97
CVEs
2
Critical
33
High
0
KEV
1
PoC
21
Unpatched C/H
34.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
33
MEDIUM
43
LOW
2
Monthly CVE Trend
Affected Products (30)
Linux Kernel
98
N A
81
Debian Linux
63
Mac Os X
56
Active Management Technology Firmware
51
Fedora
44
Windows
43
Xen
39
Graphics Driver
37
Converged Security Management Engine Firmware
30
Core I7 8665U Firmware
27
Server Board S2600St Firmware
26
Core I7 8500Y Firmware
26
Quartus Prime
25
Core I7 8565U Firmware
25
Core I7 8650U Firmware
25
Server Board S2600Wf Firmware
25
Core I7 8700 Firmware
25
Core I7 8700K Firmware
25
Core I7 8700T Firmware
25
Core I7 8706G Firmware
24
Core I9 9900K Firmware
24
Server Board S2600Kp Firmware
24
Server Board S2600Bp Firmware
24
Proset Wireless Wifi
24
Core I9 9880H Firmware
24
Core I7 8850H Firmware
24
Server System R1000Wf Firmware
23
Server System R2000Wf Firmware
23
Core I7 8709G Firmware
23
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-53503 | Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible. | HIGH | 7.5 | 0.4% | 58 |
PoC
|
| CVE-2026-54333 | Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-54334 | Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-20702 | Protection mechanism failure in Intel Data Center Attestation Primitives (Intel DCAP) enables unauthenticated network-based attackers with specialized internal knowledge to undermine the integrity of the attestation system and expose confidential data from downstream systems relying on SGX enclave verification. The vulnerability (CWE-693) is particularly impactful in confidential computing environments where DCAP serves as the trust anchor for SGX workload isolation. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01449 addressing this issue. | HIGH | 8.9 | 0.3% | 45 |
No patch
|
| CVE-2026-68128 | Out-of-bounds bitmap write in the Linux kernel's Intel ICE SR-IOV driver allows a malicious Virtual Function guest to crash the host kernel or potentially escalate privileges to the host. The vulnerable function ice_parser_profile_init unconditionally passes caller-controlled ptype values from VIRTCHNL_OP_ADD_RSS_CFG into set_bit() against a statically sized 1024-bit bitmap, permitting a value such as 0xffff to write beyond the bitmap boundary and trigger a kernel NULL pointer dereference. No public exploit code has been identified and EPSS exploitation probability is low at 0.18%, but the CVSS 8.8 score and confirmed crash reproducibility signal real urgency for SR-IOV multi-tenant environments where stable-branch patches are already available. | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-8798 | Unbounded retry loops in BC-FJA's JNI native entropy layer cause calling threads to hang indefinitely when Intel RDSEED or RDRAND instructions persistently fail, producing a non-interruptible thread-level denial of service in any Java FIPS application backed by bc-fips 2.1.x before 2.1.3. The affected JNI seeding routine re-issues the CPU entropy instruction without any iteration limit whenever the carry flag signals failure - a condition reproducible by hardware entropy source faults, DRBG exhaustion under heavy multi-core contention, or hypervisors that do not forward these Intel instructions to guest VMs. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the conditions are routinely present in virtualized environments where hypervisors commonly withhold RDRAND/RDSEED forwarding, making this a realistic operational risk for enterprise Java FIPS deployments in cloud or VM-based infrastructure. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-18952 | Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users with low privileges as a vector for internal network reconnaissance and credential theft. The flaw resides in the threat intelligence feed parser, which fails to validate URL parameters submitted to the threat intel source configuration endpoint, allowing a crafted request to redirect server-side HTTP fetches to internal resources - including cloud metadata endpoints. Patch is confirmed available per Amazon's security bulletin AWS-2026-079; no public exploit code has been identified at time of analysis. | HIGH | 8.6 | 0.3% | 43 |
|
| CVE-2026-20898 | Privilege escalation in the Alias Checking Trusted Module (ACTM) firmware for certain Intel Xeon processors allows a local privileged attacker to escalate to System Management Mode (SMM) execution, achieving high confidentiality and integrity impact across both the directly compromised system and subsequent systems such as co-hosted hypervisors or tenant workloads. The attack requires high-complexity local technique combined with pre-existing privileged user access, placing it firmly in the advanced persistent threat actor category. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01439 to address this firmware flaw. | HIGH | 8.5 | 0.1% | 43 |
