Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 04:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

154-74% vs 7-day avg of 597

2 critical, 44 high, 61 medium, 27 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	5.2	CVE-2026-78116	The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails zephyrproject, Broadcomzephyrproject zephyr, Broadcom AFBR-S50	NVD	Oct 21 19:17 UTC
CVE-2026-78116The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails Executive summary A bug in the Broadcom AFBR-S50 time-of-flight sensor driver can corrupt memory in devices that use this sensor, causing crashes or loss of availability. The advisory says an attacker in front of the sensor could trigger the fault with light conditions, though the attacker does not control the corrupted content. The advisory does not state a severity score or a fixed version, and it does not give vendor recommendations beyond the description of the fault. Technical summary The driver's data_ready_work_handler() in drivers/sensor/broadcom/afbr_s50/afbr_s50.c completes the same RTIO submission twice when Argus_EvaluateData() returns a non-OK status, because the error branch does not return. This double completion frees and reuses a submission pool entry, corrupts the mpsc submission queue, and can write through a released buffer, which the advisory describes as memory corruption and loss of availability rather than code execution. The fault is triggered by sensor conditions such as harsh ambient light or sharp distance transitions, and SPI transfer errors reach the same branch, so no physical or software access is required per the advisory. Affected and fixed versions are not stated, and no workaround is stated. The advisory does not give detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Physical Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Affects zephyrproject Broadcom zephyrproject zephyr Broadcom AFBR-S50 NIST National Vulnerability DatabasePublished Oct 21, 2026 19:17 UTC Read the advisory
	Medium	5.4	CVE-2026-19810	Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a type of issue whereby an... BroadcomBroadcom Symantec Endpoint Detection and Response	NVD	Oct 13 21:17 UTC
CVE-2026-19810Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a type of issue whereby an... From the advisory Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a type of issue whereby an attacker may attempt to inject malicious script that executes in the context of another user’s session, potentially resulting in unauthorized access to functionality or information normally restricted to that user. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Affects Broadcom Broadcom Symantec Endpoint Detection and Response NIST National Vulnerability DatabasePublished Oct 13, 2026 21:17 UTC Read the advisory
	High	8.4	CVE-2026-87428	In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials... Brocade, BroadcomBrocade Active Support Connectivity Gateway, Broadcom Brocade Active Support Connectivity Gateway	NVD	Oct 8 07:16 UTC
CVE-2026-87428In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials... From the advisory In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Active Support Connectivity Gateway Broadcom Brocade Active Support Connectivity Gateway NIST National Vulnerability DatabasePublished Oct 8, 2026 07:16 UTC Read the advisory
	Medium	5.3	CVE-2026-87426	An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and... Brocade, BroadcomBrocade Active Support Connectivity Gateway, Broadcom Brocade Active Support Connectivity Gateway	NVD	Oct 8 07:16 UTC
CVE-2026-87426An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and... From the advisory An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Active Support Connectivity Gateway Broadcom Brocade Active Support Connectivity Gateway NIST National Vulnerability DatabasePublished Oct 8, 2026 07:16 UTC Read the advisory
	High	7.6	CVE-2026-87425	An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0 Brocade, BroadcomBrocade Active Support Connectivity Gateway, Broadcom Brocade Active Support Connectivity Gateway	NVD	Oct 8 07:16 UTC
CVE-2026-87425An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0 From the advisory An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Active Support Connectivity Gateway Broadcom Brocade Active Support Connectivity Gateway NIST National Vulnerability DatabasePublished Oct 8, 2026 07:16 UTC Read the advisory
	High	8.6	CVE-2026-87424	A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to... Brocade, BroadcomBrocade Active Support Connectivity Gateway, Broadcom Brocade Active Support Connectivity Gateway	NVD	Oct 8 07:16 UTC
CVE-2026-87424A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to... From the advisory A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Active Support Connectivity Gateway Broadcom Brocade Active Support Connectivity Gateway NIST National Vulnerability DatabasePublished Oct 8, 2026 07:16 UTC Read the advisory
	High	7.7	CVE-2026-85490	When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences... Brocade, BroadcomBrocade Active Support Connectivity Gateway, Broadcom Brocade Active Support Connectivity Gateway	NVD	Oct 8 07:16 UTC
