically root) on the host. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; details are published only in Canonical advisory GHSA-j825-cg34-5fr5. | CRITICAL | 9.9 | 0.4% | 50 |
|
| CVE-2026-63298 | Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvidia.driver.capabilities` and `nvidia.require.*` instance config values, enabling an authenticated attacker to inject arbitrary directives into the generated `lxc.conf` file. Any LXD user with instance-creation or configuration-modification privileges can exploit this to escape the container boundary and execute arbitrary commands on the host with the full privileges of the LXD daemon - effectively achieving complete host compromise. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, low-privilege attack path and scope-changed CVSS vector reflect an elevated real-world threat for shared or multi-tenant LXD deployments. | CRITICAL | 9.9 | 0.4% | 50 |
|