33
CVEs
0
Critical
0
High
0
KEV
8
PoC
0
Unpatched C/H
81.8%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
19
LOW
14
Monthly CVE Trend
Affected Products (30)
Binutils
234
Glibc
108
Debian Linux
94
Ubuntu Linux
91
Libredwg
89
Opensuse
84
Fedora
77
Leap
60
Enterprise Linux
50
Gnutls
48
Enterprise Linux Workstation
35
Enterprise Linux Desktop
33
Grub2
33
Enterprise Linux Server
33
Backports Sle
25
Emacs
25
Ontap Select Deploy Administration Utility
22
Enterprise Linux Server Aus
22
Ncurses
19
Enterprise Linux Server Tus
18
Mailman
17
Pspp
16
Enterprise Linux Eus
13
Bash
13
Hci Management Node
13
Solidfire
13
Linux Enterprise Server
13
Libextractor
13
Openshift Container Platform
12
Wget
12
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-41992 | Out-of-bounds read in GNU gzip's LZH decompression logic allows an unprivileged local attacker to disclose memory contents by supplying two specially crafted archives - an LZW file followed by an LZH file - in a single gzip -d invocation. The shared global decompression array, never reinitialized between files in the same process invocation, is poisoned by the LZW pass and subsequently causes the LZH decoder to read past the end of the allocated buffer, yielding high confidentiality impact per the CVSS 4.0 vector (VC:H). No public exploit or CISA KEV listing has been identified at time of analysis; the fix exists as an upstream source commit only, with no confirmed packaged release. | MEDIUM | 6.9 | 0.1% | 35 |
|
| CVE-2026-77219 | Integer overflow in GNU Emacs PBM/PPM/PGM image loader (all versions before 31.0.91) enables heap memory disclosure when a user opens a crafted image file. Signed integer multiplication of image height, width, and channel count wraps to a negative value for sufficiently large inputs, bypassing the allocated-buffer bounds check and allowing the pixel reader to over-read heap contents, which are then rendered on-screen as color values. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the VulnCheck-reported CVSS 4.0 score of 6.9 reflects high confidentiality and availability impact under local conditions with user interaction. | MEDIUM | 6.9 | 0.1% | 35 |
|
| CVE-2026-56389 | Arbitrary program execution in GNU Bison (confirmed in 3.8.2) is triggered when a developer or automated pipeline runs `bison --html` on an attacker-controlled grammar file. The `%define tool.xsltproc` directive - intended to specify the XSLT processor binary for HTML report generation - is accepted without any restriction and passed directly to `execvp()`, allowing complete substitution of the transformation executable. No public exploit code or active exploitation has been identified at time of analysis, but the attack surface is relevant to developer workstations, build servers, and CI/CD pipelines that process untrusted grammar files. | MEDIUM | 6.8 | 0.2% | 34 |
|
| CVE-2026-90622 | Null pointer dereference in GNU libredwg 0.13.4's Layer table encoding function allows a local attacker to crash any application built on the library by supplying a DWG file whose LAYER entity has no material handle assigned. The root cause is commit 27118c40 ( | LOW | 1.9 | 0.2% | 30 |
PoC
|
| CVE-2026-91781 | A null pointer dereference in GNU Binutils 2.47 allows a local attacker to crash affected utilities by supplying a crafted ELF file. The flaw resides in elf_x86_64_common_section_index() in bfd/elf64-x86-64.c, part of the ELF section-handling path, and only denies availability of the tool process - there is no confidentiality or integrity impact. Publicly available proof-of-concept code exists and the issue is fixed in version 2.48, but real-world risk is low given the local attack vector, minimal impact, and low EPSS-relevant severity. | LOW | 1.9 | 0.1% | 30 |
PoC
|
| CVE-2026-91780 | A NULL pointer dereference in GNU Binutils 2.47 lets a locally-supplied, malformed ELF object crash BFD-based tools such as ld, objdump or readelf when they parse the crafted symbol tables. Only availability is affected — the process dies with a segmentation fault and there is no confidentiality or integrity impact. Publicly available exploit code exists (a PoC is published in a GitHub repository referenced from the Sourceware bug report), but there is no CISA KEV listing and no vendor patch at the time of analysis, since the project has reportedly not yet responded to the bug report. | LOW | 1.9 | 0.1% | 30 |
PoC
No patch
|
| CVE-2026-91779 | We need produce JSON per schema. Let's analyze. CVE-2026-91779: GNU Binutils 2.47, function _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c, null pointer dereference, local attack, CVSS 1.9 (CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L...). CWE-476. POC publicly available. Reported by VulDB. CPE gnu:binutils. Tags: Denial Of Service, Null Pointer Dereference, Binutils, Gnu. EUVD affected: Binutils 2.47. References include sourceware bugzilla 34446, exploit GitHub. Need fields. Product name: "GNU Binutils" (1-3 words). Summary: Original synthesis. Start with impact and product. "A local null pointer dereference in GNU Binutils 2.47's ELF exception-handling frame parser allows crafted object files to crash tools like objdump, ld, or readelf..." Mention local, POC public, CVSS low 1.9, DoS only. Avoid "A vulnerability..." start. Let's craft 2-3 sentences. Technical context: Explain binutils, BFD library, elf-eh-frame.c, EH frame handling; CWE-476 null pointer dereference; local attack requires processing malicious ELF file with crafted .eh_frame section. Mention CPE gnu:binutils. Risk assessment: CVSS 4.0 1.9 with AV:L, PR:L, VA:L only; EPSS not provided; KEV not listed; POC publicly available (per input "exploit has been released to public"). Note exploitability limited: local, requires user to run binutils tool on crafted file, low impact (DoS only). State EPSS missing. SSVC not provided. Affected products: GNU Binutils 2.47; CPE gnu:binutils:*; EUVD says 2.47; references sourceware bugzilla. Remediation: No patch identified; project informed but not responded. Compensating controls: avoid processing untrusted ELF files with binutils tools, sandbox, validate input, use alternative tools, monitor for crash. Mention advisory URLs. Since patch status says not available -> "No vendor-released patch identified at time of analysis." But input says project informed but has not responded. So state that. Exploit scenario: local attacker provides mal | LOW | 1.9 | 0.1% | 30 |
