135
CVEs
22
Critical
47
High
1
KEV
19
PoC
3
Unpatched C/H
94.8%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
22
HIGH
47
MEDIUM
32
LOW
9
Monthly CVE Trend
Affected Products (30)
Ubuntu Linux
3427
Debian Linux
1884
Opensuse
1043
Enterprise Linux Server
699
Leap
696
Enterprise Linux Desktop
689
Enterprise Linux Workstation
686
Fedora
641
Linux Kernel
467
Enterprise Linux Server Aus
446
Enterprise Linux Server Tus
370
Enterprise Linux Eus
357
Firefox
348
MySQL
330
Enterprise Linux Server Eus
282
Enterprise Linux
277
Thunderbird
231
Linux Enterprise Server
228
Oncommand Workflow Automation
217
Active Iq Unified Manager
216
Linux Enterprise Desktop
205
Oncommand Insight
201
Snapcenter
172
MariaDB
163
Seamonkey
161
Linux Enterprise Software Development Kit
160
Java
152
Jdk
147
Jre
143
Imagemagick
141
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-111497 | Remote code execution is possible in Node.js releases that bundle a vulnerable Brotli decoder: a malformed brotli-compressed stream can trigger an out-of-bounds write when decompressed, corrupting memory in the process handling the data. Exposure is limited to deployments that actually pass attacker-controlled brotli data into the decoder - for example services honouring Content-Encoding: br on untrusted requests or responses, or applications calling zlib.brotliDecompress/BrotliDecompress on untrusted input - and no authentication or user interaction is required in that scenario. The flaw is rated High with a CVSS 4.0 score of 9.2 (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H), no CISA KEV listing confirms active exploitation, and a public PoC reference exists but is not verified as working exploit code; the vendor fix is Node.js v26.12.1, released 2026-10-21. | CRITICAL | 9.2 | 0.5% | 116 |
KEV
PoC
|
| CVE-2026-77602 | Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in user, including one with only low-tier permissions, execute arbitrary Ruby and Python code on the COSMOS server and its per-target decom microservices. COSMOS reads configuration from a user-writable overlay (targets_modified/) before its read-only targets/ tree and then executes that content - rendering it as ERB, eval-ing GENERIC_READ/WRITE_CONVERSION blocks, or require-ing Script Runner procedure files - so an attacker who can write to the overlay via the screen-save or storage-upload endpoints achieves code execution as the openc3 user, which holds Redis and object-store credentials and sits on the internal service network. A working proof-of-concept is published in the vendor GitHub advisory, and the vendor has released 7.3.0 as the fix; no confirmed active exploitation (CISA KEV) has been reported. Reachability is limited on default single-host installs because the shipped docker-compose binds Traefik to 127.0.0.1:2900, so exploitation is realistic on multi-user deployments that expose the web port. | CRITICAL | 9.9 | 0.6% | 70 |
PoC
|
| CVE-2026-92957 | Sandbox escape in the vm2 Node.js library through 3.11.6 lets untrusted code running inside a NodeVM instance reach the host's child_process builtin and execute operating-system commands whenever the embedding application configures a wildcard builtin require policy containing a node:-prefixed deny entry. The affected configuration (for example new NodeVM({ require: { builtin: ['*', '-node:child_process'] } })) fails to deny the canonical child_process module, so sandboxed code can obtain execSync and spawn via require('child_process') or require('node:child_process'), giving host command-execution capability to code that was supposed to be isolated (CVSS 4.0 base 9.4; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation requires PR:L privileges in the sense that the attacker must already be able to run attacker-controlled JavaScript inside the sandbox, and it only works under that specific deny-list form; a correctly spelled '-child_process' entry, a non-wildcard allow-list, or not exposing child_process at all avoids the flaw. No public exploit code or confirmed active exploitation was identified at time of analysis. | CRITICAL | 9.4 | 0.5% | 67 |
PoC
|
