{
 "format": 1,
 "built": "2026-10-29T13:07:17Z",
 "sources": {
  "hub": "https://discover.bareket.ai",
  "hub_updated": "2026-10-29T09:17:38.562Z",
  "epss": "https://epss.empiricalsecurity.com/epss_scores-current.csv.gz",
  "epss_date": "2026-10-28",
  "kev": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
  "kev_version": "2026.10.28",
  "kev_date": "2026-10-28T19:00:04.8077Z",
  "nvd": "https://services.nvd.nist.gov/rest/json/cves/2.0",
  "nvd_read": "2026-10-29T13:07:17Z",
  "nvd_families": [
   {
    "slug": "nvidia-gpu-driver",
    "query": "cpe:2.3:a:nvidia:gpu_display_driver",
    "total": 81,
    "kept": 81
   },
   {
    "slug": "nvidia-dcgm",
    "query": "cpe:2.3:a:nvidia:data_center_gpu_manager",
    "total": 3,
    "kept": 3
   },
   {
    "slug": "linuxfoundation-runc",
    "query": "cpe:2.3:a:linuxfoundation:runc",
    "total": 17,
    "kept": 17
   },
   {
    "slug": "linuxfoundation-containerd",
    "query": "cpe:2.3:a:linuxfoundation:containerd",
    "total": 22,
    "kept": 22
   },
   {
    "slug": "nvidia-container-toolkit",
    "query": "cpe:2.3:a:nvidia:nvidia_container_toolkit",
    "total": 7,
    "kept": 7
   },
   {
    "slug": "dell-poweredge-bios",
    "query": "cpe:2.3:o:dell",
    "total": 702,
    "kept": 22
   }
  ]
 },
 "stats": {
  "cves": 399,
  "with_ranges": 273,
  "without_ranges": 126,
  "with_fixed_in": 99,
  "kev": 1,
  "epss_scored": 399,
  "recent_90d": 10,
  "recent_90d_without_ranges": 9,
  "dropped_ranges": 302,
  "dropped_range_cves": 59
 },
 "cves": {
  "CVE-2004-0525": {
   "cvss": 5,
   "cvss_version": "2.0",
   "epss": 0.02665,
   "epss_date": "2026-10-28",
   "published": "2004-08-06T04:00:00.000",
   "modified": "2026-06-16T22:05:49.030",
   "severity": "medium",
   "summary": "HP Integrated Lights-Out (iLO) 1.10 and other versions before 1.55 allows remote attackers to cause a denial of service (hang) by accessing iLO using the TCP/IP reserved port zero.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_firmware",
     "eq": "1.10"
    },
    {
     "product": "integrated_lights-out_firmware",
     "eq": "1.15"
    },
    {
     "product": "integrated_lights-out_firmware",
     "eq": "1.50"
    }
   ],
   "products": [
    "hp:integrated_lights-out_firmware"
   ]
  },
  "CVE-2011-4158": {
   "cvss": 4,
   "cvss_version": "2.0",
   "epss": 0.01587,
   "epss_date": "2026-10-28",
   "published": "2011-11-16T16:55:00.800",
   "modified": "2026-06-16T23:34:31.270",
   "severity": "medium",
   "summary": "Unspecified vulnerability in HP Directories Support for ProLiant Management Processors 3.10 and 3.20 for Integrated Lights-Out iLO2 and iLO3 allows remote authenticated users to obtain sensitive information via unknown vectors.",
   "vendors": [
    "ilo"
   ],
   "products": [
    "hp:directories_support_for_proliant_management_processors"
   ]
  },
  "CVE-2012-3271": {
   "cvss": 9.3,
   "cvss_version": "2.0",
   "epss": 0.05091,
   "epss_date": "2026-10-28",
   "published": "2012-11-29T13:14:37.227",
   "modified": "2026-06-16T23:42:54.267",
   "severity": "high",
   "summary": "Unspecified vulnerability on the HP Integrated Lights-Out 3 (aka iLO3) with firmware before 1.50 and Integrated Lights-Out 4 (aka iLO4) with firmware before 1.13 allows remote attackers to obtain sensitive information via unknown vectors.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_3_firmware",
     "versionEndIncluding": "1.28"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "eq": "1.00"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "eq": "1.05"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "eq": "1.20"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "eq": "1.26"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "versionEndIncluding": "1.11"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "eq": "1.05"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "eq": "1.10"
    }
   ],
   "products": [
    "hp:integrated_lights-out_3_firmware",
    "hp:integrated_lights-out_4_firmware"
   ]
  },
  "CVE-2013-2338": {
   "cvss": 10,
   "cvss_version": "2.0",
   "epss": 0.10436,
   "epss_date": "2026-10-28",
   "published": "2013-06-14T19:55:01.140",
   "modified": "2026-06-16T23:53:09.713",
   "severity": "high",
   "summary": "Unspecified vulnerability on HP Integrated Lights-Out 3 (aka iLO3) cards with firmware before 1.57 and 4 (aka iLO4) cards with firmware before 1.22, when Single-Sign-On (SSO) is used, allows remote attackers to execute arbitrary code via unknown vectors.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_3_firmware",
     "versionEndIncluding": "1.55"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "eq": "1.00"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "eq": "1.05"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "eq": "1.20"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "eq": "1.26"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "eq": "1.28"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "eq": "1.50"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "versionEndIncluding": "1.20"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "eq": "1.11"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "eq": "1.13"
    }
   ],
   "products": [
    "hp:integrated_lights-out_3_firmware",
    "hp:integrated_lights-out_4_firmware"
   ]
  },
  "CVE-2013-3589": {
   "cvss": 4.3,
   "cvss_version": "2.0",
   "epss": 0.01634,
   "epss_date": "2026-10-28",
   "published": "2013-09-24T10:35:51.923",
   "modified": "2026-06-16T23:55:28.520",
   "severity": "medium",
   "summary": "Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRAC6 monolithic devices with firmware before 1.96 and iDRAC7 devices with firmware before 1.46.45 allows remote attackers to inject arbitrary web script or HTML via the ErrorMsg parameter.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac6_firmware",
     "versionEndIncluding": "1.95"
    },
    {
     "product": "idrac6_firmware",
     "eq": "1.0"
    },
    {
     "product": "idrac6_firmware",
     "eq": "1.1"
    },
    {
     "product": "idrac6_firmware",
     "eq": "1.2"
    },
    {
     "product": "idrac6_firmware",
     "eq": "1.3"
    },
    {
     "product": "idrac6_firmware",
     "eq": "1.5"
    },
    {
     "product": "idrac6_firmware",
     "eq": "1.6"
    },
    {
     "product": "idrac6_firmware",
     "eq": "1.8"
    },
    {
     "product": "idrac7_firmware",
     "versionEndIncluding": "1.40.40"
    },
    {
     "product": "idrac7_firmware",
     "eq": "1.00.00"
    },
    {
     "product": "idrac7_firmware",
     "eq": "1.06.06"
    },
    {
     "product": "idrac7_firmware",
     "eq": "1.10.10"
    },
    {
     "product": "idrac7_firmware",
     "eq": "1.20.20"
    },
    {
     "product": "idrac7_firmware",
     "eq": "1.23.23"
    },
    {
     "product": "idrac7_firmware",
     "eq": "1.37.35"
    }
   ],
   "products": [
    "dell:idrac6_firmware",
    "dell:idrac6_monolithic",
    "dell:idrac7",
    "dell:idrac7_firmware"
   ]
  },
  "CVE-2013-4782": {
   "cvss": 10,
   "cvss_version": "2.0",
   "epss": 0.26211,
   "epss_date": "2026-10-28",
   "published": "2013-07-08T22:55:01.107",
   "modified": "2026-06-16T23:57:53.147",
   "severity": "high",
   "summary": "The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.",
   "vendors": [
    "supermicro"
   ],
   "products": [
    "supermicro:bmc"
   ]
  },
  "CVE-2013-4783": {
   "cvss": 10,
   "cvss_version": "2.0",
   "epss": 0.03384,
   "epss_date": "2026-10-28",
   "published": "2013-07-08T22:55:01.137",
   "modified": "2026-06-16T23:57:53.263",
   "severity": "high",
   "summary": "The Dell iDRAC6 with firmware 1.x before 1.92 and 2.x and 3.x before 3.42, and iDRAC7 with firmware before 1.23.23, allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.  NOTE: the vendor disputes the significance of this issue, stating \"DRAC's are intended to be on a separate management network; they are not designed nor intended to be placed on or connected to the Internet.\"",
   "vendors": [
    "idrac"
   ],
   "products": [
    "dell:idrac6_bmc"
   ]
  },
  "CVE-2013-4784": {
   "cvss": 10,
   "cvss_version": "2.0",
   "epss": 0.49587,
   "epss_date": "2026-10-28",
   "published": "2013-07-08T22:55:01.170",
   "modified": "2026-06-16T23:57:53.390",
   "severity": "high",
   "summary": "The HP Integrated Lights-Out (iLO) BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.",
   "vendors": [
    "ilo"
   ],
   "products": [
    "hp:integrated_lights-out_bmc"
   ]
  },
  "CVE-2013-4785": {
   "cvss": 10,
   "cvss_version": "2.0",
   "epss": 0.03621,
   "epss_date": "2026-10-28",
   "published": "2013-07-08T22:55:01.187",
   "modified": "2026-06-16T23:57:53.510",
   "severity": "high",
   "summary": "The web interface on the Dell iDRAC6 with firmware before 1.95 allows remote attackers to modify the CLP interface for arbitrary users and possibly have other impact via a request to an unspecified form that is accessible from testurls.html.  NOTE: the vendor disputes the significance of this issue, stating \"DRAC's are intended to be on a separate management network; they are not designed nor intended to be placed on or connected to the Internet.\"",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac6_firmware",
     "eq": "1.7"
    }
   ],
   "products": [
    "dell:idrac6_firmware"
   ]
  },
  "CVE-2013-4805": {
   "cvss": 9,
   "cvss_version": "2.0",
   "epss": 0.0298,
   "epss_date": "2026-10-28",
   "published": "2013-08-05T13:22:48.160",
   "modified": "2026-06-16T23:57:55.517",
   "severity": "high",
   "summary": "Unspecified vulnerability in HP Integrated Lights-Out 3 (aka iLO3) firmware before 1.60 and 4 (aka iLO4) firmware before 1.30 allows remote attackers to bypass authentication via unknown vectors.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_firmware",
     "eq": "1.10"
    },
    {
     "product": "integrated_lights-out_firmware",
     "eq": "1.15"
    },
    {
     "product": "integrated_lights-out_firmware",
     "eq": "1.50"
    }
   ],
   "products": [
    "hp:integrated_lights-out_firmware"
   ]
  },
  "CVE-2013-4842": {
   "cvss": 4.3,
   "cvss_version": "2.0",
   "epss": 0.02262,
   "epss_date": "2026-10-28",
   "published": "2013-11-18T03:55:05.883",
   "modified": "2026-06-16T23:57:59.280",
   "severity": "medium",
   "summary": "Cross-site scripting (XSS) vulnerability in HP Integrated Lights-Out 4 (iLO4) with firmware before 1.32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_firmware",
     "eq": "1.10"
    },
    {
     "product": "integrated_lights-out_firmware",
     "eq": "1.15"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_firmware"
   ]
  },
  "CVE-2013-4843": {
   "cvss": 6.8,
   "cvss_version": "2.0",
   "epss": 0.01825,
   "epss_date": "2026-10-28",
   "published": "2013-11-18T03:55:05.913",
   "modified": "2026-06-16T23:57:59.383",
   "severity": "medium",
   "summary": "Unspecified vulnerability in HP Integrated Lights-Out 4 (iLO4) with firmware before 1.32 allows remote authenticated users to obtain sensitive information via unknown vectors.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_firmware",
     "eq": "1.10"
    },
    {
     "product": "integrated_lights-out_firmware",
     "eq": "1.15"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_firmware"
   ]
  },
  "CVE-2014-2601": {
   "cvss": 7.8,
   "cvss_version": "2.0",
   "epss": 0.03955,
   "epss_date": "2026-10-28",
   "published": "2014-04-24T23:55:05.580",
   "modified": "2026-06-17T00:06:53.317",
   "severity": "high",
   "summary": "The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_2_firmware",
     "versionEndIncluding": "2.23"
    },
    {
     "product": "integrated_lights-out_2_firmware",
     "eq": "1.00"
    },
    {
     "product": "integrated_lights-out_2_firmware",
     "eq": "1.10"
    },
    {
     "product": "integrated_lights-out_2_firmware",
     "eq": "1.20"
    },
    {
     "product": "integrated_lights-out_2_firmware",
     "eq": "1.30"
    },
    {
     "product": "integrated_lights-out_2_firmware",
     "eq": "1.70"
    },
    {
     "product": "integrated_lights-out_2_firmware",
     "eq": "1.75"
    },
    {
     "product": "integrated_lights-out_2_firmware",
     "eq": "2.12"
    },
    {
     "product": "integrated_lights-out_2_firmware",
     "eq": "2.15"
    },
    {
     "product": "integrated_lights-out_2_firmware",
     "eq": "2.20"
    },
    {
     "product": "integrated_lights-out_2_firmware",
     "eq": "2.22"
    }
   ],
   "products": [
    "hp:integrated_lights-out_2_firmware"
   ]
  },
  "CVE-2014-7876": {
   "cvss": 10,
   "cvss_version": "2.0",
   "epss": 0.12795,
   "epss_date": "2026-10-28",
   "published": "2015-03-31T10:59:00.073",
   "modified": "2026-06-17T00:15:52.193",
   "severity": "high",
   "summary": "Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27 and 4 before 2.03 and iLO Chassis Management (CM) firmware before 1.30 allows remote attackers to gain privileges, execute arbitrary code, or cause a denial of service via unknown vectors.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_2_firmware",
     "versionEndIncluding": "2.25"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "versionEndIncluding": "2.01"
    },
    {
     "product": "integrated_lights-out_chassis_management_firmware",
     "versionEndIncluding": "1.29"
    }
   ],
   "products": [
    "hp:integrated_lights-out_2_firmware",
    "hp:integrated_lights-out_4_firmware",
    "hp:integrated_lights-out_chassis_management_firmware"
   ]
  },
  "CVE-2014-8272": {
   "cvss": 5,
   "cvss_version": "2.0",
   "epss": 0.19153,
   "epss_date": "2026-10-28",
