Vulnerabilities
Summary — last 7 days
New vulnerabilities3,527▼ 1,287 vs. last week
Critical / high1,365▼ 1,397 vs. last week
New active exploitation (KEV)13▲ 6 vs. last week
Unscored (no CVSS)710▲ 647 vs. last week
More filters
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Low (3.5) | 0.14% | — | OpenubmcAI | 10/13/2026 | 10/16/2026 | The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the… | |
| Deferred | Medium (5.4) | 0.15% | — | OpenubmcAI | 10/13/2026 | 10/16/2026 | openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a… | |
| Deferred | High (8.6) | 0.19% | — | Huawei OpenubmcAIHuawei IbmcAI | 10/13/2026 | 10/16/2026 | Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization… |