159
CVEs
25
Critical
89
High
1
KEV
8
PoC
92
Unpatched C/H
17.0%
Patch Rate
3.4%
Avg EPSS
Severity Breakdown
CRITICAL
25
HIGH
89
MEDIUM
45
LOW
0
Monthly CVE Trend
Affected Products (30)
Integrated Lights Out 5 Firmware
17
Cloudline Cl4100 Gen10 Server Firmware
16
Cloudline Cl5800 Gen9 Server Firmware
16
Cloudline Cl5800 Gen10 Server Firmware
16
Cloudline Cl3100 Gen10 Server Firmware
16
Cloudline Cl5200 Gen9 Server Firmware
16
Baseboard Management Controller
14
Arubaos Cx
13
Insight Remote Support
9
Storeonce System
8
Nimbleos
6
Ntp
6
Hpux Ntp
6
Autopass License Server
5
Oneview Global Dashboard
4
Aruba Networking Private 5g Core
4
Smart Update Manager
4
Superdome Flex Server Firmware
3
Sf300 Firmware
3
Utility Computing Service Meter
3
Hf40C Firmware
3
Hf40 Firmware
3
Hf20 Firmware
3
Ubuntu Linux
3
Hf20H Firmware
3
Hf20C Firmware
3
Sf100 Firmware
3
Hf60 Firmware
3
Arubaos Switch
3
Oneview
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2017-5689 | An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available. | CRITICAL | 9.8 | 94.2% | 213 |
KEV
PoC
|
| CVE-2016-7434 | The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 62.4%. | HIGH | 7.5 | 62.4% | 120 |
PoC
No patch
|
| CVE-2020-7136 | A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 79.5% | 69 |
PoC
No patch
|
| CVE-2022-37932 | A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 2.6% | 69 |
PoC
No patch
|
| CVE-2024-53676 | A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 51.3% | 69 |
PoC
No patch
|
| CVE-2025-37097 | A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service | HIGH | 7.5 | 0.2% | 58 |
PoC
No patch
|
| CVE-2019-8936 | NTP through 4.2.8p12 has a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | HIGH | 7.5 | 5.7% | 58 |
PoC
|
| CVE-2017-6458 | Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 10.6%. | HIGH | 8.8 | 10.6% | 55 |
|
| CVE-2026-23600 | Remote authentication bypass in HPE AutoPass License Server (APLS) allows unauthenticated network attackers to circumvent access controls and gain full administrative control over the licensing service, per HPE advisory hpesbgn05003en_us. The flaw (CWE-287, improper authentication) carries a maximum CVSS 4.0 base score of 10.0 with high confidentiality, integrity, and availability impact extending to subsequent systems. No public exploit identified at time of analysis, and the EPSS probability is currently low (0.24%). | CRITICAL | 10.0 | 0.2% | 50 |
No patch
|
| CVE-2025-37089 | Command Injection Rce in HPE StoreOnce backup storage software. One of 6 critical CVEs. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2025-37092 | Command Injection Rce (2Nd) in HPE StoreOnce backup storage software. One of 6 critical CVEs. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2025-37096 | Command Injection Rce (3Rd) in HPE StoreOnce backup storage software. One of 6 critical CVEs. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2025-37099 | A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2025-37095 | Directory Traversal in HPE StoreOnce backup storage software. One of 6 critical CVEs. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2016-7426 | NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 11.7% and no vendor patch available. | HIGH | 7.5 | 11.7% | 49 |
No patch
|