   "published": "2014-12-19T11:59:05.290",
   "modified": "2026-06-17T00:16:29.667",
   "severity": "medium",
   "summary": "The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly select session ID values, which makes it easier for remote attackers to execute arbitrary commands via a brute-force attack.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac6_modular",
     "versionEndIncluding": "3.60"
    },
    {
     "product": "idrac7",
     "versionEndIncluding": "1.56.55"
    },
    {
     "product": "idrac6_monolithic",
     "versionEndIncluding": "1.97"
    }
   ],
   "products": [
    "dell:idrac6_modular",
    "dell:idrac6_monolithic",
    "dell:idrac7",
    "intel:ipmi"
   ]
  },
  "CVE-2015-2106": {
   "cvss": 6.4,
   "cvss_version": "2.0",
   "epss": 0.03521,
   "epss_date": "2026-10-28",
   "published": "2015-03-31T10:59:04.997",
   "modified": "2026-06-17T00:23:36.537",
   "severity": "medium",
   "summary": "Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27, 3 before 1.82, and 4 before 2.10 allows remote attackers to bypass intended access restrictions or cause a denial of service via unknown vectors.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_2_firmware",
     "versionEndIncluding": "2.25"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "versionEndIncluding": "1.80"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "versionEndIncluding": "2.03"
    }
   ],
   "products": [
    "hp:integrated_lights-out_2_firmware",
    "hp:integrated_lights-out_3_firmware",
    "hp:integrated_lights-out_4_firmware"
   ]
  },
  "CVE-2015-5435": {
   "cvss": 4,
   "cvss_version": "2.0",
   "epss": 0.02376,
   "epss_date": "2026-10-28",
   "published": "2015-09-30T01:59:16.037",
   "modified": "2026-06-17T00:29:07.600",
   "severity": "medium",
   "summary": "Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 3 before 1.85 and 4 before 2.22 allows remote authenticated users to cause a denial of service via unknown vectors.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_3_firmware",
     "versionEndIncluding": "1.80"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "versionEndIncluding": "2.20"
    }
   ],
   "products": [
    "hp:integrated_lights-out_3_firmware",
    "hp:integrated_lights-out_4_firmware"
   ]
  },
  "CVE-2015-5436": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.01614,
   "epss_date": "2026-10-28",
   "fixed_in": "2.30",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2015-5436",
   "published": "2017-05-11T14:29:46.997",
   "modified": "2026-06-17T00:29:07.703",
   "severity": "high",
   "summary": "A potential security vulnerability has been identified with HP Integrated Lights-Out 4 (iLO 4) firmware version 2.11 and later, but prior to version 2.30. The vulnerability could be exploited remotely resulting in Denial of Service (DoS). Note this was originally published in 2015 however the CVE entry was added in 2020.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_firmware",
     "versionEndExcluding": "2.30"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_firmware"
   ]
  },
  "CVE-2016-3697": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00388,
   "epss_date": "2026-10-28",
   "published": "2016-06-01T20:59:06.137",
   "modified": "2026-06-17T00:46:12.550",
   "severity": "high",
   "summary": "libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndIncluding": "0.0.9"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2016-4375": {
   "cvss": 9.8,
   "cvss_version": "3.0",
   "epss": 0.02998,
   "epss_date": "2026-10-28",
   "published": "2016-09-08T16:59:00.143",
   "modified": "2026-06-17T00:47:26.883",
   "severity": "critical",
   "summary": "Multiple unspecified vulnerabilities in HPE Integrated Lights-Out 3 (aka iLO 3) firmware before 1.88, Integrated Lights-Out 4 (aka iLO 4) firmware before 2.44, and Integrated Lights-Out 4 (aka iLO 4) mRCA firmware before 2.32 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_3_firmware",
     "eq": "1.87"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "eq": "2.43"
    },
    {
     "product": "integrated_lights-out_4_mrca_firmware",
     "eq": "2.31"
    }
   ],
   "products": [
    "hp:integrated_lights-out_3",
    "hp:integrated_lights-out_3_firmware",
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_4_firmware",
    "hp:integrated_lights-out_4_mrca_firmware"
   ]
  },
  "CVE-2016-4379": {
   "cvss": 3.7,
   "cvss_version": "3.0",
   "epss": 0.01647,
   "epss_date": "2026-10-28",
   "published": "2016-09-08T16:59:01.797",
   "modified": "2026-06-17T00:47:27.387",
   "severity": "low",
   "summary": "The TLS implementation in HPE Integrated Lights-Out 3 (aka iLO3) firmware before 1.88 does not properly use a MAC protection mechanism in conjunction with CBC padding, which allows remote attackers to obtain sensitive information via a padding-oracle attack, aka a Vaudenay attack.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_3_firmware",
     "versionEndIncluding": "1.87"
    }
   ],
   "products": [
    "hp:integrated_lights-out_3",
    "hp:integrated_lights-out_3_firmware"
   ]
  },
  "CVE-2016-5685": {
   "cvss": 8.8,
   "cvss_version": "3.0",
   "epss": 0.01757,
   "epss_date": "2026-10-28",
   "published": "2016-11-29T15:59:00.200",
   "modified": "2026-06-17T00:49:52.347",
   "severity": "high",
   "summary": "Dell iDRAC7 and iDRAC8 devices with firmware before 2.40.40.40 allow authenticated users to gain Bash shell access through a string injection.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac7_firmware",
     "versionEndIncluding": "2.30.30.30"
    },
    {
     "product": "idrac8_firmware",
     "versionEndIncluding": "2.30.30.30"
    }
   ],
   "products": [
    "dell:idrac7",
    "dell:idrac7_firmware",
    "dell:idrac8",
    "dell:idrac8_firmware"
   ]
  },
  "CVE-2017-12542": {
   "cvss": 10,
   "cvss_version": "3.0",
   "epss": 0.99294,
   "epss_date": "2026-10-28",
   "fixed_in": "2.53",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2017-12542",
   "published": "2018-02-15T22:29:04.263",
   "modified": "2026-06-17T01:03:28.647",
   "severity": "critical",
   "summary": "A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4_firmware",
     "versionEndExcluding": "2.53"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_4_firmware"
   ]
  },
  "CVE-2017-8979": {
   "cvss": 9.8,
   "cvss_version": "3.0",
   "epss": 0.04822,
   "epss_date": "2026-10-28",
   "published": "2018-02-15T22:29:09.293",
   "modified": "2026-06-17T01:27:18.370",
   "severity": "critical",
   "summary": "Security vulnerabilities in the HPE Integrated Lights-Out 2 (iLO 2) firmware could be exploited remotely to allow authentication bypass, code execution, and denial of service.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_2_firmware",
     "eq": "2.29"
    }
   ],
   "products": [
    "hp:integrated_lights-out",
    "hp:integrated_lights-out_2_firmware"
   ]
  },
  "CVE-2017-8987": {
   "cvss": 8.6,
   "cvss_version": "3.0",
   "epss": 0.0555,
   "epss_date": "2026-10-28",
   "published": "2018-08-06T20:29:00.943",
   "modified": "2026-06-17T01:27:19.107",
   "severity": "high",
   "summary": "A Unauthenticated Remote Denial of Service vulnerability was identified in HPE Integrated Lights-Out 3 (iLO 3) version v1.88 only. The vulnerability is resolved in iLO3 v1.89 or subsequent versions.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_3_firmware",
     "eq": "1.88"
    }
   ],
   "products": [
    "hp:integrated_lights-out",
    "hp:integrated_lights-out_3_firmware"
   ]
  },
  "CVE-2018-1207": {
   "cvss": 9.8,
   "cvss_version": "3.0",
   "epss": 0.90091,
   "epss_date": "2026-10-28",
   "fixed_in": "2.52.52.52",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2018-1207",
   "published": "2018-03-23T14:29:00.277",
   "modified": "2026-06-17T01:50:42.383",
   "severity": "critical",
   "summary": "Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code. A remote unauthenticated attacker may potentially be able to use CGI variables to execute remote code.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "emc_idrac7",
     "versionEndExcluding": "2.52.52.52"
    },
    {
     "product": "emc_idrac8",
     "versionEndExcluding": "2.52.52.52"
    }
   ],
   "products": [
    "dell:emc_idrac7",
    "dell:emc_idrac8"
   ]
  },
  "CVE-2018-1211": {
   "cvss": 7.5,
   "cvss_version": "3.0",
   "epss": 0.03196,
   "epss_date": "2026-10-28",
   "fixed_in": "2.52.52.52",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2018-1211",
   "published": "2018-03-23T14:29:00.353",
   "modified": "2026-06-17T01:50:42.557",
   "severity": "high",
   "summary": "Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain a path traversal vulnerability in its Web server's URI parser which could be used to obtain specific sensitive data without authentication. A remote unauthenticated attacker may be able to read configuration settings from the iDRAC by querying specific URI strings.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "emc_idrac7",
     "versionEndExcluding": "2.52.52.52"
    },
    {
     "product": "emc_idrac8",
     "versionEndExcluding": "2.52.52.52"
    }
   ],
   "products": [
    "dell:emc_idrac7",
    "dell:emc_idrac8"
   ]
  },
  "CVE-2018-1212": {
   "cvss": 8.8,
   "cvss_version": "3.0",
   "epss": 0.04335,
   "epss_date": "2026-10-28",
   "fixed_in": "2.91",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2018-1212",
   "published": "2018-07-02T17:29:00.257",
   "modified": "2026-06-17T01:50:42.667",
   "severity": "high",
   "summary": "The web-based diagnostics console in Dell EMC iDRAC6 (Monolithic versions prior to 2.91 and Modular all versions) contains a command injection vulnerability. A remote authenticated malicious iDRAC user with access to the diagnostics console could potentially exploit this vulnerability to execute arbitrary commands as root on the affected iDRAC system.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac6_monolithic",
     "versionEndExcluding": "2.91"
    }
   ],
   "products": [
    "dell:idrac6_modular",
    "dell:idrac6_monolithic"
   ]
  },
  "CVE-2018-1243": {
   "cvss": 7.5,
   "cvss_version": "3.0",
   "epss": 0.01818,
   "epss_date": "2026-10-28",
   "published": "2018-07-02T17:29:00.347",
   "modified": "2026-06-17T01:50:48.173",
   "severity": "high",
   "summary": "Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers to perform bruteforce session guessing attacks.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac6_firmware",
     "versionEndExcluding": "2.91"
    },
    {
     "product": "idrac7_firmware",
     "versionEndExcluding": "2.60.60.60"
    },
    {
     "product": "idrac8_firmware",
     "versionEndExcluding": "2.60.60.60"
    },
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "3.21.21.21"
    }
   ],
   "products": [
    "dell:idrac6_firmware",
    "dell:idrac7_firmware",
    "dell:idrac8_firmware",
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2018-1244": {
   "cvss": 8.8,
   "cvss_version": "3.0",
   "epss": 0.03428,
   "epss_date": "2026-10-28",
   "published": "2018-07-02T17:29:00.380",
   "modified": "2026-06-17T01:50:48.300",
   "severity": "high",
   "summary": "Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A remote authenticated malicious iDRAC user with configuration privileges could potentially exploit this vulnerability to execute arbitrary commands on the iDRAC where SNMP alerting is enabled.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac7_firmware",
     "versionEndExcluding": "2.60.60.60"
    },
    {
     "product": "idrac8_firmware",
     "versionEndExcluding": "2.60.60.60"
    },
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "3.21.21.21"
    }
   ],
   "products": [
    "dell:idrac7_firmware",
    "dell:idrac8_firmware",
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2018-1249": {
   "cvss": 5.9,
   "cvss_version": "3.0",
   "epss": 0.00891,
   "epss_date": "2026-10-28",
   "fixed_in": "3.21.21.21",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2018-1249",
   "published": "2018-07-02T17:29:00.427",
   "modified": "2026-06-17T01:50:48.917",
   "severity": "medium",
   "summary": "Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "3.21.21.21"
    }
   ],
   "products": [
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2018-15774": {
   "cvss": 8.8,
   "cvss_version": "3.0",
   "epss": 0.00941,
   "epss_date": "2026-10-28",
   "published": "2018-12-13T22:29:00.327",
   "modified": "2026-06-17T01:43:05.840",
   "severity": "high",
   "summary": "Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability. An authenticated malicious iDRAC user with operator privileges could potentially exploit a permissions check flaw in the Redfish interface to gain administrator access.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac7_firmware",
     "versionEndExcluding": "2.61.60.60"
    },
    {
     "product": "idrac8_firmware",
     "versionEndExcluding": "2.61.60.60"
    },
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "3.20.21.20"
    },
    {
     "product": "idrac9_firmware",
     "versionStartIncluding": "3.21.21.21",
     "versionEndExcluding": "3.21.24.22"
    }
   ],
   "products": [
    "dell:idrac7_firmware",
    "dell:idrac8_firmware",
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2018-15776": {
   "cvss": 6.8,
   "cvss_version": "3.0",
   "epss": 0.00416,
   "epss_date": "2026-10-28",
   "fixed_in": "2.61.60.60",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2018-15776",
   "published": "2018-12-13T22:29:00.377",
   "modified": "2026-06-17T01:43:06.000",
