81
CVEs
1
Critical
24
High
0
KEV
0
PoC
14
Unpatched C/H
34.6%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
24
MEDIUM
50
LOW
0
Monthly CVE Trend
Affected Products (30)
Android
131
Nr15
64
Linux Kernel
62
Software Development Kit
58
Nr16
57
Nr17
48
Openwrt
42
Mt7915 Firmware
28
Mt7615 Firmware
28
Mt7629 Firmware
28
Mt7622 Firmware
28
Mt7628 Firmware
28
Mt7613 Firmware
28
Yocto
27
Iot Yocto
23
Nr17r
20
Mt7603E Firmware
20
Mt7620 Firmware
18
Mt7612 Firmware
18
Mt7610 Firmware
17
Lr12a
16
Lr13
14
Nbiot Sdk
9
Mt8981 Firmware
8
Mt7916 Firmware
8
Mt7603 Firmware
8
Mt7986 Firmware
8
Debian Linux
6
Modem
4
Mt7922 Firmware
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-20407 | Out-of-bounds write in Android WLAN STA driver due to missing bounds check allows local privilege escalation to System with user interaction. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2026-20430 | OpenWrt and its Software Development Kit contain an out-of-bounds write vulnerability in the WLAN access point firmware caused by improper bounds checking, enabling adjacent network attackers to achieve privilege escalation without user interaction or special privileges. The vulnerability carries high severity with complete impact across confidentiality, integrity, and availability, though no patch is currently available. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2026-20408 | OpenWRT and related SDKs are vulnerable to a heap buffer overflow in the WLAN component that allows adjacent network attackers to execute privilege escalation without user interaction or special permissions. The out-of-bounds write condition enables attackers on the same network segment to gain elevated system privileges. No patch is currently available for this vulnerability. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2026-80750 | Use-after-free in the Linux kernel's MediaTek power domain driver exposes kernel memory to potential corruption via a dangling device-tree node pointer. In scpsys_get_bus_protection_legacy(), two error paths call of_node_put() to release infracfg and SMI device-tree node references before those nodes are passed to dev_err_probe() with the %pOF format specifier; if the put drops the last reference, the formatter dereferences freed memory. Vendor patches are available for Linux 6.18.46, 7.1.10, and 7.2, and EPSS exploitation probability sits at 0.20% (10th percentile) with no confirmed active exploitation. | HIGH | 8.4 | 0.2% | 42 |
|
| CVE-2026-80751 | Uninitialized pointer dereference in the Linux kernel's MediaTek GPU power-domain driver (`pmdomain/mediatek/mfg`) can trigger a kernel fault or incorrect OPP (Operating Performance Point) configuration on first device attachment. The `prev_o` variable in `mtk_mfg_attach_dev()` is read in a conditional branch on the first loop iteration before ever being assigned, meaning it holds an indeterminate stack value; if that value is non-NULL, the kernel dereferences a stale or garbage pointer. Affected versions span stable kernel trees from commit f08e7a4e8d6a through the fixed points in 7.1.10, 7.2, and 6.19. No public exploit code and no CISA KEV listing are present; EPSS at 0.19% (9th percentile) reflects minimal real-world exploitation interest. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2025-71071 | In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. | HIGH | 7.8 | 0.0% | 39 |
|
| CVE-2023-53274 | In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: mt8183: Add back SSPM related clocks This reverts commit 860690a93ef23b567f781c1b631623e27190f101. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes. | HIGH | 7.8 | 0.0% | 39 |
|
| CVE-2026-31584 | Use-after-free in Linux kernel MediaTek video encoder allows local authenticated users to corrupt memory and potentially execute arbitrary code. The flaw affects the vcodec driver's encoder release path where ctx memory is freed before canceling scheduled workqueue tasks, enabling race conditions between cleanup and worker threads that may dereference freed memory. KASAN-confirmed exploitation requires local access with low privileges (CVSS AV:L/PR:L). Patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) indicates very low probability of automated exploitation, with no public exploit identified at time of analysis. | HIGH | 7.8 | 0.0% | 39 |
|
| CVE-2026-45909 | Local privilege escalation potential in the Linux kernel's MediaTek clock gate driver stems from incorrect use of __initconst annotations on mtk_gate structures that are accessed at runtime, not just during initialization. After kernel init completes, the memory backing these structs is freed, so any runtime access reads freed memory - affecting Linux 6.18 prior to stable releases 6.18.14 and 6.19.4. CVSS rates this 7.8 (High) with local attack vector; EPSS is 0.02% and no public exploit identified at time of analysis. | HIGH | 7.8 | 0.0% | 39 |
|
| CVE-2026-46308 | Local privilege escalation and memory corruption in the Linux kernel's MediaTek power-domain (pmdomain) driver stems from a use-after-free in scpsys_get_bus_protection_legacy(), where a device node is released via of_node_put() before the error path dereferences it in dev_err_probe(). Affecting kernels using the MediaTek SCPSYS legacy bus-protection code path (typically ARM/ARM64 MediaTek SoC platforms), a local low-privileged attacker able to influence the probe error path could corrupt freed kernel memory, with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.02%, 4th percentile). | HIGH | 7.8 | 0.0% | 39 |
|
| CVE-2025-39882 | In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: fix potential OF node use-after-free The for_each_child_of_node() helper drops the reference it takes to each node as. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application. | HIGH | 7.8 | 0.0% | 39 |
|
| CVE-2023-53388 | In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Clean dangling pointer on bind error path mtk_drm_bind() can fail, in which case drm_dev_put() is called, destroying. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application. | HIGH | 7.8 | 0.0% | 39 |
|
| CVE-2026-20423 | Nbiot Sdk contains a vulnerability that allows attackers to local escalation of privilege with User execution privileges needed (CVSS 7.8). | HIGH | 7.8 | 0.0% | 39 |
No patch
|
| CVE-2026-20401 | Nr15 modem suffers from an uncaught exception vulnerability that allows remote attackers to trigger a denial of service by connecting a device to a malicious base station. No special privileges or user interaction are required to exploit this network-based flaw. A patch is not currently available. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-20434 | Privilege escalation in Modem affects Nr17, Lr13, Nr16, Lr12a, and Nr15 devices through an out-of-bounds write vulnerability triggered when connecting to a rogue base station. An attacker controlling a malicious base station can achieve remote code execution and full system compromise without requiring additional privileges or user interaction beyond initial network connection. No patch is currently available for this high-severity vulnerability. | HIGH | 7.5 | 0.1% | 38 |
No patch
|