CVE-2026-85490When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences... From the advisory When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Active Support Connectivity Gateway Broadcom Brocade Active Support Connectivity Gateway NIST National Vulnerability DatabasePublished Oct 8, 2026 07:16 UTC Read the advisory
	High	8.7	CVE-2026-85489	An authentication flaw exists in the Brocade ASCG administrative management service component Brocade, BroadcomBrocade Active Support Connectivity Gateway, Broadcom Brocade Active Support Connectivity Gateway	NVD	Oct 8 07:16 UTC
CVE-2026-85489An authentication flaw exists in the Brocade ASCG administrative management service component From the advisory An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Active Support Connectivity Gateway Broadcom Brocade Active Support Connectivity Gateway NIST National Vulnerability DatabasePublished Oct 8, 2026 07:16 UTC Read the advisory
	High	7.0	CVE-2026-85488	Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer Brocade, BroadcomBrocade Active Support Connectivity Gateway, Broadcom Brocade Active Support Connectivity Gateway	NVD	Oct 8 07:16 UTC
CVE-2026-85488Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer From the advisory Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Active Support Connectivity Gateway Broadcom Brocade Active Support Connectivity Gateway NIST National Vulnerability DatabasePublished Oct 8, 2026 07:16 UTC Read the advisory
	High	8.6	CVE-2026-85487	A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0 Brocade, BroadcomBrocade Active Support Connectivity Gateway, Broadcom Brocade Active Support Connectivity Gateway	NVD	Oct 8 07:16 UTC
CVE-2026-85487A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0 From the advisory A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Active Support Connectivity Gateway Broadcom Brocade Active Support Connectivity Gateway NIST National Vulnerability DatabasePublished Oct 8, 2026 07:16 UTC Read the advisory
	High	8.6	CVE-2026-85486	Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation Brocade, BroadcomBrocade Active Support Connectivity Gateway, Broadcom Brocade Active Support Connectivity Gateway	NVD	Oct 8 07:16 UTC
CVE-2026-85486Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation From the advisory Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Active Support Connectivity Gateway Broadcom Brocade Active Support Connectivity Gateway NIST National Vulnerability DatabasePublished Oct 8, 2026 07:16 UTC Read the advisory
	High	8.6	CVE-2026-85423	A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0 Brocade, BroadcomBrocade Active Support Connectivity Gateway, Broadcom Brocade Active Support Connectivity Gateway	NVD	Oct 8 07:16 UTC
CVE-2026-85423A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0 From the advisory A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the application to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning the appliance into an unauthenticated proxy or execution vector. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Active Support Connectivity Gateway Broadcom Brocade Active Support Connectivity Gateway NIST National Vulnerability DatabasePublished Oct 8, 2026 07:16 UTC Read the advisory
	High	8.4	CVE-2026-85422	A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data... Brocade, BroadcomBrocade Active Support Connectivity Gateway, Broadcom Brocade Active Support Connectivity Gateway	NVD	Oct 8 07:16 UTC
CVE-2026-85422A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data... From the advisory A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored management credentials or craft forged administrative synchronization messages. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Active Support Connectivity Gateway Broadcom Brocade Active Support Connectivity Gateway NIST National Vulnerability DatabasePublished Oct 8, 2026 07:16 UTC Read the advisory
	High	8.7	CVE-2026-85421	A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0 Brocade, BroadcomBrocade Active Support Connectivity Gateway, Broadcom Brocade Active Support Connectivity Gateway	NVD	Oct 8 07:16 UTC
CVE-2026-85421A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0 From the advisory A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states, and modify system configurations, leading to a complete compromise of the streaming service control plane. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Active Support Connectivity Gateway Broadcom Brocade Active Support Connectivity Gateway NIST National Vulnerability DatabasePublished Oct 8, 2026 07:16 UTC Read the advisory
	Medium	5.6	CVE-2026-5769	A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the... Brocade, BroadcomBrocade SANnav, Broadcom Brocade Sannav	NVD	Oct 8 06:16 UTC
CVE-2026-5769A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the... From the advisory A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine (VM). This can happen when the SANnav server encounters an Out Of Memory (OOM) condition. The vulnerability could allow an authenticated admin user with access to the server hosting the SANnav to potentially view the memory swap file and access the password(s). Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required High User interaction None CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade SANnav Broadcom Brocade Sannav NIST National Vulnerability DatabasePublished Oct 8, 2026 06:16 UTC Read the advisory