   "severity": "medium",
   "summary": "Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac7_firmware",
     "versionEndExcluding": "2.61.60.60"
    },
    {
     "product": "idrac8_firmware",
     "versionEndExcluding": "2.61.60.60"
    }
   ],
   "products": [
    "dell:idrac7_firmware",
    "dell:idrac8_firmware"
   ]
  },
  "CVE-2018-7078": {
   "cvss": 7.2,
   "cvss_version": "3.0",
   "epss": 0.07033,
   "epss_date": "2026-10-28",
   "published": "2018-08-06T20:29:02.163",
   "modified": "2026-06-17T02:02:38.107",
   "severity": "high",
   "summary": "A remote code execution was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than version v2.60 and HPE Integrated Lights-Out 5 (iLO 5) earlier than version v1.30.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4_firmware",
     "versionEndExcluding": "2.60"
    },
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "1.30"
    }
   ],
   "products": [
    "hp:integrated_lights-out",
    "hp:integrated_lights-out_4_firmware",
    "hp:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2018-7093": {
   "cvss": 8.6,
   "cvss_version": "3.0",
   "epss": 0.03081,
   "epss_date": "2026-10-28",
   "published": "2018-08-14T14:29:00.510",
   "modified": "2026-06-17T02:02:39.200",
   "severity": "high",
   "summary": "A security vulnerability in HPE Integrated Lights-Out 3 prior to v1.90, iLO 4 prior to v2.60, iLO 5 prior to v1.30, Moonshot Chassis Manager firmware prior to v1.58, and Moonshot Component Pack prior to v2.55 could be remotely exploited to create a denial of service.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_3_firmware",
     "versionEndExcluding": "1.90"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "versionEndExcluding": "2.60"
    },
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "1.30"
    }
   ],
   "products": [
    "hp:integrated_lights-out",
    "hp:integrated_lights-out_3_firmware",
    "hp:integrated_lights-out_4_firmware",
    "hp:integrated_lights-out_5_firmware",
    "hp:moonshot_chassis_manager_firmware",
    "hp:moonshot_component_pack",
    "hp:moonshot_component_pack_firmware"
   ]
  },
  "CVE-2018-7101": {
   "cvss": 7.5,
   "cvss_version": "3.0",
   "epss": 0.0715,
   "epss_date": "2026-10-28",
   "published": "2018-09-27T18:29:00.300",
   "modified": "2026-06-17T02:02:40.007",
   "severity": "high",
   "summary": "A potential remote denial of service security vulnerability has been identified in HPE Integrated Lights Out 4 prior to v2.60 and iLO 5 for Gen 10 servers prior to v1.30.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4_firmware",
     "versionEndExcluding": "2.60"
    },
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "1.30"
    }
   ],
   "products": [
    "hp:integrated_lights-out",
    "hp:integrated_lights-out_4_firmware",
    "hp:integrated_lights-out_5_firmware",
    "hp:proliant_bl460c_gen10_server",
    "hp:proliant_dl120_gen10_server",
    "hp:proliant_dl160_gen10_server",
    "hp:proliant_dl180_gen10_server",
    "hp:proliant_dl360_gen10_server",
    "hp:proliant_dl380_gen10_server",
    "hp:proliant_dl385_gen10_server",
    "hp:proliant_dl560_gen10_server",
    "hp:proliant_dl580_gen10_server"
   ]
  },
  "CVE-2018-7105": {
   "cvss": 7.2,
   "cvss_version": "3.0",
   "epss": 0.04114,
   "epss_date": "2026-10-28",
   "published": "2018-09-27T18:29:00.800",
   "modified": "2026-06-17T02:02:40.407",
   "severity": "high",
   "summary": "A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers prior to v1.35, HPE Integrated Lights-Out 4 (iLO 4) prior to v2.61, HPE Integrated Lights-Out 3 (iLO 3) prior to v1.90 could be remotely exploited to execute arbitrary code leading to disclosure of information.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "1.35"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "versionEndExcluding": "1.90"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "versionEndExcluding": "2.61"
    }
   ],
   "products": [
    "hp:gen_10_servers",
    "hp:integrated_lights-out",
    "hp:integrated_lights-out_3_firmware",
    "hp:integrated_lights-out_4_firmware",
    "hp:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2018-7112": {
   "cvss": 5.5,
   "cvss_version": "3.0",
   "epss": 0.00668,
   "epss_date": "2026-10-28",
   "published": "2018-12-03T15:29:00.383",
   "modified": "2026-06-17T02:02:41.023",
   "severity": "medium",
   "summary": "The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. This issue was resolved in previously provided firmware updates as follows. The HPE Windows firmware installer was updated in the system ROM updates which also addressed the original Spectre/Meltdown set of vulnerabilities. At that time, the Windows firmware installer was also updated in the versions of HPE Integrated Lights-Out 2, 3, and 4 (iLO 2, 3, and 4) listed in the security bulletin. The updated HPE Windows firmware installer was released in the...",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_2_firmware",
     "versionEndExcluding": "2.33"
    },
    {
     "product": "integrated_lights-out_3_firmware",
     "versionEndExcluding": "1.90"
    },
    {
     "product": "integrated_lights-out_4_firmware",
     "versionEndExcluding": "2.60"
    }
   ],
   "products": [
    "hp:integrated_lights-out",
    "hp:integrated_lights-out_2",
    "hp:integrated_lights-out_2_firmware",
    "hp:integrated_lights-out_3_firmware",
    "hp:integrated_lights-out_4_firmware",
    "hp:proliant_gen6_server",
    "hp:proliant_gen7_server",
    "hp:proliant_gen8_server",
    "hp:proliant_xl740f_gen9_server",
    "hp:proliant_xl740f_gen9_server_firmware",
    "hp:proliant_xl750f_gen9_server",
    "hp:proliant_xl750f_gen9_server_firmware"
   ]
  },
  "CVE-2018-7113": {
   "cvss": 6.6,
   "cvss_version": "3.0",
   "epss": 0.00744,
   "epss_date": "2026-10-28",
   "fixed_in": "1.37",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2018-7113",
   "published": "2018-12-03T15:29:00.620",
   "modified": "2026-06-17T02:02:41.300",
   "severity": "medium",
   "summary": "A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) prior to v1.37 could be locally exploited to bypass the security restrictions for firmware updates.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "1.37"
    }
   ],
   "products": [
    "hp:gen_10_servers",
    "hp:integrated_lights-out",
    "hp:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2018-7117": {
   "cvss": 6.1,
   "cvss_version": "3.0",
   "epss": 0.01295,
   "epss_date": "2026-10-28",
   "fixed_in": "1.40",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2018-7117",
   "published": "2019-04-09T19:29:01.633",
   "modified": "2026-06-17T02:02:41.727",
   "severity": "medium",
   "summary": "A remote Cross-Site Scripting in HPE iLO 5 Web User Interface vulnerability was identified in HPE Integrated Lights-Out 5 (iLO 5) for Gen10 ProLiant Servers earlier than version v1.40.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "1.40"
    }
   ],
   "products": [
    "hp:integrated_lights-out_5_firmware",
    "hp:proliant_bl460c_gen10",
    "hp:proliant_dl120_gen10",
    "hp:proliant_dl160_gen10",
    "hp:proliant_dl180_gen10",
    "hp:proliant_dl20_gen10",
    "hp:proliant_dl325_gen10",
    "hp:proliant_dl360_gen10",
    "hp:proliant_dl380_gen10",
    "hp:proliant_dl385_gen10",
    "hp:proliant_dl560_gen10",
    "hp:proliant_dl580_gen10"
   ]
  },
  "CVE-2019-11982": {
   "cvss": 8.3,
   "cvss_version": "3.0",
   "epss": 0.02094,
   "epss_date": "2026-10-28",
   "published": "2019-06-05T17:29:00.227",
   "modified": "2026-06-17T02:13:57.437",
   "severity": "high",
   "summary": "A remote cross site scripting vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndIncluding": "1.39"
    }
   ],
   "products": [
    "hp:integrated_lights-out_5_firmware",
    "hp:proliant_bl460c_gen10",
    "hp:proliant_dl120_gen10",
    "hp:proliant_dl160_gen10",
    "hp:proliant_dl180_gen10",
    "hp:proliant_dl20_gen10",
    "hp:proliant_dl325_gen10",
    "hp:proliant_dl360_gen10",
    "hp:proliant_dl380_gen10",
    "hp:proliant_dl385_gen10",
    "hp:proliant_dl560_gen10",
    "hp:proliant_dl580_gen10"
   ]
  },
  "CVE-2019-11983": {
   "cvss": 7,
   "cvss_version": "3.0",
   "epss": 0.01102,
   "epss_date": "2026-10-28",
   "published": "2019-06-05T17:29:00.257",
   "modified": "2026-06-17T02:13:57.553",
   "severity": "high",
   "summary": "A remote buffer overflow vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndIncluding": "1.39"
    }
   ],
   "products": [
    "hp:integrated_lights-out_5_firmware",
    "hp:proliant_bl460c_gen10",
    "hp:proliant_dl120_gen10",
    "hp:proliant_dl160_gen10",
    "hp:proliant_dl180_gen10",
    "hp:proliant_dl20_gen10",
    "hp:proliant_dl325_gen10",
    "hp:proliant_dl360_gen10",
    "hp:proliant_dl380_gen10",
    "hp:proliant_dl385_gen10",
    "hp:proliant_dl560_gen10",
    "hp:proliant_dl580_gen10"
   ]
  },
  "CVE-2019-16649": {
   "cvss": 10,
   "cvss_version": "3.1",
   "epss": 0.00927,
   "epss_date": "2026-10-28",
   "published": "2019-09-21T02:15:11.523",
   "modified": "2026-06-17T02:22:29.393",
   "severity": "critical",
   "summary": "On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the server managed by the BMC.",
   "vendors": [
    "supermicro"
   ],
   "ranges": [
    {
     "product": "x11dai-n_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dac_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dph-tq_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dph-i_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dph-t_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dps-re_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dsf-e_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dsn-ts_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dsn-tsq_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dsc\\+_firmware",
     "eq": "1.74"
    },
    {
     "product": "x11ddw-nt_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11ddw-l_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dgq_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dpff-sn_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dpfr-sn_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dpfr-s_firmware",
     "eq": "1.71.5"
    }
   ],
   "products": [
    "supermicro:x11dac",
    "supermicro:x11dac_firmware",
    "supermicro:x11dai-n",
    "supermicro:x11dai-n_firmware",
    "supermicro:x11dph-i",
    "supermicro:x11dph-i_firmware",
    "supermicro:x11dph-t",
    "supermicro:x11dph-t_firmware",
    "supermicro:x11dph-tq",
    "supermicro:x11dph-tq_firmware",
    "supermicro:x11dps-re",
    "supermicro:x11dps-re_firmware"
   ]
  },
  "CVE-2019-16650": {
   "cvss": 10,
   "cvss_version": "3.1",
   "epss": 0.02163,
   "epss_date": "2026-10-28",
   "published": "2019-09-21T02:15:11.587",
   "modified": "2026-06-17T02:22:29.890",
   "severity": "critical",
   "summary": "On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC.",
   "vendors": [
    "supermicro"
   ],
   "ranges": [
    {
     "product": "x11dai-n_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dac_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dph-tq_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dph-i_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dph-t_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dps-re_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dsf-e_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dsn-ts_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dsn-tsq_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dsc\\+_firmware",
     "eq": "1.74"
    },
    {
     "product": "x11ddw-nt_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11ddw-l_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dgq_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dpff-sn_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dpfr-sn_firmware",
     "eq": "1.71.5"
    },
    {
     "product": "x11dpfr-s_firmware",
     "eq": "1.71.5"
    }
   ],
   "products": [
    "supermicro:x11dac",
    "supermicro:x11dac_firmware",
    "supermicro:x11dai-n",
    "supermicro:x11dai-n_firmware",
    "supermicro:x11dph-i",
    "supermicro:x11dph-i_firmware",
    "supermicro:x11dph-t",
    "supermicro:x11dph-t_firmware",
    "supermicro:x11dph-tq",
    "supermicro:x11dph-tq_firmware",
    "supermicro:x11dps-re",
    "supermicro:x11dps-re_firmware"
   ]
  },
  "CVE-2019-16884": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.04409,
   "epss_date": "2026-10-28",
   "published": "2019-09-25T18:15:13.057",
   "modified": "2026-06-17T02:22:53.837",
   "severity": "high",
   "summary": "runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionStartIncluding": "0.0.1",
     "versionEndIncluding": "0.1.1"
    },
    {
     "product": "runc",
     "eq": "1.0.0"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2019-19921": {
   "cvss": 7,
   "cvss_version": "3.1",
   "epss": 0.00433,
   "epss_date": "2026-10-28",
   "published": "2020-02-12T15:15:12.210",
   "modified": "2026-06-17T02:27:27.390",
   "severity": "high",
   "summary": "runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndIncluding": "0.1.1"
    },
    {
     "product": "runc",
     "eq": "1.0.0"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2019-3705": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.04173,
   "epss_date": "2026-10-28",
   "published": "2019-04-26T19:29:00.527",
   "modified": "2026-06-17T02:35:25.347",
   "severity": "critical",
   "summary": "Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to crash the webserver or execute arbitrary code on the system with privileges of the webserver by sending specially crafted input data to the affected system.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac6_firmware",
