141
CVEs
4
Critical
50
High
0
KEV
1
PoC
30
Unpatched C/H
38.3%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
50
MEDIUM
68
LOW
2
Monthly CVE Trend
Affected Products (30)
Linux Kernel
98
N A
81
Debian Linux
63
Mac Os X
56
Active Management Technology Firmware
51
Fedora
44
Windows
43
Xen
39
Graphics Driver
37
Converged Security Management Engine Firmware
30
Core I7 8665U Firmware
27
Server Board S2600St Firmware
26
Core I7 8500Y Firmware
26
Quartus Prime
25
Core I7 8565U Firmware
25
Core I7 8650U Firmware
25
Core I7 8700K Firmware
25
Core I7 8700 Firmware
25
Core I7 8700T Firmware
25
Server Board S2600Wf Firmware
25
Core I7 8706G Firmware
24
Core I9 9900K Firmware
24
Server Board S2600Kp Firmware
24
Server Board S2600Bp Firmware
24
Core I9 9880H Firmware
24
Proset Wireless Wifi
24
Core I7 8850H Firmware
24
Server System R1000Wf Firmware
23
Server System R2000Wf Firmware
23
Core I7 8709G Firmware
23
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-53503 | Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible. | HIGH | 7.5 | 0.4% | 58 |
PoC
|
| CVE-2026-45898 | Kernel memory corruption in the Linux iWARP Connection Manager (RDMA/iwcm) subsystem can crash systems running RDMA workloads on iWARP-capable hardware such as Intel E830 adapters. The bug, introduced by commit e1168f0 ('RDMA/iwcm: Simplify cm_event_handler()'), causes workqueue list corruption when iwcm_work items from a free list are reused while still queued, triggering a kernel BUG and panic. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 5th percentile), despite a CVSS base score of 9.8. | CRITICAL | 9.8 | 0.0% | 49 |
|
| CVE-2026-54333 | Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening. | CRITICAL | 9.8 | – | 49 |
|
| CVE-2026-54334 | Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk. | CRITICAL | 9.8 | – | 49 |
|
| CVE-2026-20794 | Local privilege escalation in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileged local user trigger a Ring 1 device-driver buffer overflow to execute arbitrary code and take total control of the host. The flaw carries a CVSS 4.0 base score of 9.3 with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis, and the EPSS score is negligible at 0.01% (3rd percentile), consistent with the SSVC verdict of no known exploitation. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2026-20702 | Protection mechanism failure in Intel Data Center Attestation Primitives (Intel DCAP) enables unauthenticated network-based attackers with specialized internal knowledge to undermine the integrity of the attestation system and expose confidential data from downstream systems relying on SGX enclave verification. The vulnerability (CWE-693) is particularly impactful in confidential computing environments where DCAP serves as the trust anchor for SGX workload isolation. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01449 addressing this issue. | HIGH | 8.9 | 0.3% | 45 |
No patch
|
| CVE-2026-20887 | Improper access control in all versions of Intel Vision software allows a remote, unauthenticated attacker to trigger denial of service and, under low-complexity conditions, achieve remote code execution against the Ring 3 user-application layer. The CVSS 4.0 base score of 8.8 reflects high confidentiality impact with lesser integrity and availability effects; there is no public exploit identified at time of analysis, and EPSS is low at 0.20% (42nd percentile). Intel published advisory SA-01457 and CISA's SSVC framework rates exploitation as none but technical impact as total. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-68128 | Out-of-bounds bitmap write in the Linux kernel's Intel ICE SR-IOV driver allows a malicious Virtual Function guest to crash the host kernel or potentially escalate privileges to the host. The vulnerable function ice_parser_profile_init unconditionally passes caller-controlled ptype values from VIRTCHNL_OP_ADD_RSS_CFG into set_bit() against a statically sized 1024-bit bitmap, permitting a value such as 0xffff to write beyond the bitmap boundary and trigger a kernel NULL pointer dereference. No public exploit code has been identified and EPSS exploitation probability is low at 0.18%, but the CVSS 8.8 score and confirmed crash reproducibility signal real urgency for SR-IOV multi-tenant environments where stable-branch patches are already available. | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-45945 | Race condition in the Linux kernel's Intel VT-d IOMMU driver allows a local low-privileged attacker to trigger inconsistent PASID table state during domain replacement, potentially producing spurious IOMMU faults and unpredictable DMA behavior with cross-scope impact. The flaw stems from non-atomic updates to 512-bit PASID entries while the Present bit is set, and no public exploit identified at time of analysis despite a high CVSS score driven by the scope-changed local attack surface. | HIGH | 8.8 | 0.0% | 44 |
