5019
CVEs
500
Critical
2166
High
2
KEV
250
PoC
229
Unpatched C/H
90.4%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
500
HIGH
2166
MEDIUM
2349
LOW
2
Monthly CVE Trend
Affected Products (30)
Linux Kernel
3119
Debian Linux
1753
Enterprise Linux Server
1506
Enterprise Linux Workstation
1461
Enterprise Linux Desktop
1458
Enterprise Linux
1186
Ubuntu Linux
972
Enterprise Linux Server Aus
839
Opensuse
696
Enterprise Linux Eus
687
Fedora
682
Enterprise Linux Server Tus
677
Chrome
639
Ubuntu
578
Enterprise Linux Server Eus
452
Java
385
Leap
346
MySQL
343
Python
274
Openshift Container Platform
229
Linux Enterprise Desktop
206
Thunderbird
201
MariaDB
189
Openstack
184
Satellite
183
Linux Enterprise Server
160
Jboss Enterprise Application Platform
160
Firefox
159
Jdk
158
Jre
156
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-64849 | Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making outbound requests to internal or cloud metadata endpoints via the POST /api/2.0/mlflow/webhooks/{id}/test endpoint. Because URL validation and the actual delivery re-resolve the hostname independently and follow redirects, an attacker can bypass the public-IP check and receive the target's response_status and response_body, enabling exfiltration of cloud credentials (e.g. from 169.254.169.254). No public exploit identified at time of analysis; the CVSS 9.3 rating and scope-change flag reflect the credential-theft potential of reaching metadata services. | CRITICAL | 9.3 | 0.3% | 117 |
KEV
PoC
|
| CVE-2026-59822 | Authentication bypass in LiteLLM (BerriAI) proxy/AI Gateway before 1.84.0 lets a remote unauthenticated attacker reach MCP tooling by sending a fabricated Authorization header. The malformed header forces the MCP Streamable HTTP endpoint down an OAuth2 passthrough fallback that substitutes a failed key validation with an empty UserAPIKeyAuth() object, effectively treating the caller as authorized without any valid LiteLLM key. The CVSS 4.0 score of 8.8 reflects network-reachable, no-privilege access with high confidentiality impact; no public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 8.8 | 0.3% | 114 |
KEV
PoC
|
| CVE-2026-70398 | Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticated tenant abuse the GitOpsCluster controller in the multicloud-integrations component to redirect spoke-cluster credentials into a namespace they control. Because the controller acts on the tenant's behalf across trust boundaries (a confused-deputy flaw), a low-privileged user can obtain tokens that grant access to managed spoke clusters and bypass ArgoCD AppProject scoping controls. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS base score is 9.6 (Critical). | CRITICAL | 9.6 | 23.0% | 71 |
No patch
|
| CVE-2026-18963 | Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in the keycloak-services component to complete a password reset for any user without ever clicking the emailed verification link, letting them directly set new credentials. Because the mandatory email-ownership check can be bypassed, the flaw yields full control of arbitrary accounts (CVSS 9.1). No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.1 | 0.4% | 71 |
PoC
|
| CVE-2026-48750 | Host-side arbitrary file write in Incus (the LXD-fork container and VM manager) before 7.2.0 lets an attacker who can supply a crafted image and call the instance exec endpoint write attacker-controlled content to any path on the host, leading to root-level command execution. A top-level `exec-output` symlink packed into an image survives image unpacking, and when `record-output:true` is passed to `/instances/$name/exec` the daemon follows that symlink to write `exec_UUID.stdout`/`.stderr` outside the instance - for example into `/etc/cron.d`. A working proof-of-concept exists in the GHSA advisory, but there is no public exploit identified as used in active attacks. | CRITICAL | 9.9 | 0.8% | 70 |
PoC
|
| CVE-2026-18663 | Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in `get_ldapmessage_controls_ext()`, which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash. | MEDIUM | 5.9 | 40.0% | 70 |
No patch
|
| CVE-2026-48753 | Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a path-traversal-laden multipart upload ID and plant files anywhere the daemon (typically root) can write, escalating to remote code execution. The flaw lives in the local S3 storage backend's multipart upload handling, where the attacker-supplied uploadId is concatenated onto the uploads directory without sanitization. A complete working PoC exists that drops a /etc/cron.d job for root command execution; no CISA KEV listing or EPSS score is provided, so this is publicly available exploit code rather than confirmed active exploitation. | CRITICAL | 9.9 | 0.7% | 70 |
PoC
|
| CVE-2026-48752 | Arbitrary host file read and write in Incus (the LXC/LXD container and VM manager) before version 7.2.0 allows a user who can import a crafted container image or instance backup to escape into the host filesystem via an unsanitized top-level `templates` symlink, possibly escalating to root command execution. The flaw stems from tar/rsync extraction routines that exclude device nodes but fail to reject symlinks pointing outside the target directory. No KEV listing or EPSS score is provided, but a detailed working PoC is published in the GHSA advisory. | CRITICAL | 9.9 | 0.8% | 70 |