No patch
|
| CVE-2026-20789 | Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows exposes local systems to code execution by unprivileged attackers via a Ring 2 (device driver layer) improper access control flaw. Any local process with no privileges required and no user interaction can leverage the driver's failure to enforce access boundaries to achieve local code execution, with follow-on high confidentiality impact on the broader system - consistent with a kernel-level scope change. No public exploit identified at time of analysis, and no CISA KEV listing; however, the low complexity and zero-privilege requirement make this a credible post-compromise escalation vector for threat actors with any form of local code execution already established. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-24911 | Kernel-mode stack overflow in Intel PROSet/Wireless WiFi Software for Windows allows adjacent unauthenticated attackers to crash affected systems, resulting in a full system denial of service. The flaw resides in Ring 0 (kernel privilege level) WiFi driver code, meaning a successful exploit triggers a kernel panic or Blue Screen of Death rather than a user-space crash. No public exploit or CISA KEV listing has been identified at time of analysis, and no exact patched version is confirmed in the available reference data - the Intel advisory INTEL-SA-01468 should be consulted directly. | HIGH | 8.3 | 0.2% | 42 |
No patch
|
| CVE-2026-20727 | Intel PROSet/Wireless WiFi Software for Windows contains a null pointer dereference in Ring 0 (kernel space) that an adjacent, unauthenticated attacker can exploit to crash the target system, resulting in a denial of service. The flaw resides in the WiFi kernel driver, meaning a successful trigger causes a kernel panic (BSOD on Windows) with high availability impact on both the vulnerable component and the broader system. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the adjacent-network attack vector and zero-privilege requirement make this relevant for any environment where untrusted parties share a wireless segment with Intel WiFi-equipped Windows endpoints. | HIGH | 8.3 | 0.2% | 42 |
No patch
|
| CVE-2026-20776 | Denial of service in Intel PROSet/Wireless WiFi Software affects the Ring 2 device driver layer, where an improper conditions check (CWE-754) can be triggered by an adjacent, unauthenticated attacker with no user interaction required. The vulnerability collapses wireless availability on the affected host and, per the CVSS 4.0 vector, cascades to subsequent system availability as well, meaning dependent network-connected services may also be disrupted. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 8.3 | 0.2% | 42 |
No patch
|
| CVE-2026-22887 | Kernel-mode denial of service in Intel PROSet/Wireless WiFi Software for Windows allows an adjacent unauthenticated attacker to crash the target system by triggering an improper buffer restriction in the Ring 0 (kernel-level) WiFi driver component. The vulnerability carries a CVSS 4.0 score of 8.3, requires no authentication or user interaction, and is confined to adjacent-network attackers. Intel has acknowledged the issue via security advisory INTEL-SA-01468; no public exploit code exists and no CISA KEV listing has been identified at time of analysis. | HIGH | 8.3 | 0.2% | 42 |
No patch
|
| CVE-2026-20741 | Improper access control in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows a local unprivileged process to cause a denial of service affecting both the wireless subsystem and, to a lesser extent, downstream system integrity. Affected systems running Intel wireless drivers are exposed to any unprivileged local code - no authentication, no elevated privileges, and no user interaction are required. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog. | HIGH | 8.3 | 0.1% | 42 |
No patch
|
| CVE-2026-20715 | Denial of service via improper input validation in Intel Active Management Technology (AMT) and Intel Standard Manageability firmware allows unauthenticated network-adjacent attackers to disrupt the out-of-band management interface. The CVSS 4.0 AT:P designation confirms that specific prerequisites - namely AMT being provisioned and network-accessible - must independently exist before exploitation is possible. No public exploit has been identified at time of analysis, and Intel has disclosed the issue under advisory INTEL-SA-01427. | HIGH | 8.2 | 0.3% | 41 |
No patch
|