41
CVEs
9
Critical
16
High
0
KEV
9
PoC
3
Unpatched C/H
87.8%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
9
HIGH
16
MEDIUM
12
LOW
0
Monthly CVE Trend
Affected Products (30)
Debian Linux
7846
Fedora
2105
Ubuntu Linux
1875
Linux Kernel
1387
Opensuse
1366
Leap
1013
Chrome
1001
Enterprise Linux Server
970
Enterprise Linux Desktop
941
Enterprise Linux Workstation
937
Ubuntu
793
Enterprise Linux Server Aus
531
Enterprise Linux Server Tus
461
Enterprise Linux
385
Enterprise Linux Eus
342
Enterprise Linux Server Eus
325
Active Iq Unified Manager
298
Java
282
PHP
244
Firefox
243
Thunderbird
228
Jdk
221
Backports Sle
217
Jre
216
Oncommand Insight
211
MySQL
190
Wireshark
190
MariaDB
186
Qemu
172
Oncommand Workflow Automation
170
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-48751 | Privilege escalation and project-restriction bypass in Incus before 7.2.0 lets a low-privileged user with access to an unrestricted project craft an instance whose snapshot carries malicious low-level hooks (raw.lxc/raw.qemu), then move and restore it into a project protected by restricted.containers.lowlevel=block, executing arbitrary commands on the host as root. The snapshot-restore path fails to re-enforce the lowlevel restriction, so the security control is silently bypassed. Publicly available exploit code exists (full PoC published in the vendor GHSA advisory); there is no public evidence of active exploitation. | CRITICAL | 9.9 | 0.7% | 70 |
PoC
|
| CVE-2026-45623 | Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# sourceMappingURL=PATH */` comment that the PreviousMap parser dereferences directly against the local filesystem with no scheme, allowlist, or traversal check. Because the read fires under default options (no `from`, `map`, or plugins), any pipeline that processes untrusted CSS is reachable; when the resulting `JSON.parse` SyntaxError is surfaced to the caller it leaks roughly the first 10 bytes of the targeted file, and the same code path yields a file-existence oracle and a DoS primitive. Publicly available exploit code exists (POC), but there is no public evidence of active exploitation, and EPSS is low at 0.50% (40th percentile). | CRITICAL | 9.1 | 0.5% | 66 |
PoC
|
| CVE-2026-50289 | OS command injection in the systeminformation Node.js library (npm, versions <= 5.31.6) lets an attacker who can influence a `source`d path in Debian/Ubuntu `interfaces(5)` files run arbitrary shell commands with the privileges of any process that calls `networkInterfaces()`. The unsanitized path token parsed from `/etc/network/interfaces` (and files it recursively sources) is interpolated into a `cat ... | grep` shell string executed via `execSync()`, so metacharacters in the path break out and execute commands. Publicly available exploit code exists (working PoC in the advisory); no public exploit is identified as being used in active exploitation. Fixed in 5.31.7. | HIGH | 8.7 | 2.1% | 66 |
PoC
|
| CVE-2026-85649 | Fail-open password validation in Chew, Kean Ho's Actualizer v1.2.0 installer allows a build host with an incompatible mkpasswd implementation to produce Debian images with empty root and alpha account password fields. The installer script Shell/debian-minbase-install.sh invokes mkpasswd to generate yescrypt hashes but never validates whether the output is a valid yescrypt hash or even non-empty, proceeding unconditionally when mkpasswd silently fails. Deployed images built under this condition may permit passwordless authentication to the root and alpha accounts, depending on the PAM configuration of the target system. No public exploit is required; the flaw is self-triggering under a specific but plausible build-host misconfiguration. Vendor-released patch is available in v1.2.1. | HIGH | 7.9 | 0.2% | 60 |
PoC
No patch
|
| CVE-2026-55229 | Server-side request forgery in Gotenberg v8.33.0 and earlier allows remote unauthenticated attackers to coerce the server into making arbitrary outbound HTTP(S) requests and to disclose local image files by uploading a crafted DOCX to the /forms/libreoffice/convert endpoint. The flaw stems from LibreOffice automatically resolving external and local resources referenced in <img> tags during conversion, exposing internal networks and on-disk image files. Publicly available exploit code exists via the vendor's GHSA-2mrg-35hw-x3x9 advisory, though no CISA KEV listing or EPSS data is available at time of analysis. | HIGH | 7.5 | 0.4% | 58 |
PoC
|
| CVE-2026-56755 | Denial of service in Gitea's Debian package registry (all versions before 1.27.0) lets any authenticated user with package write access crash the server with a single .deb upload. The parser's ParseControlFile decompresses control.tar.gz with no size limit and tees the entire stream into a strings.Builder, so an 83 MB payload expands to 16+ GB and exhausts memory; a companion O(N²) string concatenation on Description continuation lines can independently saturate a CPU core. A complete working proof-of-concept is published in the advisory, so publicly available exploit code exists, though there is no public exploit identified as used in active attacks and the issue is not in CISA KEV. | MEDIUM | 6.2 | 0.1% | 51 |
PoC
|
| CVE-2026-44359 | Poisoned-pipeline (pwn request) code execution in the Meshtastic firmware repository's GitHub Actions CI allows any external user to run arbitrary code inside the project's trusted CI context prior to firmware 2.7.21.1370b23. Because main_matrix.yml (and related workflows) triggered on pull_request_target while the check, build, and build-debian-src jobs checked out and executed code from the attacker's fork with no approval gate, a pull request from an author_association of NONE automatically ran attacker-controlled files with access to repository secrets and an elevated GITHUB_TOKEN. This is CWE-94 code injection scoring CVSS 10.0; no public exploit identified at time of analysis, though a linked Google Drive writeup may contain proof-of-concept detail. | CRITICAL | 10.0 | 1.0% | 51 |