	Medium	6.9	CVE-2026-5049	A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a Brocade, BroadcomBrocade SANnav, Broadcom Brocade Sannav	NVD	Oct 8 06:16 UTC
CVE-2026-5049A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a From the advisory A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade SANnav Broadcom Brocade Sannav NIST National Vulnerability DatabasePublished Oct 8, 2026 06:16 UTC Read the advisory
	Medium	6.1	CVE-2026-5048	In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject... Brocade, BroadcomBrocade SANnav, Broadcom Brocade Sannav	NVD	Oct 8 06:16 UTC
CVE-2026-5048In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject... From the advisory In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade SANnav Broadcom Brocade Sannav NIST National Vulnerability DatabasePublished Oct 8, 2026 06:16 UTC Read the advisory
	High	8.2	CVE-2026-5047	A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files Brocade, BroadcomBrocade SANnav, Broadcom Brocade Sannav	NVD	Oct 8 06:16 UTC
CVE-2026-5047A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files From the advisory A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade SANnav Broadcom Brocade Sannav NIST National Vulnerability DatabasePublished Oct 8, 2026 06:16 UTC Read the advisory
	Medium	6.9	CVE-2026-94587	A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before... Brocade, BroadcomBrocade Fabric OS, Broadcom Fabric Operating System	NVD	Oct 8 05:17 UTC
CVE-2026-94587A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before... From the advisory A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can overflow stack buffers causing a crash of the weblinker daemon. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Fabric OS Broadcom Fabric Operating System NIST National Vulnerability DatabasePublished Oct 8, 2026 05:17 UTC Read the advisory
	High	8.5	CVE-2026-94586	A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions... Brocade, BroadcomBrocade Fabric OS, Broadcom Fabric Operating System	NVD	Oct 8 05:17 UTC
CVE-2026-94586A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions... From the advisory A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Fabric OS Broadcom Fabric Operating System NIST National Vulnerability DatabasePublished Oct 8, 2026 05:17 UTC Read the advisory
	High	7.7	CVE-2026-94585	An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform Brocade, BroadcomBrocade Fabric OS, Broadcom Fabric Operating System	NVD	Oct 8 05:17 UTC
CVE-2026-94585An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform From the advisory An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Fabric OS Broadcom Fabric Operating System NIST National Vulnerability DatabasePublished Oct 8, 2026 05:17 UTC Read the advisory
	High	8.5	CVE-2026-94581	An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an... Brocade, BroadcomBrocade Fabric OS, Broadcom Fabric Operating System	NVD	Oct 8 05:17 UTC
CVE-2026-94581An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an... From the advisory An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Fabric OS Broadcom Fabric Operating System NIST National Vulnerability DatabasePublished Oct 8, 2026 05:17 UTC Read the advisory
	Medium	5.4	CVE-2026-94579	An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions... Brocade, BroadcomBrocade Fabric OS, Broadcom Fabric Operating System	NVD	Oct 8 05:17 UTC
CVE-2026-94579An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions... From the advisory An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges when their remote SSH session closes. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements Present Privileges required Low User interaction Passive CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Fabric OS Broadcom Fabric Operating System NIST National Vulnerability DatabasePublished Oct 8, 2026 05:17 UTC Read the advisory
	High	7.3	CVE-2026-94577	A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0... Brocade, BroadcomBrocade Fabric OS, Broadcom Fabric Operating System	NVD	Oct 8 05:17 UTC
CVE-2026-94577A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0... From the advisory A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass Role-Based Access Control (RBAC) validation checks. Successful exploitation allows an attacker to elevate privileges to root Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Fabric OS Broadcom Fabric Operating System NIST National Vulnerability DatabasePublished Oct 8, 2026 05:17 UTC Read the advisory
	Medium	5.9	CVE-2026-94576	An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Brocade, BroadcomBrocade Fabric OS, Broadcom Fabric Operating System	NVD	Oct 8 05:17 UTC
CVE-2026-94576An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 From the advisory An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying another account's access privileges. Exploitation allows a lower-privileged user to assign administrative roles to a target account, leading to localized privilege escalation. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Brocade Broadcom Brocade Fabric OS Broadcom Fabric Operating System NIST National Vulnerability DatabasePublished Oct 8, 2026 05:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited