3549
CVEs
408
Critical
1569
High
1
KEV
4
PoC
47
Unpatched C/H
98.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
408
HIGH
1569
MEDIUM
390
LOW
6
Monthly CVE Trend
Affected Products (30)
Linux Kernel
6758
Debian Linux
1512
Ubuntu
550
Android
548
Ubuntu Linux
504
Enterprise Linux
265
Fedora
256
Opensuse
236
Leap
195
Enterprise Linux Server
135
Enterprise Linux Workstation
132
H410c Firmware
130
Enterprise Linux Desktop
130
H410s Firmware
119
H700s Firmware
119
H500s Firmware
119
Enterprise Linux Server Aus
119
H300s Firmware
118
Enterprise Linux Server Tus
91
Windows
78
Active Iq Unified Manager
78
Cloud Backup
75
Enterprise Linux Server Eus
69
H300E Firmware
68
H500E Firmware
68
H700E Firmware
68
Enterprise Linux Eus
65
Solidfire
58
Hci Management Node
57
Solaris
53
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-53362 | Heap out-of-bounds write in the Linux kernel's IPv6 stack (__ip6_append_data) lets a local unprivileged user corrupt kernel memory by sending data through a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. On the paged-allocation path the linear skb area is undersized by 'fraggap' bytes while pagedlen is overstated by the same amount, so the copy writes past skb->end into the trailing skb_shared_info. No public exploit is identified at time of analysis and EPSS is low (0.18%, 7th percentile), but the flaw is locally triggerable without special privileges and the vendor has released fixes. | HIGH | 7.8 | 0.2% | 109 |
KEV
PoC
|
| CVE-2026-53359 | Local privilege escalation and host memory corruption in the Linux kernel's KVM x86 shadow paging (MMU) subsystem allows a low-privileged actor with control over a guest/VMM to trigger a use-after-free in the host kernel. The flaw is an incomplete fix for commit 0cb2af2ea66ad: kvm_mmu_get_child_sp() reuses a shadow page without comparing its role, so a stale rmap entry survives after a memslot is dropped and the shadow page is freed, and later gfn walks dereference a pointer into freed memory. A public proof-of-concept exists (flagged by Italy's ACN/CSIRT) and SSVC rates technical impact as total, but it is not on CISA KEV and EPSS is low (0.18%), indicating no confirmed widespread active exploitation. | HIGH | 8.8 | 0.2% | 64 |
PoC
|
| CVE-2026-82017 | Boot registry parameter injection in IGEL OS 12 (before 12.7.6) and IGEL OS 11 (before 11.11.150) allows an attacker with physical access to execute arbitrary Linux kernel command-line parameters by writing to an unencrypted, unsigned configuration partition that the signed bootloader reads at startup. The attack is particularly dangerous because it does not alter the measured boot code path, meaning TPM PCR attestation does not detect the tampering - effectively defeating the trust assumptions of the secure boot and full-disk encryption stack. A publicly available exploit script and a DEF CON 34 presentation detail the technique; no CISA KEV listing has been issued at time of analysis, indicating exploitation has not been confirmed at scale. | HIGH | 8.6 | 0.2% | 63 |
PoC
|
| CVE-2026-68432 | Privilege escalation in the Linux kernel's vxlan subsystem allows a local user holding CAP_NET_ADMIN in a vxlan device's network namespace to rewrite underlay configuration in a separate, more privileged namespace where they lack that capability. The flaw in vxlan_changelink() affects multiple stable kernel branches (6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2-rc) and is most impactful in multi-tenant container or cloud environments where vxlan devices span namespace boundaries - a common topology in Kubernetes and OpenStack deployments. With an EPSS score of 17% and no public exploit or CISA KEV listing confirmed at time of analysis, this is an elevated-risk local privilege escalation requiring prompt patching on affected containerized infrastructure. | HIGH | 8.8 | 17.0% | 61 |
|
| CVE-2026-68433 | Uninitialized memory read in the Linux kernel's libceph client library exposes stale kernel buffer contents and risks system instability on Ceph-connected hosts. The flaw exists in handle_get_version_reply(), which incorrectly uses msg->front_alloc_len - the allocated buffer size - as the decode boundary instead of msg->front.iov_len, the count of bytes actually received. A truncated MON_GET_VERSION_REPLY from a malicious or compromised Ceph monitor therefore passes the ceph_decode_need() guard and reads a second u64 from leftover bytes of a prior message, constituting an out-of-bounds read of uninitialized kernel memory. No public exploit has been identified at time of analysis, but the 16% EPSS score is elevated for a kernel library flaw and warrants prompt patching on Ceph-client deployments. | HIGH | 8.6 | 16.0% | 59 |
|
| CVE-2026-68431 | Out-of-bounds memory read in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote, unauthenticated client leak adjacent kernel memory. The receive path applied the minimum SMB2 PDU size check only to packets with ProtocolId SMB2_PROTO_NUMBER, so a short packet carrying SMB2_TRANSFORM_PROTO_NUM slipped past validation on an SMB 2.1 connection (which offers no transform handling) and reached init_smb2_rsp_hdr(), which read past the request allocation and returned the copied fields to the client. Rated CVSS 9.1 with an EPSS of 11%; no public exploit or CISA KEV listing is indicated, so this is no public exploit identified at time of analysis. | CRITICAL | 9.1 | 11.0% | 56 |
|
| CVE-2026-68445 | GPU shader validation bypass in the Linux kernel's drm/vc4 driver allows local low-privileged users to rewrite validated shader bytecode after it has been approved by the GPU security validator. Specifically, vc4_gem_object_mmap() rejects writable mappings of validated shader buffer objects (BOs) but neglects to clear VM_MAYWRITE, enabling a two-step attack: map the BO read-only, then invoke mprotect() to silently upgrade the mapping to PROT_WRITE, bypassing the one-time validation check the GPU trusts unconditionally. No public exploit has been identified and no CISA KEV listing exists, but an EPSS of 17% is elevated for a local-only kernel driver issue, warranting prompt patching on affected Raspberry Pi and BCM283x-based platforms. | HIGH | 7.8 | 17.0% | 56 |