     "versionEndExcluding": "2.92"
    },
    {
     "product": "idrac7_firmware",
     "versionEndExcluding": "2.61.60.60"
    },
    {
     "product": "idrac8_firmware",
     "versionEndExcluding": "2.61.60.60"
    },
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "3.20.21.20"
    }
   ],
   "products": [
    "dell:idrac6_firmware",
    "dell:idrac7_firmware",
    "dell:idrac8_firmware",
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2019-3706": {
   "cvss": 9.8,
   "cvss_version": "3.0",
   "epss": 0.03308,
   "epss_date": "2026-10-28",
   "published": "2019-04-26T19:29:00.587",
   "modified": "2026-06-17T02:35:25.460",
   "severity": "critical",
   "summary": "Dell EMC iDRAC9 versions prior to 3.24.24.24, 3.21.26.22, 3.22.22.22 and 3.21.25.22 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending specially crafted data to the iDRAC web interface.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "eq": "3.20.21.20"
    },
    {
     "product": "idrac9_firmware",
     "eq": "3.21.24.22"
    },
    {
     "product": "idrac9_firmware",
     "eq": "3.23.23.23"
    }
   ],
   "products": [
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2019-3707": {
   "cvss": 9.8,
   "cvss_version": "3.0",
   "epss": 0.03308,
   "epss_date": "2026-10-28",
   "fixed_in": "3.30.30.30",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2019-3707",
   "published": "2019-04-26T19:29:00.637",
   "modified": "2026-06-17T02:35:25.570",
   "severity": "critical",
   "summary": "Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending specially crafted input data to the WS-MAN interface.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "3.30.30.30"
    }
   ],
   "products": [
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2019-3764": {
   "cvss": 4.3,
   "cvss_version": "3.1",
   "epss": 0.00882,
   "epss_date": "2026-10-28",
   "published": "2019-11-07T18:15:12.167",
   "modified": "2026-06-17T02:35:33.033",
   "severity": "medium",
   "summary": "Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnerability. A remote authenticated malicious iDRAC user with low privileges may potentially exploit this vulnerability to obtain sensitive information such as password hashes.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac7_firmware",
     "versionEndExcluding": "2.65.65.65"
    },
    {
     "product": "idrac8_firmware",
     "versionEndExcluding": "2.70.70.70"
    },
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "3.36.36.36"
    }
   ],
   "products": [
    "dell:idrac7_firmware",
    "dell:idrac8_firmware",
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2019-4169": {
   "cvss": 9.1,
   "cvss_version": "3.1",
   "epss": 0.0171,
   "epss_date": "2026-10-28",
   "published": "2019-08-26T15:15:13.000",
   "modified": "2026-06-17T02:36:14.110",
   "severity": "critical",
   "summary": "IBM Open Power Firmware OP910 and OP920 could allow access to BMC via IPMI using default OpenBMC password even after BMC password was changed away from the default password. IBM X-Force ID: 158702.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ibm:open_power",
    "ibm:power_system_8335-gtc",
    "ibm:power_system_8335-gtg",
    "ibm:power_system_8335-gth",
    "ibm:power_system_8335-gtw",
    "ibm:power_system_8335-gtx"
   ]
  },
  "CVE-2019-5676": {
   "cvss": 6.7,
   "cvss_version": "3.1",
   "epss": 0.0052,
   "epss_date": "2026-10-28",
   "published": "2019-05-10T21:29:00.583",
   "modified": "2026-06-17T02:38:03.120",
   "severity": "medium",
   "summary": "NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in which it incorrectly loads Windows system DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), leading to escalation of privileges through code execution.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "410",
     "versionEndExcluding": "412.36"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "418",
     "versionEndExcluding": "425.51"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "430",
     "versionEndExcluding": "430.64"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2019-5736": {
   "cvss": 8.6,
   "cvss_version": "3.1",
   "epss": 0.98452,
   "epss_date": "2026-10-28",
   "published": "2019-02-11T19:29:00.297",
   "modified": "2026-06-17T02:38:07.500",
   "severity": "high",
   "summary": "runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndIncluding": "0.1.1"
    },
    {
     "product": "runc",
     "eq": "1.0.0"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2019-6161": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.01384,
   "epss_date": "2026-10-28",
   "published": "2019-09-26T16:15:11.970",
   "modified": "2026-06-17T02:38:42.290",
   "severity": "high",
   "summary": "An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC in firmware versions prior to 1908.M. This vulnerability allows session IDs to be reused, which could provide unauthorized access to the BMC under certain circumstances. This vulnerability does not affect ThinkSystem XCC, System x IMM2, or other BMCs.",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:cp_storage_block",
    "lenovo:cp_storage_block_firmware"
   ]
  },
  "CVE-2019-6187": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.00859,
   "epss_date": "2026-10-28",
   "published": "2019-11-20T02:15:10.787",
   "modified": "2026-06-17T02:38:45.683",
   "severity": "medium",
   "summary": "A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_7x82",
    "lenovo:thinkagile_7y11",
    "lenovo:thinkagile_7y12",
    "lenovo:thinkagile_7y88",
    "lenovo:thinkagile_7y92",
    "lenovo:thinkagile_7z03",
    "lenovo:thinksystem_sd530",
    "lenovo:thinksystem_sd650",
    "lenovo:thinksystem_sn550",
    "lenovo:thinksystem_sn850",
    "lenovo:thinksystem_sr150",
    "lenovo:xclarity_controller"
   ]
  },
  "CVE-2019-6195": {
   "cvss": 4.8,
   "cvss_version": "3.1",
   "epss": 0.00641,
   "epss_date": "2026-10-28",
   "published": "2020-02-14T17:15:13.223",
   "modified": "2026-06-17T02:38:47.093",
   "severity": "medium",
   "summary": "An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and...",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_hx_1000",
    "lenovo:thinkagile_hx_2000",
    "lenovo:thinkagile_hx_3000",
    "lenovo:thinkagile_hx_5000",
    "lenovo:thinkagile_hx_7000",
    "lenovo:thinkagile_vx_1000",
    "lenovo:thinkagile_vx_2000",
    "lenovo:thinkagile_vx_3000",
    "lenovo:thinkagile_vx_5000",
    "lenovo:thinkagile_vx_7000",
    "lenovo:thinksystem_sd530",
    "lenovo:xclarity_controller"
   ]
  },
  "CVE-2020-11483": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.01381,
   "epss_date": "2026-10-28",
   "published": "2020-10-29T04:15:10.593",
   "modified": "2026-06-17T02:50:14.830",
   "severity": "critical",
   "summary": "NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which the firmware includes hard-coded credentials, which may lead to elevation of privileges or information disclosure.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "intel:bmc_firmware",
    "nvidia:dgx-1",
    "nvidia:dgx-2"
   ]
  },
  "CVE-2020-11484": {
   "cvss": 4.9,
   "cvss_version": "3.1",
   "epss": 0.01086,
   "epss_date": "2026-10-28",
   "published": "2020-10-29T04:15:11.013",
   "modified": "2026-06-17T02:50:15.073",
   "severity": "medium",
   "summary": "NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an attacker with administrative privileges can obtain the hash of the BMC/IPMI user password, which may lead to information disclosure.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "intel:bmc_firmware",
    "nvidia:dgx-1"
   ]
  },
  "CVE-2020-11485": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00783,
   "epss_date": "2026-10-28",
   "published": "2020-10-29T04:15:11.297",
   "modified": "2026-06-17T02:50:15.200",
   "severity": "high",
   "summary": "NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery (CSRF) vulnerability in the AMI BMC firmware in which the web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request, which can lead to information disclosure or code execution.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "intel:bmc_firmware",
    "nvidia:dgx-1"
   ]
  },
  "CVE-2020-11486": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.02724,
   "epss_date": "2026-10-28",
   "published": "2020-10-29T04:15:11.390",
   "modified": "2026-06-17T02:50:15.307",
   "severity": "critical",
   "summary": "NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "intel:bmc_firmware",
    "nvidia:dgx-1"
   ]
  },
  "CVE-2020-11487": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.01274,
   "epss_date": "2026-10-28",
   "published": "2020-10-29T04:15:11.467",
   "modified": "2026-06-17T02:50:15.563",
   "severity": "high",
   "summary": "NVIDIA DGX servers, DGX-1 with BMC firmware versions prior to 3.38.30. DGX-2 with BMC firmware versions prior to 1.06.06 and all DGX A100 Servers with all BMC firmware versions, contains a vulnerability in the AMI BMC firmware in which the use of a hard-coded RSA 1024 key with weak ciphers may lead to information disclosure.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "intel:bmc_firmware",
    "nvidia:dgx-1",
    "nvidia:dgx-2",
    "nvidia:dgx_a100"
   ]
  },
  "CVE-2020-11488": {
   "cvss": 6.7,
   "cvss_version": "3.1",
   "epss": 0.00254,
   "epss_date": "2026-10-28",
   "published": "2020-10-29T04:15:11.623",
   "modified": "2026-06-17T02:50:15.737",
   "severity": "medium",
   "summary": "NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which software does not validate the RSA 1024 public key used to verify the firmware signature, which may lead to information disclosure or code execution.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "intel:bmc_firmware",
    "nvidia:dgx-1",
    "nvidia:dgx-2"
   ]
  },
  "CVE-2020-11489": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.01332,
   "epss_date": "2026-10-28",
   "published": "2020-10-29T04:15:11.703",
   "modified": "2026-06-17T02:50:16.077",
   "severity": "high",
   "summary": "NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain a vulnerability in the AMI BMC firmware in which default SNMP community strings are used, which may lead to information disclosure.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "intel:bmc_firmware",
    "nvidia:dgx-1",
    "nvidia:dgx-2"
   ]
  },
  "CVE-2020-11615": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.01263,
   "epss_date": "2026-10-28",
   "published": "2020-10-29T04:15:11.810",
   "modified": "2026-06-17T02:50:29.510",
   "severity": "high",
   "summary": "NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which it uses a hard-coded RC4 cipher key, which may lead to information disclosure.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "intel:bmc_firmware",
    "nvidia:dgx-1"
   ]
  },
  "CVE-2020-11616": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.01332,
   "epss_date": "2026-10-28",
   "published": "2020-10-29T04:15:11.890",
   "modified": "2026-06-17T02:50:29.610",
   "severity": "high",
   "summary": "NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random Number Generator (PRNG) algorithm used in the JSOL package that implements the IPMI protocol is not cryptographically strong, which may lead to information disclosure.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "intel:bmc_firmware",
    "nvidia:dgx-1"
   ]
  },
  "CVE-2020-14156": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.01809,
   "epss_date": "2026-10-28",
   "published": "2020-06-15T18:15:15.207",
   "modified": "2026-06-17T02:54:18.517",
   "severity": "high",
   "summary": "user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "openbmc-project:openbmc"
   ]
  },
  "CVE-2020-15157": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.02299,
   "epss_date": "2026-10-28",
   "fixed_in": "1.2.14",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2020-15157",
   "published": "2020-10-16T17:15:11.870",
   "modified": "2026-06-17T02:56:09.850",
   "severity": "medium",
   "summary": "In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources. Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionStartIncluding": "1.2.0",
     "versionEndExcluding": "1.2.14"
    },
    {
     "product": "containerd",
     "eq": "1.3.0"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2020-15257": {
   "cvss": 5.2,
   "cvss_version": "3.1",
   "epss": 0.03125,
   "epss_date": "2026-10-28",
   "published": "2020-12-01T03:15:11.257",
   "modified": "2026-06-17T02:56:22.470",
   "severity": "medium",
   "summary": "containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the \"host\" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionEndExcluding": "1.3.9"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "1.4.0",
     "versionEndExcluding": "1.4.3"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2020-26198": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.01003,
   "epss_date": "2026-10-28",
   "published": "2020-12-16T16:15:13.883",
   "modified": "2026-06-17T03:07:48.847",
   "severity": "medium",
   "summary": "Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionEndIncluding": "4.32.10.00"
    },
    {
     "product": "idrac9_firmware",
     "eq": "4.40.00.00"
    }
   ],
   "products": [
    "dell:idrac9",
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2020-5344": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.03842,
   "epss_date": "2026-10-28",
   "published": "2020-03-31T22:15:14.760",
   "modified": "2026-06-17T03:21:19.047",
