9
CVEs
2
Critical
4
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
4
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Linux Kernel
98
N A
81
Debian Linux
63
Mac Os X
56
Active Management Technology Firmware
51
Fedora
44
Windows
43
Xen
39
Graphics Driver
37
Converged Security Management Engine Firmware
30
Core I7 8665U Firmware
27
Server Board S2600St Firmware
26
Core I7 8500Y Firmware
26
Quartus Prime
25
Core I7 8565U Firmware
25
Core I7 8650U Firmware
25
Server Board S2600Wf Firmware
25
Core I7 8700K Firmware
25
Core I7 8700 Firmware
25
Core I7 8700T Firmware
25
Core I7 8706G Firmware
24
Core I9 9900K Firmware
24
Server Board S2600Kp Firmware
24
Server Board S2600Bp Firmware
24
Proset Wireless Wifi
24
Core I9 9880H Firmware
24
Core I7 8850H Firmware
24
Server System R1000Wf Firmware
23
Server System R2000Wf Firmware
23
Core I7 8709G Firmware
23
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-54333 | Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-54334 | Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-74674 | Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-89620 | Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. Vendor-released patches are available in Linux 7.2.4, 7.3-rc1, and 6.18.50; no public exploit or active exploitation has been identified at time of analysis. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-89619 | Buffer overflow in the Linux kernel's Intel Touch Host Controller QuickSPI HID driver allows a local user with hidraw device access to corrupt kernel memory using device-controlled content. The function `quickspi_get_report()` copies the full device-supplied response length into the caller's buffer without checking the caller-provided size bound, so a touch controller returning more bytes than allocated overflows the kernel buffer. No public exploit exists (EPSS 0.17%, no KEV), but the sibling intel-quicki2c driver already carried the correct fix, confirming the root cause is a missing bounds-check port. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-80663 | Symlink-based file clobbering in the Linux kernel's intel-speed-select daemon allows a local low-privileged user to redirect root-process writes to an attacker-chosen file by pre-positioning a symlink at the daemon's fixed /tmp pidfile path. Affected systems are those running Linux 5.18 through unpatched 6.x and 7.x branches on Intel Speed Select Technology hardware with the daemon active. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile), but the attack is mechanically simple and requires only a local shell account. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-80948 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() In iwl_op_mode_dv | – | 0.2% | 0 |
|
|
| CVE-2026-74699 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() The q->replay_stat | – | 0.2% | – |
|
|
| CVE-2026-80620 | In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81 | – | 0.2% | – |
|