|
| CVE-2026-68440 | Heap overflow in the Linux kernel's txgbe network driver enables a local attacker to write beyond an allocated heap buffer during ethtool EEPROM reads, potentially escalating to full kernel compromise on systems with Wangxun txgbe 10GbE hardware. The flaw exists because txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into a buffer ethtool allocates to exactly length bytes, causing a 1-3 byte out-of-bounds write whenever the requested length is not 4-byte aligned. Vendor patches are available in Linux 6.19 and stable releases 7.1.6 and 7.2-rc5; no public exploit code or active exploitation has been identified at time of analysis, though the 16% EPSS score is notably elevated for a kernel driver defect. | HIGH | 7.8 | 16.0% | 55 |
|
| CVE-2026-68442 | Use-after-free in the Linux kernel's btrfs filesystem driver allows a low-privileged local user to cause kernel memory corruption with full system compromise potential. Introduced by a regression in commit f86f7a75e2fb, the btrfs extent map splitting code in btrfs_drop_extent_map_range() incorrectly propagates EXTENT_FLAG_LOGGING to child split maps, which are never cleared of this flag; when the extent map shrinker later frees such a map while it remains on the inode's modified_extents list, a use-after-free is triggered. No public exploit has been identified at time of analysis, but an EPSS of 16% signals elevated exploitation probability for a local kernel UAF affecting Linux 6.8 and later across multiple stable branches. | HIGH | 7.8 | 16.0% | 55 |
|
| CVE-2026-68446 | Missing input validation in the Linux kernel's drm/vmwgfx driver allows a low-privileged local user on a VMware guest VM to supply an arbitrary array_size value in vmw_surface_metadata via ioctl, bypassing per-Shader-Model limits and triggering out-of-bounds kernel memory access with high confidentiality, integrity, and availability impact. Affected kernel versions span 5.7 through multiple stable branches, with patches now available for 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. No public exploit code or CISA KEV listing has been identified at time of analysis, though EPSS at 16% signals a meaningfully elevated probability of eventual exploitation. | HIGH | 7.8 | 16.0% | 55 |
|
| CVE-2026-68447 | Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with AMD v9 GPU hardware. The MQD control stack copy uses cp_hqd_cntl_stack_size directly from hardware registers without bounding it to the allocated Buffer Object, allowing memcpy to read past the BO into adjacent GTT memory. A local low-privileged user with access to AMD GPU compute queue checkpointing can recover sensitive kernel data; no public exploit has been identified at time of analysis, though the 15% EPSS score is above baseline for kernel information-disclosure flaws. | HIGH | 7.1 | 15.0% | 50 |
|
| CVE-2026-72421 | Incorrect IPv4 FIB route resolution in the Linux kernel causes error routes (e.g. 'unreachable') in the merged local/main routing table to be silently overwritten by matching routes in the default table. This occurs specifically when CONFIG_IP_MULTIPLE_TABLES is compiled in but no routing rules have been added, so fib_lookup() fails to bail out after the first table lookup. The result is that traffic which should be blocked/dropped is instead routed, undermining routing-based access-control expectations; no public exploit identified at time of analysis and EPSS probability is low (0.22%). | CRITICAL | 10.0 | 0.2% | 50 |
|
| CVE-2026-74705 | Use-after-free in the Linux kernel's UDP tunnel GSO segmentation path (__skb_udp_tunnel_segment()) occurs when the code dereferences a saved UDP header pointer after a skb_pull() reallocates skb->head, invalidating that pointer. The flaw affects hosts that software-segment UDP-encapsulated tunnel traffic (VXLAN/GENEVE/FoU), and can lead to a kernel crash or potential information disclosure. No public exploit is identified at time of analysis, EPSS is low (0.22%), and the issue is not on CISA KEV; the upstream fix reorders the header fetch to occur after the pull. | CRITICAL | 10.0 | 0.2% | 50 |
|
| CVE-2026-74280 | Improper error-path cleanup in the Linux kernel's Marvell OcteonTX crypto hardware-accelerator driver (crypto/marvell/octeontx) mishandles DMA unmapping: on a mapping failure the sg_cleanup loop indexes list[i] instead of list[j], leaking successfully mapped scatter-gather entries while repeatedly unmapping the already-failed one. Only systems with Marvell OcteonTX crypto hardware and this driver loaded are affected. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile) and the issue is not in CISA KEV. | CRITICAL | 10.0 | 0.2% | 50 |
|
| CVE-2026-74612 | Kernel memory disclosure and crash in the Linux kernel's veth driver arises from broken skb length accounting after an XDP program adjusts packet fragments; veth_xdp_rcv_skb() updates skb->data_len but leaves skb->len holding the stale fragment contribution, so skb_headlen() overstates the linear area. On the UDP receive path this caused __skb_datagram_iter() to copy 1024 bytes past the real linear tail into userspace - leaking skb_shared_info contents including nr_frags, xdp_frags_size, and a kernel pointer from frags[0] - while displacing and truncating real packet data. A related path via bpf_xdp_pull_data() leaves the skb non-linear and trips SKB_LINEAR_ASSERT(), crashing the kernel. There is no public exploit identified at time of analysis, and EPSS risk is low (0.21%). | CRITICAL | 10.0 | 0.2% | 50 |
|