| CVE-2026-54670 | Unauthenticated remote attackers can invoke sensitive financial and record-disclosure methods inside WeGIA's contribution dispatcher and, using a traversal-shaped controller name, force require_once to load PHP or configuration files from outside the intended controller directory. Because the pre-3.8.5 dispatcher in web/html/contribuicao/controller/control.php hardcoded an authentication exemption for ContribuicaoLogController and enforced no controller/method allowlist, methods such as getContribuicoesLogJSON, sincronizarStatus and registrarFaturas are reachable by anyone with HTTP access, leaking contribution and donation records or triggering financial workflow operations. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), this is a genuine high-priority issue; no public exploit identified at time of analysis, and it is fixed in version 3.8.5. | CRITICAL | 9.1 | 0.6% | 66 |
PoC
|
| CVE-2026-55245 | SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provider request to reach internal network services - including cloud instance-metadata endpoints - by supplying IPv6 transition-form addresses (6to4, NAT64) or CGNAT addresses that the `isPublicIP` deny-list in `core/providers/utils/fetch.go` incorrectly classifies as routable public IPs. All releases of the `github.com/maximhq/bifrost/core` Go module prior to v1.5.17 are affected, confirmed on dev HEAD f415c14 (core/version 1.5.15). Publicly available exploit code exists in the GHSA advisory as a runnable Go test; no CISA KEV listing at time of analysis. | HIGH | 8.7 | 0.4% | 64 |
PoC
|
| CVE-2026-52776 | URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud metadata services, loopback admin interfaces, and RFC 1918 internal networks by embedding IPv4-mapped IPv6 literals (e.g., [::ffff:169.254.169.254]) or the unspecified address 0.0.0.0 in OSCAL artifact import references processed by HTTPSFetcher or SFTPFetcher. Python's ipaddress module silently returns False - rather than raising TypeError - when comparing IPv6Address objects against IPv4Network ranges, so the validator's membership checks pass these forms through to requests.get unchanged. A publicly available proof-of-concept reproduces end-to-end IMDS credential exfiltration; no active exploitation is listed in CISA KEV and EPSS stands at 0.42%. | HIGH | 8.6 | 0.4% | 63 |
PoC
|
| CVE-2026-71309 | Path traversal in rclone's `serve restic` REST API allows any attacker with network access to the endpoint to read, create, overwrite, or delete objects outside the operator-configured backend directory. The flaw spans rclone v1.40 through v1.74.4 and affects WebDAV, FTP, SFTP, HTTP, and Memory backends - but not S3-compatible or local filesystem backends, which encode `..` as literal filename characters. A fully functional, step-by-step proof of concept has been publicly released; no CISA KEV listing exists at time of analysis. | HIGH | 8.6 | 0.3% | 63 |
PoC
|
| CVE-2026-54550 | Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources. | HIGH | 7.4 | 0.4% | 57 |
PoC
|
| CVE-2026-105482 | Improper input validation in Node.js DNS resolution functions lets hostname or address strings containing null bytes reach dns.resolve/dns.lookup, which the 26.12.1 security release fixes by adding explicit null-byte validation of resolve inputs. Node.js 22.x through 22.23.3, 24.x through 24.22.0, and 26.x through 26.12.0 are affected, with the vendor patch shipped in Node.js 26.12.1. The assessed vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H) means unauthenticated remote reach is possible but exploitation is conditional on the target application passing attacker-influenced strings into DNS resolution, and the exact trigger mechanism is not described in the available sources; a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV listing. | HIGH | 7.4 | 0.4% | 57 |
PoC
|
| CVE-2026-106069 | Node.js TLS certificate validation can accept a peer certificate that presents an IP address in a non-canonical representation instead of rejecting it, undermining identity checks for IP-addressed TLS peers; affected versions are 26.12.0, 24.22.0, and 22.23.3 and earlier on those branches. An attacker positioned to intercept the TLS path and able to supply a crafted certificate could exploit this to impersonate an IP-identified peer, with high confidentiality and integrity impact but no authentication or user interaction required. The vendor fixed the issue in the 2026-10-21 security release v26.12.1; a public PoC reference exists but is not verified as working exploit code, and no confirmed active exploitation is reported in the supplied intelligence. | HIGH | 7.4 | 0.2% | 57 |