   "severity": "critical",
   "summary": "Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may exploit this vulnerability to crash the affected process or execute arbitrary code on the system by sending specially crafted input data.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac7_firmware",
     "versionEndExcluding": "2.65.65.65"
    },
    {
     "product": "idrac8_firmware",
     "versionEndExcluding": "2.70.70.70"
    },
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "4.00.00.00"
    }
   ],
   "products": [
    "dell:idrac7",
    "dell:idrac7_firmware",
    "dell:idrac8",
    "dell:idrac8_firmware",
    "dell:idrac9",
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2020-5366": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.01808,
   "epss_date": "2026-10-28",
   "fixed_in": "4.20.20.20",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2020-5366",
   "published": "2020-07-09T14:15:10.793",
   "modified": "2026-06-17T03:21:21.750",
   "severity": "medium",
   "summary": "Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability by manipulating input parameters to gain unauthorized read access to the arbitrary files.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "4.20.20.20"
    }
   ],
   "products": [
    "dell:idrac9",
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2020-5966": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00375,
   "epss_date": "2026-10-28",
   "published": "2020-06-25T22:15:11.757",
   "modified": "2026-06-17T03:22:32.163",
   "severity": "high",
   "summary": "NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, in which a NULL pointer is dereferenced, leading to denial of service or potential escalation of privileges.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "392.61"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "418",
     "versionEndExcluding": "426.78"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "440",
     "versionEndExcluding": "443.18"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "451.48"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2020-7202": {
   "cvss": 5.3,
   "cvss_version": "3.1",
   "epss": 0.0149,
   "epss_date": "2026-10-28",
   "published": "2021-01-05T15:15:14.077",
   "modified": "2026-06-17T03:24:30.007",
   "severity": "medium",
   "summary": "A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4) firmware. The vulnerability could be remotely exploited to disclose the serial number and other information.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.76"
    },
    {
     "product": "integrated_lights-out_5",
     "versionEndExcluding": "2.31"
    }
   ],
   "products": [
    "hp:apollo_4200_gen9_server",
    "hp:convergedsystem_cs700",
    "hp:convergedsystem_cs700x",
    "hp:integrated_lights-out_4",
    "hp:proliant_bl420c_gen8_server",
    "hp:proliant_bl460c_gen8_server_blade",
    "hp:proliant_bl460c_gen9_server_blade",
    "hp:proliant_bl465c_gen8_server_blade",
    "hp:proliant_bl660c_gen8_server_blade",
    "hp:proliant_bl660c_gen9_server",
    "hp:proliant_dl120_gen9_server",
    "hp:proliant_dl160_gen8_server"
   ]
  },
  "CVE-2021-1074": {
   "cvss": 7.3,
   "cvss_version": "3.1",
   "epss": 0.00498,
   "epss_date": "2026-10-28",
   "fixed_in": "392.65",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-1074",
   "published": "2021-04-21T23:15:07.633",
   "modified": "2026-06-17T03:30:54.763",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows installer contains a vulnerability where an attacker with local unprivileged system access may be able to replace an application resource with malicious files. This attack requires a user with system administration rights to execute the installer and requires the attacker to replace the files in a very short time window between file integrity validation and execution. Such an attack may lead to code execution, escalation of privileges, denial of service, and information disclosure.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "392.65"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1075": {
   "cvss": 7.3,
   "cvss_version": "3.1",
   "epss": 0.00249,
   "epss_date": "2026-10-28",
   "published": "2021-04-21T23:15:07.667",
   "modified": "2026-06-17T03:30:54.873",
   "severity": "high",
   "summary": "NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the program dereferences a pointer that contains a location for memory that is no longer valid, which may lead to code execution, denial of service, or escalation of privileges. Attacker does not have any control over the information and may conduct limited data modification.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "418",
     "versionEndExcluding": "427.33"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "452.96"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "460",
     "versionEndExcluding": "462.31"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "465",
     "versionEndExcluding": "466.11"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1076": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00347,
   "epss_date": "2026-10-28",
   "published": "2021-04-21T23:15:07.700",
   "modified": "2026-06-17T03:30:54.980",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys or nvidia.ko) where improper access control may lead to denial of service, information disclosure, or data corruption.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.143"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "418",
     "versionEndExcluding": "418.197.02"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "418",
     "versionEndExcluding": "427.33"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.119.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "452.96"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "460",
     "versionEndExcluding": "460.73.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "460",
     "versionEndExcluding": "462.31"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "465",
     "versionEndExcluding": "465.24.02"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "465",
     "versionEndExcluding": "466.11"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1077": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00277,
   "epss_date": "2026-10-28",
   "published": "2021-04-21T23:15:07.733",
   "modified": "2026-06-17T03:30:55.090",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux, R450 and R460 driver branch, contains a vulnerability where the software uses a reference count to manage a resource that is incorrectly updated, which may lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.119.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "452.96"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "460",
     "versionEndExcluding": "460.73.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "460",
     "versionEndExcluding": "462.31"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1078": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00219,
   "epss_date": "2026-10-28",
   "published": "2021-04-21T23:15:07.767",
   "modified": "2026-06-17T03:30:55.197",
   "severity": "medium",
   "summary": "NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel driver (nvlddmkm.sys) where a NULL pointer dereference may lead to system crash.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "392.65"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "418",
     "versionEndExcluding": "427.33"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "452.96"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "460",
     "versionEndExcluding": "462.31"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "465",
     "versionEndExcluding": "466.11"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1089": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00283,
   "epss_date": "2026-10-28",
   "published": "2021-07-22T05:15:07.497",
   "modified": "2026-06-17T03:30:56.440",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in nvidia-smi where an uncontrolled DLL loading path may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "427.33",
     "versionEndExcluding": "427.48"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "452.96",
     "versionEndExcluding": "453.10"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "462.31",
     "versionEndExcluding": "462.96"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1090": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.00288,
   "epss_date": "2026-10-28",
   "published": "2021-07-22T05:15:07.680",
   "modified": "2026-06-17T03:30:56.550",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for control calls where the software reads or writes to a buffer by using an index or pointer that references a memory location after the end of the buffer, which may lead to data tampering or denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "427.33",
     "versionEndExcluding": "427.48"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "452.96",
     "versionEndExcluding": "453.10"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "462.31",
     "versionEndExcluding": "462.96"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1091": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.0026,
   "epss_date": "2026-10-28",
   "published": "2021-07-22T05:15:07.770",
   "modified": "2026-06-17T03:30:56.660",
   "severity": "high",
   "summary": "NVIDIA GPU Display driver for Windows contains a vulnerability where an unprivileged user can create a file hard link that causes the driver to overwrite a file that requires elevated privilege to modify, which could lead to data loss or denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "427.33",
     "versionEndExcluding": "427.48"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "452.96",
     "versionEndExcluding": "453.10"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "462.31",
     "versionEndExcluding": "462.96"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1092": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.0026,
   "epss_date": "2026-10-28",
   "published": "2021-07-22T05:15:07.857",
   "modified": "2026-06-17T03:30:56.763",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the NVIDIA Control Panel application where it is susceptible to a Windows file system symbolic link attack where an unprivileged attacker can cause the applications to overwrite privileged files, resulting in potential denial of service or data loss.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "427.33",
     "versionEndExcluding": "427.48"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "452.96",
     "versionEndExcluding": "453.10"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "462.31",
     "versionEndExcluding": "462.96"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1093": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00351,
   "epss_date": "2026-10-28",
   "published": "2021-07-22T05:15:07.937",
   "modified": "2026-06-17T03:30:56.867",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in firmware where the driver contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary, and may lead to denial of service or system crash.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "418.197.02",
     "versionEndExcluding": "418.211.00"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "427.33",
     "versionEndExcluding": "427.48"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450.119.03",
     "versionEndExcluding": "450.142.00"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "452.96",
     "versionEndExcluding": "453.10"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "460.73.01",
     "versionEndExcluding": "460.91.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "462.31",
     "versionEndExcluding": "462.96"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1094": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00338,
   "epss_date": "2026-10-28",
   "published": "2021-07-22T05:15:08.023",
   "modified": "2026-06-17T03:30:56.973",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where an out of bounds array access may lead to denial of service or information disclosure.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "418.197.02",
     "versionEndExcluding": "418.211.00"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "427.33",
     "versionEndExcluding": "427.48"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450.119.03",
     "versionEndExcluding": "450.142.00"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "452.96",
     "versionEndExcluding": "453.10"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "460.73.01",
     "versionEndExcluding": "460.91.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "462.31",
     "versionEndExcluding": "462.96"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1095": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00398,
   "epss_date": "2026-10-28",
   "published": "2021-07-22T05:15:08.113",
   "modified": "2026-06-17T03:30:57.087",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handlers for all control calls with embedded parameters where dereferencing an untrusted pointer may lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "418.197.02",
     "versionEndExcluding": "418.211.00"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "427.33",
     "versionEndExcluding": "427.48"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450.119.03",
     "versionEndExcluding": "450.142.00"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "452.96",
     "versionEndExcluding": "453.10"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "460.73.01",