|
| CVE-2026-34459 | Stack buffer overflow in Sandboxie-Plus SbieSvc proxy service enables SYSTEM privilege escalation from sandboxed processes, including Security Hardened Sandboxes. Attackers chain an information disclosure (returning up to 32KB uninitialized stack memory with ASLR/stack cookie bypass) with an unbounded memcpy overflow in the GetRawInputDeviceInfoSlave IPC handler. Intel CET shadow stacks block ROP exploitation but not the information leak itself. Vendor-released patch available in version 1.17.3. No public exploit identified at time of analysis, but attack complexity is rated high (AC:H) with low privilege requirements (PR:L), making this viable for motivated attackers targeting sandbox environments. | HIGH | 8.8 | 0.0% | 44 |
|
| CVE-2026-8798 | Unbounded retry loops in BC-FJA's JNI native entropy layer cause calling threads to hang indefinitely when Intel RDSEED or RDRAND instructions persistently fail, producing a non-interruptible thread-level denial of service in any Java FIPS application backed by bc-fips 2.1.x before 2.1.3. The affected JNI seeding routine re-issues the CPU entropy instruction without any iteration limit whenever the carry flag signals failure - a condition reproducible by hardware entropy source faults, DRBG exhaustion under heavy multi-core contention, or hypervisors that do not forward these Intel instructions to guest VMs. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the conditions are routinely present in virtualized environments where hypervisors commonly withhold RDRAND/RDSEED forwarding, making this a realistic operational risk for enterprise Java FIPS deployments in cloud or VM-based infrastructure. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-40618 | Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are configured without hardware crypto acceleration, allowing remote unauthenticated attackers to cause denial of service via undisclosed traffic patterns. CVSS 7.5 (High) with network attack vector and no prerequisites. EPSS data not provided, no CISA KEV listing identified, indicating theoretical rather than observed exploitation. Vendor patch available per F5 advisory K000158082. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2025-35990 | Escalation of privilege in Intel Endpoint Management Assistant (EMA) software before version 1.14.5 allows an unauthenticated adversary on an adjacent network to gain elevated privileges on the vulnerable host, fully compromising its confidentiality, integrity, and availability. The flaw stems from improper input validation in a Ring 3 user-application component and carries a CVSS 4.0 base score of 8.7 (High). There is no public exploit identified at time of analysis, exploitation is not observed per CISA SSVC (Exploitation: none), and EPSS is very low at 0.03%. | HIGH | 8.7 | 0.0% | 44 |
No patch
|
| CVE-2026-18952 | Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users with low privileges as a vector for internal network reconnaissance and credential theft. The flaw resides in the threat intelligence feed parser, which fails to validate URL parameters submitted to the threat intel source configuration endpoint, allowing a crafted request to redirect server-side HTTP fetches to internal resources - including cloud metadata endpoints. Patch is confirmed available per Amazon's security bulletin AWS-2026-079; no public exploit code has been identified at time of analysis. | HIGH | 8.6 | 0.3% | 43 |
|
| CVE-2026-20898 | Privilege escalation in the Alias Checking Trusted Module (ACTM) firmware for certain Intel Xeon processors allows a local privileged attacker to escalate to System Management Mode (SMM) execution, achieving high confidentiality and integrity impact across both the directly compromised system and subsequent systems such as co-hosted hypervisors or tenant workloads. The attack requires high-complexity local technique combined with pre-existing privileged user access, placing it firmly in the advanced persistent threat actor category. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01439 to address this firmware flaw. | HIGH | 8.5 | 0.1% | 43 |
No patch
|