No patch
|
| CVE-2026-89482 | Kernel memory corruption in the Linux NVMe/TCP host driver (nvme-tcp) allows a malicious or compromised NVMe-over-TCP target to trigger a wild-memory-access write on the connecting host. The receive path gated C2HData PDUs on blk_rq_payload_bytes() alone; for a REQ_OP_WRITE_ZEROES command (no physical segments but non-zero byte count) the request iterator is never initialized, so an attacker-supplied C2HData is copied into whatever stale, driver-private iterator the previous command on that tag left behind. Fixed across stable trees; no public exploit identified at time of analysis and EPSS is low (0.20%). | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-80981 | A use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows the server-side link-addition path (smc_llc_srv_add_link() in net/smc/smc_llc.c) to read a freed LLC queue entry. smc_llc_flow_qentry_del() kfree()s the qentry, but on links without a shared v2 receive buffer the already-freed add_llc pointer is subsequently passed to smc_llc_save_add_link_rkeys(), producing a slab-use-after-free. Affects kernels since 6.14 through the fix in 6.18.50 / 7.2.4 / 7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.20%), and the KASAN report shows it manifests as a kernel crash rather than a demonstrated code-execution primitive. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-80986 | Out-of-bounds read in the Linux kernel's SMC-Rv2 (Shared Memory Communications over RDMA v2) LLC handling occurs in smc_llc_save_add_link_rkeys(), where the peer rkey count is read from offset 94 of a 72-byte 'ADD LINK' message allocation whenever the RDMA device reports max_recv_sge == 1 and no shared v2 receive buffer exists. Any peer that initiates an SMC-Rv2 link addition triggers the over-read on every link addition, regardless of message contents, as demonstrated by a reproducible KASAN slab-out-of-bounds report. The flaw is fixed in stable kernels; no public exploit code or active exploitation has been identified, and EPSS is low at 0.20%. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-47846 | Authentication bypass in Bitnami Cassandra container images (4.0.x, 4.1.x, 5.0.x lines) allows remote attackers to access the database as superuser using the built-in cassandra:cassandra credentials, even when operators configure a custom administrator via CASSANDRA_USER. The container init script provisions the new superuser but, in certain scenarios, fails to drop the default account, leaving an unintended privileged login path. No public exploit identified at time of analysis, but the trivially guessable default credentials make discovery and abuse straightforward once the CQL port is reachable. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-73974 | Arbitrary root file read in Linuxfabrik monitoring plugins allows a local attacker controlling the nagios or icinga account to exfiltrate any root-readable file by exploiting the hidden but permanently live --test argument accepted by all sudoers-whitelisted check plugins. Invoking the deb-updates plugin via sudo with --test=/etc/shadow,,0 causes lftest.py to read the supplied path as root with no path confinement and echo its full contents to stdout; approximately 22 additional whitelisted plugins yield filtered leaks or file-existence oracles through the same mechanism. No active exploitation has been confirmed by CISA KEV, but a fully functional proof-of-concept command is publicly disclosed in the vendor's own GitHub security advisory GHSA-rh9c-rqvg-f7pr, and patches are available in linuxfabrik-lib v6.1.0 and monitoring-plugins v7.0.0. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
|
| CVE-2026-12565 | Path traversal in BBOT's unarchive internal module enables a malicious archive hosted by attacker-controlled infrastructure to write files outside the intended extraction directory when BBOT runs on systems with GNU tar < 1.34. This vulnerability is a residual gap from CVE-2025-10284, which resolved git-specific RCE vectors but left the underlying archive extraction path validation entirely unimplemented, relying instead on inconsistent external tool behavior across platforms. No public exploit has been identified at time of analysis; the CVSS vector (AC:H/UI:R) constrains real-world risk to BBOT operators actively scanning attacker-controlled targets on affected OS distributions, but the high integrity impact (I:H) and zero privilege requirement (PR:N) are significant for red-team and CI/CD BBOT deployments running on legacy base images. | MEDIUM | 5.3 | 0.2% | 47 |
PoC
|
| CVE-2026-74517 | Local privilege-escalation/denial-of-service via a use-after-free in the Linux kernel's KVM x86 I/O APIC emulation (CVE-2026-74517): during VM teardown the delayed I/O APIC EOI work (kvm_ioapic_eoi_inject_work) can execute after the target vCPUs are freed, causing __kvm_irq_delivery_to_apic_fast to read freed slab memory. Any local principal able to create and run a KVM guest can race VM destruction against a pending delayed EOI to corrupt host kernel memory. EPSS is low (0.15%, 5th percentile) and the issue is not on CISA KEV; no public exploit is identified, and the reporter/tags frame the practical impact as denial of service. | CRITICAL | 9.3 | 0.2% | 47 |
|
| CVE-2026-64434 | Use-after-free in the Linux kernel's Bluetooth L2CAP subsystem can be triggered by an adjacent attacker, potentially leading to arbitrary code execution or kernel memory corruption. The flaw occurs when a channel timeout callback races with connection teardown, allowing a freed connection object to be accessed. Patched kernels are available; no active exploitation is confirmed, but the vulnerability is remotely exploitable within Bluetooth range without authentication or user interaction. | HIGH | 8.8 | 0.2% | 44 |
|