     "versionEndExcluding": "460.91.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "462.31",
     "versionEndExcluding": "462.96"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1096": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00264,
   "epss_date": "2026-10-28",
   "published": "2021-07-22T05:15:08.200",
   "modified": "2026-06-17T03:30:57.203",
   "severity": "medium",
   "summary": "NVIDIA Windows GPU Display Driver for Windows contains a vulnerability in the NVIDIA kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where dereferencing a NULL pointer may lead to a system crash.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "427.33",
     "versionEndExcluding": "427.48"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "452.96",
     "versionEndExcluding": "453.10"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "462.31",
     "versionEndExcluding": "462.96"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1115": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.00208,
   "epss_date": "2026-10-28",
   "published": "2021-10-27T21:15:07.427",
   "modified": "2026-06-17T03:30:59.307",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs, where an attacker with local unprivileged system access may cause a NULL pointer dereference, which may lead to denial of service in a component beyond the vulnerable component.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "392.68"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "460",
     "versionEndExcluding": "463.15"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "472.39"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "490",
     "versionEndExcluding": "496.49"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1116": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00219,
   "epss_date": "2026-10-28",
   "published": "2021-10-27T21:15:07.497",
   "modified": "2026-06-17T03:30:59.417",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a NULL pointer dereference in the kernel, created within user mode code, may lead to a denial of service in the form of a system crash.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "392.68"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "460",
     "versionEndExcluding": "463.15"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "472.39"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "490",
     "versionEndExcluding": "496.49"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-1117": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00191,
   "epss_date": "2026-10-28",
   "published": "2021-10-27T21:15:07.553",
   "modified": "2026-06-17T03:30:59.520",
   "severity": "medium",
   "summary": "Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an attacker through specific configuration and with local unprivileged system access may cause improper input validation, which may lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "392.68"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "460",
     "versionEndExcluding": "463.15"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "472.39"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "495",
     "versionEndExcluding": "496.49"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2021-21334": {
   "cvss": 6.3,
   "cvss_version": "3.1",
   "epss": 0.01947,
   "epss_date": "2026-10-28",
   "published": "2021-03-10T22:15:12.183",
   "modified": "2026-06-17T03:35:19.197",
   "severity": "medium",
   "summary": "In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionEndExcluding": "1.3.10"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "1.4.0",
     "versionEndExcluding": "1.4.4"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2021-21505": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.02387,
   "epss_date": "2026-10-28",
   "published": "2021-05-06T13:15:11.200",
   "modified": "2026-06-17T03:35:41.523",
   "severity": "critical",
   "summary": "Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC account. A remote unauthenticated attacker, with the knowledge of the default credentials, could potentially exploit this to log in to the system to gain root privileges.",
   "vendors": [
    "idrac"
   ],
   "products": [
    "dell:emc_integrated_system_for_microsoft_azure_stack_hub",
    "dell:emc_integrated_system_for_microsoft_azure_stack_hub_firmware"
   ]
  },
  "CVE-2021-21510": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.01026,
   "epss_date": "2026-10-28",
   "fixed_in": "2.75.100.75",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21510",
   "published": "2021-03-08T22:15:14.080",
   "modified": "2026-06-17T03:35:41.970",
   "severity": "medium",
   "summary": "Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary ‘Host’ header values to poison a web-cache or trigger redirections.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac8_firmware",
     "versionEndExcluding": "2.75.100.75"
    }
   ],
   "products": [
    "dell:idrac8_firmware"
   ]
  },
  "CVE-2021-21538": {
   "cvss": 10,
   "cvss_version": "3.1",
   "epss": 0.01499,
   "epss_date": "2026-10-28",
   "fixed_in": "4.40.10.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21538",
   "published": "2021-07-29T16:15:08.693",
   "modified": "2026-06-17T03:35:44.390",
   "severity": "critical",
   "summary": "Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the virtual console.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionStartIncluding": "4.40.00.00",
     "versionEndExcluding": "4.40.10.00"
    }
   ],
   "products": [
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2021-21539": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.00616,
   "epss_date": "2026-10-28",
   "fixed_in": "4.40.00.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21539",
   "published": "2021-04-30T21:15:08.707",
   "modified": "2026-06-17T03:35:44.497",
   "severity": "high",
   "summary": "Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to gain elevated privileges when a user with higher privileges is simultaneously accessing iDRAC through the web interface.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "4.40.00.00"
    }
   ],
   "products": [
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2021-21540": {
   "cvss": 8.1,
   "cvss_version": "3.1",
   "epss": 0.01155,
   "epss_date": "2026-10-28",
   "fixed_in": "4.40.00.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21540",
   "published": "2021-04-30T21:15:08.740",
   "modified": "2026-06-17T03:35:44.597",
   "severity": "high",
   "summary": "Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to overwrite configuration information by injecting arbitrarily large payload.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "4.40.00.00"
    }
   ],
   "products": [
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2021-21541": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00813,
   "epss_date": "2026-10-28",
   "fixed_in": "4.40.00.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21541",
   "published": "2021-04-30T21:15:08.780",
   "modified": "2026-06-17T03:35:44.700",
   "severity": "medium",
   "summary": "Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "4.40.00.00"
    }
   ],
   "products": [
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2021-21542": {
   "cvss": 4.8,
   "cvss_version": "3.1",
   "epss": 0.00397,
   "epss_date": "2026-10-28",
   "fixed_in": "4.40.00.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21542",
   "published": "2021-04-30T21:15:08.820",
   "modified": "2026-06-17T03:35:44.803",
   "severity": "medium",
   "summary": "Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected while generating a certificate. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "4.40.00.00"
    }
   ],
   "products": [
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2021-21543": {
   "cvss": 4.8,
   "cvss_version": "3.1",
   "epss": 0.00628,
   "epss_date": "2026-10-28",
   "fixed_in": "4.40.00.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21543",
   "published": "2021-04-30T21:15:08.860",
   "modified": "2026-06-17T03:35:44.907",
   "severity": "medium",
   "summary": "Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected parameters. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "4.40.00.00"
    }
   ],
   "products": [
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2021-21544": {
   "cvss": 2.7,
   "cvss_version": "3.1",
   "epss": 0.00921,
   "epss_date": "2026-10-28",
   "fixed_in": "4.40.00.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21544",
   "published": "2021-04-30T21:15:08.900",
   "modified": "2026-06-17T03:35:45.010",
   "severity": "low",
   "summary": "Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to manipulate the username field under the comment section and set the value to any user.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "4.40.00.00"
    }
   ],
   "products": [
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2021-21554": {
   "cvss": 6.7,
   "cvss_version": "3.1",
   "epss": 0.00335,
   "epss_date": "2026-10-28",
   "fixed_in": "2.9.4",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21554",
   "published": "2021-06-14T19:15:08.193",
   "modified": "2026-06-17T03:35:46.170",
   "severity": "medium",
   "summary": "Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and, Dell Precision 7920 Rack Workstation BIOS contain a stack-based buffer overflow vulnerability in systems with Intel Optane DC Persistent Memory installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, arbitrary code execution, or information disclosure in UEFI or BIOS Preboot Environment.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.9.4",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.9.4",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.9.4",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.9.4",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.9.4",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.9.4",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.9.4",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.9.4",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    }
   ],
   "products": [
    "poweredge_mx740c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r640_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r840_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware"
   ]
  },
  "CVE-2021-21555": {
   "cvss": 6.7,
   "cvss_version": "3.1",
   "epss": 0.00314,
   "epss_date": "2026-10-28",
   "fixed_in": "2.11.2",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21555",
   "published": "2021-06-14T19:15:08.273",
   "modified": "2026-06-17T03:35:46.290",
   "severity": "medium",
   "summary": "Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a heap-based buffer overflow vulnerability in systems with NVDIMM-N installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, arbitrary code execution, or information disclosure in UEFI or BIOS Preboot Environment.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_t640_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_t640"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    }
   ],
   "products": [
    "poweredge_mx740c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r640_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r840_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware",
    "poweredge_t640_firmware"
   ]
  },
  "CVE-2021-21556": {
   "cvss": 6.7,
   "cvss_version": "3.1",
   "epss": 0.00306,
   "epss_date": "2026-10-28",
   "fixed_in": "2.11.2",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21556",
   "published": "2021-06-14T19:15:08.353",
   "modified": "2026-06-17T03:35:46.423",
   "severity": "medium",
   "summary": "Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a stack-based buffer overflow vulnerability in systems with NVDIMM-N installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, arbitrary code execution, or information disclosure in UEFI or BIOS Preboot Environment.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_t640_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_t640"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    }
   ],
   "products": [
    "poweredge_mx740c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r640_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r840_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware",
    "poweredge_t640_firmware"
   ]
  },
  "CVE-2021-21557": {
   "cvss": 6.7,
   "cvss_version": "3.1",
   "epss": 0.00346,
   "epss_date": "2026-10-28",
   "published": "2021-06-14T19:15:08.497",
   "modified": "2026-06-17T03:35:46.543",
   "severity": "medium",
   "summary": "Dell PowerEdge Server BIOS and select Dell Precision Rack BIOS contain an out-of-bounds array access vulnerability. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of service, arbitrary code execution, or information disclosure in System Management Mode.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r540_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r540"
     ]
    },
    {
     "product": "poweredge_r440_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r440"
     ]
    },
    {
     "product": "poweredge_t440_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_t440"
     ]
    },
    {
     "product": "poweredge_xr2_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_xr2"
     ]
    },
    {
     "product": "poweredge_r740xd2_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r740xd2"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_t640_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_t640"
     ]
