235
CVEs
4
Critical
73
High
0
KEV
1
PoC
43
Unpatched C/H
31.5%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
73
MEDIUM
126
LOW
10
Monthly CVE Trend
Affected Products (30)
Linux Kernel
98
N A
81
Debian Linux
63
Mac Os X
56
Active Management Technology Firmware
51
Fedora
44
Windows
43
Xen
39
Graphics Driver
37
Converged Security Management Engine Firmware
30
Core I7 8665U Firmware
27
Server Board S2600St Firmware
26
Core I7 8500Y Firmware
26
Quartus Prime
25
Core I7 8565U Firmware
25
Server Board S2600Wf Firmware
25
Core I7 8650U Firmware
25
Core I7 8700T Firmware
25
Core I7 8700 Firmware
25
Core I7 8700K Firmware
25
Core I7 8706G Firmware
24
Core I9 9900K Firmware
24
Server Board S2600Kp Firmware
24
Server Board S2600Bp Firmware
24
Proset Wireless Wifi
24
Core I9 9880H Firmware
24
Core I7 8850H Firmware
24
Compute Module Hns2600Bp Firmware
23
Server System R1000Wf Firmware
23
Server System R2000Wf Firmware
23
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-53503 | Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible. | HIGH | 7.5 | 0.4% | 58 |
PoC
|
| CVE-2026-45898 | Kernel memory corruption in the Linux iWARP Connection Manager (RDMA/iwcm) subsystem can crash systems running RDMA workloads on iWARP-capable hardware such as Intel E830 adapters. The bug, introduced by commit e1168f0 ('RDMA/iwcm: Simplify cm_event_handler()'), causes workqueue list corruption when iwcm_work items from a free list are reused while still queued, triggering a kernel BUG and panic. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 5th percentile), despite a CVSS base score of 9.8. | CRITICAL | 9.8 | 0.0% | 49 |
|
| CVE-2026-54333 | Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-54334 | Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-20794 | Local privilege escalation in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileged local user trigger a Ring 1 device-driver buffer overflow to execute arbitrary code and take total control of the host. The flaw carries a CVSS 4.0 base score of 9.3 with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis, and the EPSS score is negligible at 0.01% (3rd percentile), consistent with the SSVC verdict of no known exploitation. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2026-20702 | Protection mechanism failure in Intel Data Center Attestation Primitives (Intel DCAP) enables unauthenticated network-based attackers with specialized internal knowledge to undermine the integrity of the attestation system and expose confidential data from downstream systems relying on SGX enclave verification. The vulnerability (CWE-693) is particularly impactful in confidential computing environments where DCAP serves as the trust anchor for SGX workload isolation. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01449 addressing this issue. | HIGH | 8.9 | 0.3% | 45 |
No patch
|
| CVE-2026-20887 | Improper access control in all versions of Intel Vision software allows a remote, unauthenticated attacker to trigger denial of service and, under low-complexity conditions, achieve remote code execution against the Ring 3 user-application layer. The CVSS 4.0 base score of 8.8 reflects high confidentiality impact with lesser integrity and availability effects; there is no public exploit identified at time of analysis, and EPSS is low at 0.20% (42nd percentile). Intel published advisory SA-01457 and CISA's SSVC framework rates exploitation as none but technical impact as total. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2025-40058 | Improper enablement of IOMMU dirty page tracking in the Intel VT-d (iommu/vt-d) driver of the Linux kernel allows a misconfiguration where dirty tracking is offered even when the IOMMU performs incoherent page walks. Because the hardware cannot atomically update A/EA/D bits in non-snooped paging-structure entries, this triggers a non-recoverable fault and can corrupt or silently drop dirty-page state used during operations like VM live migration. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is a corrective hardening patch rather than an actively exploited flaw. | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-68128 | Out-of-bounds bitmap write in the Linux kernel's Intel ICE SR-IOV driver allows a malicious Virtual Function guest to crash the host kernel or potentially escalate privileges to the host. The vulnerable function ice_parser_profile_init unconditionally passes caller-controlled ptype values from VIRTCHNL_OP_ADD_RSS_CFG into set_bit() against a statically sized 1024-bit bitmap, permitting a value such as 0xffff to write beyond the bitmap boundary and trigger a kernel NULL pointer dereference. No public exploit code has been identified and EPSS exploitation probability is low at 0.18%, but the CVSS 8.8 score and confirmed crash reproducibility signal real urgency for SR-IOV multi-tenant environments where stable-branch patches are already available. | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2023-53764 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Handle lock during peer_id find ath12k_peer_find_by_id() requires | HIGH | 8.8 | 0.0% | 44 |
|
| CVE-2026-45945 | Race condition in the Linux kernel's Intel VT-d IOMMU driver allows a local low-privileged attacker to trigger inconsistent PASID table state during domain replacement, potentially producing spurious IOMMU faults and unpredictable DMA behavior with cross-scope impact. The flaw stems from non-atomic updates to 512-bit PASID entries while the Present bit is set, and no public exploit identified at time of analysis despite a high CVSS score driven by the scope-changed local attack surface. | HIGH | 8.8 | 0.0% | 44 |
|
| CVE-2026-34459 | Stack buffer overflow in Sandboxie-Plus SbieSvc proxy service enables SYSTEM privilege escalation from sandboxed processes, including Security Hardened Sandboxes. Attackers chain an information disclosure (returning up to 32KB uninitialized stack memory with ASLR/stack cookie bypass) with an unbounded memcpy overflow in the GetRawInputDeviceInfoSlave IPC handler. Intel CET shadow stacks block ROP exploitation but not the information leak itself. Vendor-released patch available in version 1.17.3. No public exploit identified at time of analysis, but attack complexity is rated high (AC:H) with low privilege requirements (PR:L), making this viable for motivated attackers targeting sandbox environments. | HIGH | 8.8 | 0.0% | 44 |
|
| CVE-2026-8798 | Unbounded retry loops in BC-FJA's JNI native entropy layer cause calling threads to hang indefinitely when Intel RDSEED or RDRAND instructions persistently fail, producing a non-interruptible thread-level denial of service in any Java FIPS application backed by bc-fips 2.1.x before 2.1.3. The affected JNI seeding routine re-issues the CPU entropy instruction without any iteration limit whenever the carry flag signals failure - a condition reproducible by hardware entropy source faults, DRBG exhaustion under heavy multi-core contention, or hypervisors that do not forward these Intel instructions to guest VMs. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the conditions are routinely present in virtualized environments where hypervisors commonly withhold RDRAND/RDSEED forwarding, making this a realistic operational risk for enterprise Java FIPS deployments in cloud or VM-based infrastructure. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-40618 | Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are configured without hardware crypto acceleration, allowing remote unauthenticated attackers to cause denial of service via undisclosed traffic patterns. CVSS 7.5 (High) with network attack vector and no prerequisites. EPSS data not provided, no CISA KEV listing identified, indicating theoretical rather than observed exploitation. Vendor patch available per F5 advisory K000158082. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2025-35990 | Escalation of privilege in Intel Endpoint Management Assistant (EMA) software before version 1.14.5 allows an unauthenticated adversary on an adjacent network to gain elevated privileges on the vulnerable host, fully compromising its confidentiality, integrity, and availability. The flaw stems from improper input validation in a Ring 3 user-application component and carries a CVSS 4.0 base score of 8.7 (High). There is no public exploit identified at time of analysis, exploitation is not observed per CISA SSVC (Exploitation: none), and EPSS is very low at 0.03%. | HIGH | 8.7 | 0.0% | 44 |
No patch
|