11
CVEs
3
Critical
4
High
0
KEV
3
PoC
2
Unpatched C/H
72.7%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
4
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Debian Linux
7846
Fedora
2105
Ubuntu Linux
1875
Linux Kernel
1387
Opensuse
1366
Leap
1013
Chrome
1001
Enterprise Linux Server
970
Enterprise Linux Desktop
941
Enterprise Linux Workstation
937
Ubuntu
793
Enterprise Linux Server Aus
531
Enterprise Linux Server Tus
461
Enterprise Linux
385
Enterprise Linux Eus
342
Enterprise Linux Server Eus
325
Active Iq Unified Manager
298
Java
282
PHP
244
Firefox
243
Thunderbird
228
Jdk
221
Backports Sle
217
Jre
216
Oncommand Insight
211
MySQL
190
Wireshark
190
MariaDB
186
Qemu
172
Oncommand Workflow Automation
170
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-85649 | Fail-open password validation in Chew, Kean Ho's Actualizer v1.2.0 installer allows a build host with an incompatible mkpasswd implementation to produce Debian images with empty root and alpha account password fields. The installer script Shell/debian-minbase-install.sh invokes mkpasswd to generate yescrypt hashes but never validates whether the output is a valid yescrypt hash or even non-empty, proceeding unconditionally when mkpasswd silently fails. Deployed images built under this condition may permit passwordless authentication to the root and alpha accounts, depending on the PAM configuration of the target system. No public exploit is required; the flaw is self-triggering under a specific but plausible build-host misconfiguration. Vendor-released patch is available in v1.2.1. | HIGH | 7.9 | 0.2% | 60 |
PoC
No patch
|
| CVE-2026-55149 | Remote denial-of-service in vouch-proxy v0.47.2 and earlier crashes the server process with a single unauthenticated HTTP request. The /validate endpoint's multipart cookie reassembly routine in pkg/cookie/cookie.go parses the total part count directly from the attacker-controlled Cookie header name - an N value of 10 billion passed as VouchCookie_1of10000000000 triggers a make([]string, N) call requesting approximately 160 GB of heap, immediately raising a Go runtime fatal out-of-memory error. No authentication, session token, or prior interaction is required; a fully working PoC with Docker reproduction artifacts is publicly disclosed in the GitHub Security Advisory, though no CISA KEV listing is confirmed at time of analysis. | HIGH | 7.5 | 0.4% | 58 |
PoC
|
| CVE-2026-89482 | Kernel memory corruption in the Linux NVMe/TCP host driver (nvme-tcp) allows a malicious or compromised NVMe-over-TCP target to trigger a wild-memory-access write on the connecting host. The receive path gated C2HData PDUs on blk_rq_payload_bytes() alone; for a REQ_OP_WRITE_ZEROES command (no physical segments but non-zero byte count) the request iterator is never initialized, so an attacker-supplied C2HData is copied into whatever stale, driver-private iterator the previous command on that tag left behind. Fixed across stable trees; no public exploit identified at time of analysis and EPSS is low (0.20%). | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-80981 | A use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows the server-side link-addition path (smc_llc_srv_add_link() in net/smc/smc_llc.c) to read a freed LLC queue entry. smc_llc_flow_qentry_del() kfree()s the qentry, but on links without a shared v2 receive buffer the already-freed add_llc pointer is subsequently passed to smc_llc_save_add_link_rkeys(), producing a slab-use-after-free. Affects kernels since 6.14 through the fix in 6.18.50 / 7.2.4 / 7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.20%), and the KASAN report shows it manifests as a kernel crash rather than a demonstrated code-execution primitive. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-80986 | Out-of-bounds read in the Linux kernel's SMC-Rv2 (Shared Memory Communications over RDMA v2) LLC handling occurs in smc_llc_save_add_link_rkeys(), where the peer rkey count is read from offset 94 of a 72-byte 'ADD LINK' message allocation whenever the RDMA device reports max_recv_sge == 1 and no shared v2 receive buffer exists. Any peer that initiates an SMC-Rv2 link addition triggers the over-read on every link addition, regardless of message contents, as demonstrated by a reproducible KASAN slab-out-of-bounds report. The flaw is fixed in stable kernels; no public exploit code or active exploitation has been identified, and EPSS is low at 0.20%. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-73974 | Arbitrary root file read in Linuxfabrik monitoring plugins allows a local attacker controlling the nagios or icinga account to exfiltrate any root-readable file by exploiting the hidden but permanently live --test argument accepted by all sudoers-whitelisted check plugins. Invoking the deb-updates plugin via sudo with --test=/etc/shadow,,0 causes lftest.py to read the supplied path as root with no path confinement and echo its full contents to stdout; approximately 22 additional whitelisted plugins yield filtered leaks or file-existence oracles through the same mechanism. No active exploitation has been confirmed by CISA KEV, but a fully functional proof-of-concept command is publicly disclosed in the vendor's own GitHub security advisory GHSA-rh9c-rqvg-f7pr, and patches are available in linuxfabrik-lib v6.1.0 and monitoring-plugins v7.0.0. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
|
| CVE-2026-89754 | Stale walk->action state in the Linux kernel mm/pagewalk subsystem causes walk_pud_range() to spuriously retry PUD traversal and invoke page-walk callbacks twice, resulting in a slab-out-of-bounds write reachable by unprivileged local users via the mincore(2) syscall. Affected kernels in the 6.18.21-6.18.49 and 7.0-7.2.3 ranges contain the latent logic error activated by commit 3b89863c3fa4; the bug was confirmed by KASAN output and a local fuzzer producing an OOB write into a sigqueue slab object. No public exploit is available and no active exploitation has been identified; vendor-released patches are available in 6.18.50, 7.2.4, and 7.3-rc1. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-89483 | Uninitialized kernel memory disclosure in the Linux kernel NVMe subsystem affects all kernels from commit 530436c45ef2 through fixed releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. When a discard (TRIM/DSM) operation is issued and the GFP_ATOMIC allocation for the 4096-byte DSM payload fails under memory pressure, the kernel falls back to the per-controller ctrl->discard_page, which was allocated with alloc_page(GFP_KERNEL) in nvme_init_ctrl() but never zeroed - causing up to 4080 bytes of stale kernel data (vmemmap struct page pointers and other heap residue) to be transmitted to the NVMe controller. No public exploit exists and EPSS is 0.20%; the input CVSS vector AV:N/AC:L/PR:N significantly overstates exploitability for what requires local privileged access under specific memory pressure conditions. | HIGH | 7.5 | 0.2% | 38 |
|
| CVE-2026-89169 | live-boot at commit ff8867c silently skips dm-verity root hash signature verification when the .verity file is absent from the live medium, allowing a physically present attacker to boot a tampered or unsigned root filesystem image that bypasses integrity enforcement. The flaw undermines the dm-verity-enforce-roothash-signature kernel protection intended to guarantee boot-time filesystem authenticity on Debian live systems. No public exploit code has been identified at time of analysis; the CVSS 4.0 physical-access vector (AV:P) and attack-requirement condition (AT:P) significantly constrain real-world exploitability. | MEDIUM | 4.1 | 0.1% | 21 |
No patch
|
| CVE-2026-80863 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_atomic_resources() free_rd_atomic_resources() itera | – | 0.2% | 0 |
|
|
| CVE-2026-80817 | In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing | – | 0.2% | – |
|