    },
    {
     "product": "poweredge_c6420_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_c6420"
     ]
    },
    {
     "product": "poweredge_fc640_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_fc640"
     ]
    },
    {
     "product": "poweredge_m640_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_m640"
     ]
    },
    {
     "product": "poweredge_m640p_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_m640p"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    },
    {
     "product": "poweredge_c4140_firmware",
     "versionEndExcluding": "2.11.2",
     "platforms": [
      "cpe:dell:poweredge_c4140"
     ]
    },
    {
     "product": "poweredge_t140_firmware",
     "versionEndExcluding": "2.5.1",
     "platforms": [
      "cpe:dell:poweredge_t140"
     ]
    },
    {
     "product": "poweredge_t340_firmware",
     "versionEndExcluding": "2.5.1",
     "platforms": [
      "cpe:dell:poweredge_t340"
     ]
    },
    {
     "product": "poweredge_r240_firmware",
     "versionEndExcluding": "2.5.1",
     "platforms": [
      "cpe:dell:poweredge_r240"
     ]
    },
    {
     "product": "poweredge_r340_firmware",
     "versionEndExcluding": "2.5.1",
     "platforms": [
      "cpe:dell:poweredge_r340"
     ]
    },
    {
     "product": "poweredge_r6415_firmware",
     "versionEndExcluding": "1.16.1",
     "platforms": [
      "cpe:dell:poweredge_r6415"
     ]
    },
    {
     "product": "poweredge_r7415_firmware",
     "versionEndExcluding": "1.16.1",
     "platforms": [
      "cpe:dell:poweredge_r7415"
     ]
    },
    {
     "product": "poweredge_r7425_firmware",
     "versionEndExcluding": "1.16.1",
     "platforms": [
      "cpe:dell:poweredge_r7425"
     ]
    },
    {
     "product": "poweredge_r6515_firmware",
     "versionEndExcluding": "2.2.4",
     "platforms": [
      "cpe:dell:poweredge_r6515"
     ]
    },
    {
     "product": "poweredge_r7515_firmware",
     "versionEndExcluding": "2.2.4",
     "platforms": [
      "cpe:dell:poweredge_r7515"
     ]
    },
    {
     "product": "poweredge_r6525_firmware",
     "versionEndExcluding": "2.2.5",
     "platforms": [
      "cpe:dell:poweredge_r6525"
     ]
    },
    {
     "product": "poweredge_r7525_firmware",
     "versionEndExcluding": "2.2.5",
     "platforms": [
      "cpe:dell:poweredge_r7525"
     ]
    },
    {
     "product": "poweredge_c6525_firmware",
     "versionEndExcluding": "2.2.4",
     "platforms": [
      "cpe:dell:poweredge_c6525"
     ]
    }
   ],
   "products": [
    "poweredge_c4140_firmware",
    "poweredge_c6420_firmware",
    "poweredge_c6525_firmware",
    "poweredge_fc640_firmware",
    "poweredge_m640_firmware",
    "poweredge_m640p_firmware",
    "poweredge_mx740c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r240_firmware",
    "poweredge_r340_firmware",
    "poweredge_r440_firmware",
    "poweredge_r540_firmware",
    "poweredge_r640_firmware",
    "poweredge_r6415_firmware",
    "poweredge_r6515_firmware",
    "poweredge_r6525_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd2_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r7415_firmware",
    "poweredge_r7425_firmware",
    "poweredge_r7515_firmware",
    "poweredge_r7525_firmware",
    "poweredge_r840_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware",
    "poweredge_t140_firmware",
    "poweredge_t340_firmware",
    "poweredge_t440_firmware",
    "poweredge_t640_firmware",
    "poweredge_xr2_firmware"
   ]
  },
  "CVE-2021-21576": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00746,
   "epss_date": "2026-10-28",
   "fixed_in": "4.40.40.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21576",
   "published": "2021-08-03T16:15:07.777",
   "modified": "2026-06-17T03:35:48.930",
   "severity": "medium",
   "summary": "Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "emc_idrac9_firmware",
     "versionEndExcluding": "4.40.40.00"
    }
   ],
   "products": [
    "dell:emc_idrac9_firmware"
   ]
  },
  "CVE-2021-21577": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00746,
   "epss_date": "2026-10-28",
   "fixed_in": "4.40.40.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21577",
   "published": "2021-08-03T16:15:07.867",
   "modified": "2026-06-17T03:35:49.033",
   "severity": "medium",
   "summary": "Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "emc_idrac9_firmware",
     "versionEndExcluding": "4.40.40.00"
    }
   ],
   "products": [
    "dell:emc_idrac9_firmware"
   ]
  },
  "CVE-2021-21578": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00815,
   "epss_date": "2026-10-28",
   "fixed_in": "4.40.40.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21578",
   "published": "2021-08-03T16:15:07.953",
   "modified": "2026-06-17T03:35:49.147",
   "severity": "medium",
   "summary": "Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "emc_idrac9_firmware",
     "versionEndExcluding": "4.40.40.00"
    }
   ],
   "products": [
    "dell:emc_idrac9_firmware"
   ]
  },
  "CVE-2021-21579": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00815,
   "epss_date": "2026-10-28",
   "fixed_in": "4.40.40.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21579",
   "published": "2021-08-03T16:15:08.047",
   "modified": "2026-06-17T03:35:49.250",
   "severity": "medium",
   "summary": "Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "emc_idrac9_firmware",
     "versionEndExcluding": "4.40.40.00"
    }
   ],
   "products": [
    "dell:emc_idrac9_firmware"
   ]
  },
  "CVE-2021-21580": {
   "cvss": 4.3,
   "cvss_version": "3.1",
   "epss": 0.0069,
   "epss_date": "2026-10-28",
   "published": "2021-08-03T16:15:08.213",
   "modified": "2026-06-17T03:35:49.350",
   "severity": "medium",
   "summary": "Dell EMC iDRAC8 versions prior to 2.80.80.80 \u0026 Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL can inject text to present a customized message on the application that can phish users into believing that the message is legitimate.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "emc_idrac8_firmware",
     "versionEndExcluding": "2.80.80.80"
    },
    {
     "product": "emc_idrac9_firmware",
     "versionEndExcluding": "5.00.00.00"
    }
   ],
   "products": [
    "dell:emc_idrac8_firmware",
    "dell:emc_idrac9_firmware"
   ]
  },
  "CVE-2021-21581": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00746,
   "epss_date": "2026-10-28",
   "fixed_in": "5.00.00.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21581",
   "published": "2021-08-03T16:15:08.300",
   "modified": "2026-06-17T03:35:49.463",
   "severity": "medium",
   "summary": "Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "emc_idrac9_firmware",
     "versionEndExcluding": "5.00.00.00"
    }
   ],
   "products": [
    "dell:emc_idrac9_firmware"
   ]
  },
  "CVE-2021-29201": {
   "cvss": 4.8,
   "cvss_version": "3.1",
   "epss": 0.0069,
   "epss_date": "2026-10-28",
   "published": "2021-05-25T14:15:07.570",
   "modified": "2026-06-17T03:47:23.293",
   "severity": "medium",
   "summary": "A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.78"
    },
    {
     "product": "integrated_lights-out_5",
     "versionEndExcluding": "2.44"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_5",
    "hp:proliant_bl460c_gen10_server_blade",
    "hp:proliant_dl120_gen10_server",
    "hp:proliant_dl160_gen10_server",
    "hp:proliant_dl180_gen10_server",
    "hp:proliant_dl20_gen10_server",
    "hp:proliant_dl325_gen10_plus_server",
    "hp:proliant_dl325_gen10_server",
    "hp:proliant_dl360_gen10_server",
    "hp:proliant_dl380_gen10_server",
    "hp:simplivity_380_gen9"
   ]
  },
  "CVE-2021-29202": {
   "cvss": 6.7,
   "cvss_version": "3.1",
   "epss": 0.00286,
   "epss_date": "2026-10-28",
   "published": "2021-05-25T14:15:07.607",
   "modified": "2026-06-17T03:47:23.407",
   "severity": "medium",
   "summary": "A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.78"
    },
    {
     "product": "integrated_lights-out_5",
     "versionEndExcluding": "2.44"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_5",
    "hp:proliant_bl460c_gen10_server_blade",
    "hp:proliant_dl120_gen10_server",
    "hp:proliant_dl160_gen10_server",
    "hp:proliant_dl180_gen10_server",
    "hp:proliant_dl20_gen10_server",
    "hp:proliant_dl325_gen10_plus_server",
    "hp:proliant_dl325_gen10_server",
    "hp:proliant_dl360_gen10_server",
    "hp:proliant_dl380_gen10_server",
    "hp:simplivity_380_gen9"
   ]
  },
  "CVE-2021-29204": {
   "cvss": 4.8,
   "cvss_version": "3.1",
   "epss": 0.00653,
   "epss_date": "2026-10-28",
   "published": "2021-05-25T14:15:07.637",
   "modified": "2026-06-17T03:47:23.623",
   "severity": "medium",
   "summary": "A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.78"
    },
    {
     "product": "integrated_lights-out_5",
     "versionEndExcluding": "2.44"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_5",
    "hp:proliant_bl460c_gen10_server_blade",
    "hp:proliant_dl120_gen10_server",
    "hp:proliant_dl160_gen10_server",
    "hp:proliant_dl180_gen10_server",
    "hp:proliant_dl20_gen10_server",
    "hp:proliant_dl325_gen10_plus_server",
    "hp:proliant_dl325_gen10_server",
    "hp:proliant_dl360_gen10_server",
    "hp:proliant_dl380_gen10_server",
    "hp:simplivity_380_gen9"
   ]
  },
  "CVE-2021-29205": {
   "cvss": 4.8,
   "cvss_version": "3.1",
   "epss": 0.00653,
   "epss_date": "2026-10-28",
   "published": "2021-05-25T14:15:07.663",
   "modified": "2026-06-17T03:47:23.730",
   "severity": "medium",
   "summary": "A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.78"
    },
    {
     "product": "integrated_lights-out_5",
     "versionEndExcluding": "2.44"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_5",
    "hp:proliant_bl460c_gen10_server_blade",
    "hp:proliant_dl120_gen10_server",
    "hp:proliant_dl160_gen10_server",
    "hp:proliant_dl180_gen10_server",
    "hp:proliant_dl20_gen10_server",
    "hp:proliant_dl325_gen10_plus_server",
    "hp:proliant_dl325_gen10_server",
    "hp:proliant_dl360_gen10_server",
    "hp:proliant_dl380_gen10_server",
    "hp:simplivity_380_gen9"
   ]
  },
  "CVE-2021-29206": {
   "cvss": 4.8,
   "cvss_version": "3.1",
   "epss": 0.00653,
   "epss_date": "2026-10-28",
   "published": "2021-05-25T14:15:07.693",
   "modified": "2026-06-17T03:47:23.843",
   "severity": "medium",
   "summary": "A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.78"
    },
    {
     "product": "integrated_lights-out_5",
     "versionEndExcluding": "2.44"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_5",
    "hp:proliant_bl460c_gen10_server_blade",
    "hp:proliant_dl120_gen10_server",
    "hp:proliant_dl160_gen10_server",
    "hp:proliant_dl180_gen10_server",
    "hp:proliant_dl20_gen10_server",
    "hp:proliant_dl325_gen10_plus_server",
    "hp:proliant_dl325_gen10_server",
    "hp:proliant_dl360_gen10_server",
    "hp:proliant_dl380_gen10_server",
    "hp:simplivity_380_gen9"
   ]
  },
  "CVE-2021-29207": {
   "cvss": 4.8,
   "cvss_version": "3.1",
   "epss": 0.00653,
   "epss_date": "2026-10-28",
   "published": "2021-05-25T14:15:07.730",
   "modified": "2026-06-17T03:47:23.957",
   "severity": "medium",
   "summary": "A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.78"
    },
    {
     "product": "integrated_lights-out_5",
     "versionEndExcluding": "2.44"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_5",
    "hp:proliant_bl460c_gen10_server_blade",
    "hp:proliant_dl120_gen10_server",
    "hp:proliant_dl160_gen10_server",
    "hp:proliant_dl180_gen10_server",
    "hp:proliant_dl20_gen10_server",
    "hp:proliant_dl325_gen10_plus_server",
    "hp:proliant_dl325_gen10_server",
    "hp:proliant_dl360_gen10_server",
    "hp:proliant_dl380_gen10_server",
    "hp:simplivity_380_gen9"
   ]
  },
  "CVE-2021-29208": {
   "cvss": 4.8,
   "cvss_version": "3.1",
   "epss": 0.00507,
   "epss_date": "2026-10-28",
   "published": "2021-05-25T15:15:07.417",
   "modified": "2026-06-17T03:47:24.070",
   "severity": "medium",
   "summary": "A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.78"
    },
    {
     "product": "integrated_lights-out_5",
     "versionEndExcluding": "2.44"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_5",
    "hp:proliant_bl460c_gen10_server_blade",
    "hp:proliant_dl120_gen10_server",
    "hp:proliant_dl160_gen10_server",
    "hp:proliant_dl180_gen10_server",
    "hp:proliant_dl20_gen10_server",
    "hp:proliant_dl325_gen10_plus_server",
    "hp:proliant_dl325_gen10_server",
    "hp:proliant_dl360_gen10_server",
    "hp:proliant_dl380_gen10_server",
    "hp:simplivity_380_gen9"
   ]
  },
  "CVE-2021-29209": {
   "cvss": 4.8,
   "cvss_version": "3.1",
   "epss": 0.00507,
   "epss_date": "2026-10-28",
   "published": "2021-05-25T15:15:07.443",
   "modified": "2026-06-17T03:47:24.180",
   "severity": "medium",
   "summary": "A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.78"
    },
    {
     "product": "integrated_lights-out_5",
     "versionEndExcluding": "2.44"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_5",
    "hp:proliant_bl460c_gen10_server_blade",
    "hp:proliant_dl120_gen10_server",
    "hp:proliant_dl160_gen10_server",
    "hp:proliant_dl180_gen10_server",
    "hp:proliant_dl20_gen10_server",
    "hp:proliant_dl325_gen10_plus_server",
    "hp:proliant_dl325_gen10_server",
    "hp:proliant_dl360_gen10_server",
    "hp:proliant_dl380_gen10_server",
    "hp:simplivity_380_gen9"
   ]
  },
  "CVE-2021-29210": {
   "cvss": 4.8,
   "cvss_version": "3.1",
   "epss": 0.00507,
   "epss_date": "2026-10-28",
   "published": "2021-05-25T15:15:07.470",