PoC
No patch
|
| CVE-2026-15182 | Heap-based buffer overflow in GNU LibreDWG up to version 0.13.4 allows local low-privileged attackers to corrupt heap memory via a specially crafted DWG file containing malicious BMP image data processed by the dwg_bmp function in src/dwg.c. A public proof-of-concept exploit (a crafted R13/R2000 .dwg file) has been disclosed on GitHub, raising the urgency for affected deployments that process untrusted DWG input. No confirmed active exploitation (CISA KEV) has been recorded, and a vendor-released patch in version 0.14 fully resolves the issue. | LOW | 1.9 | 0.1% | 30 |
PoC
|
| CVE-2026-15184 | Null pointer dereference in GNU LibreDWG up to 0.13.4 allows a local low-privileged attacker to crash any application that processes a maliciously crafted DWG file via the `dwg_next_entity` function in `src/dwg.c`, resulting in denial of service. A proof-of-concept exploit file is publicly available (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. The issue is fully resolved by upgrading to version 0.14, which includes a committed upstream patch. | LOW | 1.9 | 0.1% | 30 |
PoC
|
| CVE-2026-15520 | Heap-based buffer overflow in GNU LibreDWG 0.13.4-154-g0b573035 allows a local low-privileged attacker to corrupt heap memory by supplying a crafted DWG file processed through the R2004 section decompressor, yielding partial confidentiality, integrity, and availability impact. The vulnerability resides in `decompress_R2004_section` within `src/decode.c` and is exploitable whenever LibreDWG parses attacker-controlled R2004-format DWG content. A public proof-of-concept exploit file has been disclosed on GitHub; no CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis. | LOW | 1.9 | 0.1% | 30 |
PoC
|
| CVE-2026-71392 | Heap buffer overflow via integer wraparound in GNU Emacs for Android's TrueType font parser allows an attacker to corrupt heap memory and potentially achieve code execution by delivering a crafted font file through email, the built-in EWW browser, or documents using custom typefaces. The flaw is confined to 32-bit builds where an unguarded addition in sfnt_read_cmap_format_12() wraps around when computing an xmalloc allocation size, producing a fatally undersized heap buffer. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, CERT-PL reported the issue and an upstream patch commit is available. | MEDIUM | 5.3 | 0.4% | 27 |
|
| CVE-2026-71393 | Heap buffer overflow in GNU Emacs for Android's TrueType font parser (sfnt_read_name_table() in src/sfnt.c) enables potential code execution when a 32-bit Emacs process loads a crafted font file. The root cause is a CWE-190 integer overflow that wraps a 32-bit allocation size calculation, producing an undersized heap buffer that a subsequent read() call overflows. Delivery is possible through multiple standard Emacs workflows - email rendering, EWW web browsing, or documents with custom font faces - requiring only passive user interaction, with no authentication required from the attacker. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though a patch commit is confirmed upstream. | MEDIUM | 5.3 | 0.4% | 27 |
|
| CVE-2026-71391 | GNU Emacs for Android leaks heap memory contents through a crafted TrueType variable font, enabling ASLR bypass as a stepping stone to further exploitation. The flaw resides in the gvar table parser (src/sfnt.c), where an off-by-one error in shared-coordinate index boundary checks allows a font file to trigger an out-of-bounds heap read via memcpy. Attack delivery is broad: malicious fonts can reach victims through email rendered in Emacs, EWW (Emacs Web Wowser) browsing, or documents applying custom faces - all requiring user interaction but no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix commit is available but no formally released patched version has been independently confirmed. | MEDIUM | 5.3 | 0.3% | 27 |
No patch
|
| CVE-2026-71394 | Uninitialized heap memory exposure in GNU Emacs for Android's sfnt font parser allows a remote, unauthenticated attacker to trigger information disclosure, process crashes, or arbitrary memory access on 32-bit targets by delivering a crafted font file. The flaw in sfnt_read_table_directory() (src/sfnt.c) stems from an incorrect comparison variable in the read-length check, causing the parser to trust an attacker-controlled table-entry count without proper bounds validation. No public exploit or CISA KEV listing exists at time of analysis; exploitation requires user interaction with attacker-delivered content such as an email, EWW-rendered webpage, or a document referencing a malicious font face. | MEDIUM | 5.3 | 0.3% | 27 |
No patch
|
| CVE-2026-56968 | Memory disclosure in GNU SASL's NTLM client implementation allows a malicious or man-in-the-middle server to extract portions of client process memory by delivering a crafted undersized challenge to the `_gsasl_ntlm_client_step` function. All GNU SASL versions before 2.2.4 are affected, with the fix confirmed in the 2.2.4 release and a Debian security advisory issued downstream. No active exploitation has been identified; the high attack complexity required to position a malicious NTLM server tempers the already-low CVSS 3.7 rating. | MEDIUM | 5.3 | 0.2% | 27 |
|