PoC
|
| CVE-2026-105483 | Node.js TLS certificate validation in versions 26.12.0 and 24.22.0 can mishandle non-canonical IP address representations, potentially causing IP-based certificate identity checks to be evaluated incorrectly. A network-positioned attacker who can influence the certificate presented during TLS peer validation of an IP address may exploit this to affect confidentiality and integrity, though exploitation requires a man-in-the-middle or malicious-endpoint position and a suitably crafted certificate. No CISA KEV active-exploitation confirmation is provided, but a public PoC reference exists and is not verified as working exploit code. | HIGH | 7.4 | 0.2% | 57 |
PoC
|
| CVE-2026-106072 | Node.js TLS identity checking accepts non-canonical textual representations of IP addresses, so a peer certificate carrying an IP subjectAltName in a non-canonical form can pass the check it should fail (CWE-295). The flaw is grouped with CVE-2026-106069 under the Node.js 26.12.1 security release ('tls: reject non-canonical IP addresses') and is rated High by the project; EUVD lists Node 24.22.0 (≤24.22.0), 26.12.0 (≤26.12.0) and 22.23.3 (≤22.23.3) as affected baselines, and it is fixed by upgrading to 26.12.1 or the corresponding patched 24.x and 22.x releases. Exploitation is not opportunistic: the attacker must be able to intercept or interpose on a TLS connection and present a certificate whose non-canonical IP form is accepted - an on-path/MITM position rather than a plain remote request - and the independent reassessment scores this AV:N/AC:H/PR:N/UI:N with high confidentiality and integrity impact. There is no CISA KEV entry and no confirmed active exploitation; a public PoC reference exists (a gist linked from exploit-tracking sources) but it is not verified as working exploit code, and the priority label is 'this_month' rather than act-now. | MEDIUM | 6.7 | 0.3% | 54 |
PoC
|
| CVE-2026-105481 | Node.js releases at or below 22.23.3, 24.22.0 and 26.12.0 contain a flaw in the HTTP Agent's internal data guard, fixed in the v26.12.1 security release so that the guard functions even when no I/O is taking place. Exploitation is network reachable and needs no authentication or user interaction, but the assessed high attack complexity means an attacker must win a narrow timing window, and the resulting impact is bounded to low confidentiality and low integrity effects; the vendor classifies this item as 'Medium' within a release that otherwise bundles several High-severity fixes. A public PoC reference exists; it is not verified as working exploit code, no confirmed active exploitation has been reported, and the current priority places remediation in this month's cycle. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
|
| CVE-2026-63294 | Privilege escalation to host root in Canonical LXD occurs when the container manager unpacks crafted image or backup archives, because it follows a symbolic link where the backup.yaml metadata file should be and then processes attacker-controlled configuration outside its intended confinement. A low-privileged LXD user who can import a malicious archive can execute arbitrary commands as root on the underlying host, breaking the container/host trust boundary (scope change). Rated CVSS 9.9; no public exploit identified at time of analysis and not listed in CISA KEV, but the fix is coordinated through GitHub advisory GHSA-fv82-v4fj-mm4m. | CRITICAL | 9.9 | 1.0% | 51 |
|
| CVE-2026-66897 | Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an attacker with container edit permissions - or any user who launches a maliciously crafted image - overwrite arbitrary root-owned files on the host. The root cause is a validate-then-open mismatch: LXD checks template target paths against a confined os.Root handle but then creates the file via os.Create using the raw, unconfined string path. No public exploit has been identified at time of analysis, but the CVSS 9.9 rating and container-to-host scope change make this a critical container-escape. | CRITICAL | 9.9 | 0.6% | 50 |
|