3
CVEs
0
Critical
1
High
0
KEV
0
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
1350 Optical Management System
10
Netact
7
Hit 7300 Firmware
7
Impact
7
G 040W Q Firmware
6
I 240W Q Gpon Ont Firmware
6
G42 Firmware
5
Infinera Mtc 9 Firmware
5
Transcend Network Management System
4
Asika Airscale Firmware
4
Fastmile Firmware
3
Heif
3
Mantaray Nm
3
Open Redirect
3
Impact Mobile
2
Nsp
2
Nokia Maps Places
1
Pc Suite
1
Iphone Os
1
G 2425G A Firmware
1
Wavelite Metro 200 Ops And Fans Firmware
1
Service Router Linux
1
Service Router Operating System
1
Bcm4325
1
Vantage Commander
1
Infinera Dna
1
Airframe Bmc Web Gui R18 Firmware
1
Fastmile 5G Receiver Firmware
1
Bcm4329
1
Linux Kernel
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-40463 | Privilege escalation in Nokia WaveSuite's CPB Log Files feature allows authenticated low-privilege users to access pages reserved for higher-privilege roles by directly navigating to their URLs, bypassing server-side role enforcement entirely. Affected versions confirmed by EUVD-2026-68372 include WaveSuite 23.6, 24.6, 24.12, and 25.6. No public exploit code exists and no active exploitation has been observed (EPSS: 0.14%, 4th percentile), though the trivial attack mechanism - crafting a direct HTTP request - makes this a meaningful risk for insider threat and compromised low-privilege account scenarios in telecom environments. | HIGH | 7.6 | 0.1% | 38 |
No patch
|
| CVE-2026-40464 | Stored cross-site scripting in Nokia NSP's workflow application allows an authenticated attacker to inject persistent malicious scripts that execute in the browsers of other NSP users who view the compromised content. The vulnerability spans a wide range of NSP releases from version 22.3 through 25.11, affecting operators relying on Nokia's network management and orchestration platform. No public exploit code or active exploitation has been identified; SSVC assessment confirms exploitation status as none with a non-automatable attack path. | MEDIUM | 5.4 | 0.1% | 27 |
No patch
|
| CVE-2026-40465 | Open redirect in Nokia NSP (Network Services Platform) enables remote unauthenticated attackers to craft URLs that bypass server-side validation of the redirect or URL parameter, redirecting authenticated users to attacker-controlled sites. Affected versions span NSP 23.11 through NSP 25.11 per EUVD data, covering a wide release window. No public exploit identified at time of analysis; EPSS of 0.14% at the 4th percentile reflects negligible observed exploitation activity, and the vulnerability is not listed in CISA KEV. | MEDIUM | 5.3 | 0.1% | 27 |
No patch
|