PoC
|
| CVE-2026-48749 | Container-to-host filesystem escape in Incus before 7.2.0 lets a user who can import images and create instances read and write arbitrary files on the host as root. A malicious image carrying a duplicate top-level 'rootfs' symlink (rootfs -> /) passes image validation, and the stopped-container file API later chroots into that symlinked path via forkfile, exposing the host root filesystem through 'incus file pull/push'. A working proof-of-concept is published in the GitHub Security Advisory (GHSA-2q3f-q5pq-g8wv); publicly available exploit code exists, but there is no public exploit identified beyond the PoC and the CVE is not in CISA KEV. | CRITICAL | 9.9 | 0.8% | 70 |
PoC
|
| CVE-2026-48751 | Privilege escalation and project-restriction bypass in Incus before 7.2.0 lets a low-privileged user with access to an unrestricted project craft an instance whose snapshot carries malicious low-level hooks (raw.lxc/raw.qemu), then move and restore it into a project protected by restricted.containers.lowlevel=block, executing arbitrary commands on the host as root. The snapshot-restore path fails to re-enforce the lowlevel restriction, so the security control is silently bypassed. Publicly available exploit code exists (full PoC published in the vendor GHSA advisory); there is no public evidence of active exploitation. | CRITICAL | 9.9 | 0.7% | 70 |
PoC
|
| CVE-2026-48755 | Argument injection in the Incus daemon (incusd) backup feature lets an authenticated remote API client (PR:L) write arbitrary files on the host as root and likely escalate to code execution, affecting all versions before 7.2.0. The backup compression_algorithm field is split into tokens but only the first token is allowlist-validated, so trailing flags are passed straight to compressors like zstd. Publicly available exploit code exists (a full Python PoC is published in the GHSA advisory); rated CVSS 9.9 and tagged RCE, though it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.4% | 70 |
PoC
|
| CVE-2026-48769 | Arbitrary file write in the Incus daemon (incusd) via path traversal in the `Incus-Image-Hash` header allows a low-privileged attacker controlling a malicious image server to write attacker-controlled content to any path on the host filesystem as root, leading to arbitrary command execution. Affected versions are all Incus releases prior to 7.2.0; the vulnerability exists in the `source.type=url` image import code path. A full public proof-of-concept exploit exists demonstrating cron-based root command execution; no confirmed active exploitation in CISA KEV at time of analysis. | CRITICAL | 9.9 | 0.4% | 70 |
PoC
|
| CVE-2026-30623 | Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitrary `command` and `args` values in the server-creation JSON, which LiteLLM passes to the host OS without validation, yielding remote code execution as the LiteLLM process. The flaw is part of the broader MCP-stdio supply-chain advisory disclosed by ox.security across the AI ecosystem and is documented in LiteLLM's own April 2026 advisory. No public exploit is identified in the provided data, and EPSS is low (0.32%, 24th percentile), so widespread automated exploitation is not currently indicated despite the CVSS 9.8 rating. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2026-44825 | Full administrative cluster takeover in Apache Solr 9.4.0-9.10.1 and 10.0.0 arises because the 'bin/solr auth enable' setup tool silently provisions hardcoded template accounts (superadmin, admin, search, index) with publicly known default passwords alongside the operator's chosen account. Any remote attacker who reaches the Solr endpoint can authenticate with these baked-in credentials and obtain total control of the cluster. There is no public exploit identified at time of analysis and EPSS is low (0.21%), but the CVSS 9.8 rating and 'total' SSVC technical impact make this a high-severity misconfiguration-by-default flaw. | CRITICAL | 9.8 | 0.2% | 69 |
PoC
No patch
|
| CVE-2026-45695 | Remote code execution in Kopia backup server (≤ 0.22.3) allows unauthenticated attackers to run arbitrary OS commands as the Kopia process user via a single HTTP request to /api/v1/repo/exists when the server is launched with --without-password. Publicly available exploit code exists through the published GHSA advisory and PR diff; no public exploit identified at time of analysis as being weaponized in the wild, but the trivially exploitable vector (CVSS 9.8) and detailed write-up make weaponization straightforward. The bug stems from naive space-splitting of attacker-controlled sshArguments that is fed to exec.CommandContext("ssh"), letting an -oProxyCommand= token trigger $SHELL -c execution before any SSH transport is established. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
|