   "modified": "2026-06-17T03:47:24.300",
   "severity": "medium",
   "summary": "A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.78"
    },
    {
     "product": "integrated_lights-out_5",
     "versionEndExcluding": "2.44"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_5",
    "hp:proliant_bl460c_gen10_server_blade",
    "hp:proliant_dl120_gen10_server",
    "hp:proliant_dl160_gen10_server",
    "hp:proliant_dl180_gen10_server",
    "hp:proliant_dl20_gen10_server",
    "hp:proliant_dl325_gen10_plus_server",
    "hp:proliant_dl325_gen10_server",
    "hp:proliant_dl360_gen10_server",
    "hp:proliant_dl380_gen10_server",
    "hp:simplivity_380_gen9"
   ]
  },
  "CVE-2021-29211": {
   "cvss": 4.8,
   "cvss_version": "3.1",
   "epss": 0.00644,
   "epss_date": "2026-10-28",
   "published": "2021-05-25T15:15:07.497",
   "modified": "2026-06-17T03:47:24.413",
   "severity": "medium",
   "summary": "A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.78"
    },
    {
     "product": "integrated_lights-out_5",
     "versionEndExcluding": "2.44"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hp:integrated_lights-out_5",
    "hp:proliant_bl460c_gen10_server_blade",
    "hp:proliant_dl120_gen10_server",
    "hp:proliant_dl160_gen10_server",
    "hp:proliant_dl180_gen10_server",
    "hp:proliant_dl20_gen10_server",
    "hp:proliant_dl325_gen10_plus_server",
    "hp:proliant_dl325_gen10_server",
    "hp:proliant_dl360_gen10_server",
    "hp:proliant_dl380_gen10_server",
    "hp:simplivity_380_gen9"
   ]
  },
  "CVE-2021-29891": {
   "cvss": 4.9,
   "cvss_version": "3.1",
   "epss": 0.0046,
   "epss_date": "2026-10-28",
   "published": "2022-08-22T20:15:08.410",
   "modified": "2026-06-17T03:48:25.733",
   "severity": "medium",
   "summary": "IBM OPENBMC OP910 and OP940 could allow a privileged user to upload an improper site identity certificate that may cause it to lose network services. IBM X-Force ID: 207221.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ibm:hardware_management_console_7063-cr2",
    "ibm:hardware_management_console_7063-cr2_firmware",
    "ibm:power_system_ac922_\\(8335-gtg\\)",
    "ibm:power_system_ac922_\\(8335-gtg\\)_firmware",
    "ibm:power_system_ac922_\\(8335-gth\\)",
    "ibm:power_system_ac922_\\(8335-gth\\)_firmware",
    "ibm:power_system_ac922_\\(8335-gtx\\)",
    "ibm:power_system_ac922_\\(8335-gtx\\)_firmware"
   ]
  },
  "CVE-2021-30465": {
   "cvss": 8.5,
   "cvss_version": "3.1",
   "epss": 0.10245,
   "epss_date": "2026-10-28",
   "published": "2021-05-27T13:15:08.077",
   "modified": "2026-06-17T03:50:17.630",
   "severity": "high",
   "summary": "runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndIncluding": "0.1.1"
    },
    {
     "product": "runc",
     "eq": "1.0.0"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2021-32760": {
   "cvss": 6.3,
   "cvss_version": "3.1",
   "epss": 0.01595,
   "epss_date": "2026-10-28",
   "published": "2021-07-19T21:15:07.857",
   "modified": "2026-06-17T03:53:34.420",
   "severity": "medium",
   "summary": "containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionEndExcluding": "1.4.8"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "1.5.0",
     "versionEndExcluding": "1.5.4"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2021-34398": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00261,
   "epss_date": "2026-10-28",
   "fixed_in": "2.2.9",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-34398",
   "published": "2021-08-13T16:15:07.540",
   "modified": "2026-06-17T03:55:47.057",
   "severity": "high",
   "summary": "NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module where any user can inject shared libraries into the DCGM server, which is usually running as root, which may lead to privilege escalation, total loss of confidentiality and integrity, and complete denial of service.",
   "vendors": [
    "nvidia-dcgm"
   ],
   "ranges": [
    {
     "product": "data_center_gpu_manager",
     "versionEndExcluding": "2.2.9"
    }
   ],
   "products": [
    "data_center_gpu_manager"
   ]
  },
  "CVE-2021-3473": {
   "cvss": 4.9,
   "cvss_version": "3.1",
   "epss": 0.00478,
   "epss_date": "2026-10-28",
   "published": "2021-04-13T21:15:25.410",
   "modified": "2026-06-17T04:05:10.040",
   "severity": "medium",
   "summary": "An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only acc...",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_hx1320",
    "lenovo:thinkagile_hx2320",
    "lenovo:thinkagile_hx3320",
    "lenovo:thinkagile_hx3375",
    "lenovo:thinkagile_hx3520-g",
    "lenovo:thinkagile_hx3720",
    "lenovo:thinkagile_hx5520",
    "lenovo:thinkagile_hx7520",
    "lenovo:thinkagile_hx7820",
    "lenovo:thinkagile_mx_certified_nodes",
    "lenovo:thinkagile_vx_1u",
    "lenovo:xclarity_controller"
   ]
  },
  "CVE-2021-36299": {
   "cvss": 8.1,
   "cvss_version": "3.1",
   "epss": 0.29633,
   "epss_date": "2026-10-28",
   "fixed_in": "4.40.29.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-36299",
   "published": "2021-11-23T20:15:10.793",
   "modified": "2026-06-17T03:58:37.177",
   "severity": "high",
   "summary": "Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to the affected application.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "emc_idrac9_firmware",
     "versionStartIncluding": "4.40.00.00",
     "versionEndExcluding": "4.40.29.00"
    },
    {
     "product": "emc_idrac9_firmware",
     "eq": "5.00.00.00"
    }
   ],
   "products": [
    "dell:emc_idrac9_firmware"
   ]
  },
  "CVE-2021-36300": {
   "cvss": 8.2,
   "cvss_version": "3.1",
   "epss": 0.33317,
   "epss_date": "2026-10-28",
   "fixed_in": "5.00.00.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-36300",
   "published": "2021-11-23T20:15:10.853",
   "modified": "2026-06-17T03:58:37.280",
   "severity": "high",
   "summary": "iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability by sending a specially crafted malicious request to crash the webserver or cause information disclosure.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "emc_idrac9_firmware",
     "versionEndExcluding": "5.00.00.00"
    }
   ],
   "products": [
    "dell:emc_idrac9_firmware"
   ]
  },
  "CVE-2021-36301": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.27698,
   "epss_date": "2026-10-28",
   "published": "2021-11-23T20:15:10.917",
   "modified": "2026-06-17T03:58:37.390",
   "severity": "high",
   "summary": "Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker may potentially exploit this vulnerability to control process execution and gain access to the underlying operating system.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "emc_idrac8_firmware",
     "versionEndExcluding": "2.80.80.80"
    },
    {
     "product": "emc_idrac9_firmware",
     "versionEndExcluding": "4.40.40.00"
    }
   ],
   "products": [
    "dell:emc_idrac8_firmware",
    "dell:emc_idrac9_firmware"
   ]
  },
  "CVE-2021-36346": {
   "cvss": 5.3,
   "cvss_version": "3.1",
   "epss": 0.04181,
   "epss_date": "2026-10-28",
   "fixed_in": "2.82.82.82",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-36346",
   "published": "2022-01-25T23:15:08.773",
   "modified": "2026-06-17T03:58:43.543",
   "severity": "medium",
   "summary": "Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to deny access to the iDRAC webserver.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "integrated_dell_remote_access_controller_8_firmware",
     "versionEndExcluding": "2.82.82.82"
    }
   ],
   "products": [
    "dell:integrated_dell_remote_access_controller_8",
    "dell:integrated_dell_remote_access_controller_8_firmware"
   ]
  },
  "CVE-2021-36347": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.02208,
   "epss_date": "2026-10-28",
   "published": "2022-01-25T23:15:08.827",
   "modified": "2026-06-17T03:58:43.653",
   "severity": "high",
   "summary": "iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability. An authenticated remote attacker with high privileges could potentially exploit this vulnerability to control process execution and gain access to the iDRAC operating system.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "integrated_dell_remote_access_controller_8_firmware",
     "versionEndExcluding": "2.82.82.82"
    },
    {
     "product": "integrated_dell_remote_access_controller_9_firmware",
     "versionEndExcluding": "5.00.20.00"
    }
   ],
   "products": [
    "dell:integrated_dell_remote_access_controller_8",
    "dell:integrated_dell_remote_access_controller_8_firmware",
    "dell:integrated_dell_remote_access_controller_9",
    "dell:integrated_dell_remote_access_controller_9_firmware"
   ]
  },
  "CVE-2021-36348": {
   "cvss": 8.1,
   "cvss_version": "3.1",
   "epss": 0.01132,
   "epss_date": "2026-10-28",
   "fixed_in": "5.00.20.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-36348",
   "published": "2022-01-25T23:15:08.880",
   "modified": "2026-06-17T03:58:43.763",
   "severity": "high",
   "summary": "iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to iDRAC.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "integrated_dell_remote_access_controller_9_firmware",
     "versionEndExcluding": "5.00.20.00"
    }
   ],
   "products": [
    "dell:integrated_dell_remote_access_controller_9",
    "dell:integrated_dell_remote_access_controller_9_firmware"
   ]
  },
  "CVE-2021-38960": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.01063,
   "epss_date": "2026-10-28",
   "published": "2022-02-04T23:15:11.733",
   "modified": "2026-06-17T04:02:53.827",
   "severity": "high",
   "summary": "IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ibm:power_hardware_management_console_\\(7063-cr2\\)",
    "ibm:power_hardware_management_console_\\(7063-cr2\\)_firmware",
    "ibm:power_system_ac922_\\(8335-gth\\)",
    "ibm:power_system_ac922_\\(8335-gth\\)_firmware",
    "ibm:power_system_ac922_\\(8335-gtx\\)",
    "ibm:power_system_ac922_\\(8335-gtx\\)_firmware"
   ]
  },
  "CVE-2021-38961": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00653,
   "epss_date": "2026-10-28",
   "published": "2021-12-27T17:15:07.210",
   "modified": "2026-06-17T04:02:53.940",
   "severity": "medium",
   "summary": "IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ibm:power_system_ac922_\\(8335-gtc\\)",
    "ibm:power_system_ac922_\\(8335-gtc\\)_firmware",
    "ibm:power_system_ac922_\\(8335-gtg\\)",
    "ibm:power_system_ac922_\\(8335-gtg\\)_firmware",
    "ibm:power_system_ac922_\\(8335-gtw\\)",
    "ibm:power_system_ac922_\\(8335-gtw\\)_firmware"
   ]
  },
  "CVE-2021-39295": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.01282,
   "epss_date": "2026-10-28",
   "published": "2023-04-15T20:16:00.667",
   "modified": "2026-06-17T04:03:28.870",
   "severity": "high",
   "summary": "In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface.",
   "vendors": [
    "megarac"
   ],
   "ranges": [
    {
     "product": "openbmc",
     "eq": "2.9.0"
    }
   ],
   "products": [
    "openbmc-project:openbmc"
   ]
  },
  "CVE-2021-39296": {
   "cvss": 10,
   "cvss_version": "3.1",
   "epss": 0.03035,
   "epss_date": "2026-10-28",
   "published": "2021-09-09T18:15:09.097",
   "modified": "2026-06-17T04:03:29.043",
   "severity": "critical",
   "summary": "In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system.",
   "vendors": [
    "megarac"
   ],
   "ranges": [
    {
     "product": "openbmc",
     "eq": "2.9.0"
    }
   ],
   "products": [
    "openbmc-project:openbmc"
   ]
  },
  "CVE-2021-3956": {
   "cvss": 5.3,
   "cvss_version": "3.1",
   "epss": 0.00786,
   "epss_date": "2026-10-28",
   "published": "2022-05-18T16:15:08.063",
   "modified": "2026-06-17T04:06:17.083",
   "severity": "medium",
   "summary": "A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active Directory. An unauthenticated user can gain read-only access to XCC in such a configuration, thereby allowing the XCC device configuration to be viewed but not changed. XCC devices configured to use local authentication, LDAP Authentication + Authorization Mode, or LDAP servers that support only “authe...",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_hx1320",
    "lenovo:thinkagile_hx1321",
    "lenovo:thinkagile_hx1520-r",
    "lenovo:thinkagile_hx1521-r",
    "lenovo:thinkagile_hx2320-e",
    "lenovo:thinkagile_hx2321",
    "lenovo:thinkagile_hx3320",
    "lenovo:thinkagile_hx3321",
    "lenovo:thinkagile_hx3375",
    "lenovo:thinkagile_hx3376",
    "lenovo:thinkagile_hx3520-g",
    "lenovo:xclarity_controller"
   ]
  },
  "CVE-2021-41103": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00518,
   "epss_date": "2026-10-28",
   "published": "2021-10-04T17:15:08.517",
   "modified": "2026-06-17T04:07:52.820",
   "severity": "high",
   "summary": "containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionEndExcluding": "1.4.11"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "1.5.0",
     "versionEndExcluding": "1.5.7"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2021-43784": {
   "cvss": 5,
   "cvss_version": "3.1",
   "epss": 0.01803,
   "epss_date": "2026-10-28",
   "fixed_in": "1.0.3",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-43784",
   "published": "2021-12-06T18:15:08.240",
   "modified": "2026-06-17T04:11:25.983",
   "severity": "medium",
   "summary": "runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndExcluding": "1.0.3"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2021-43816": {
   "cvss": 9.1,
   "cvss_version": "3.1",
   "epss": 0.01682,
   "epss_date": "2026-10-28",
   "fixed_in": "1.5.9",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-43816",
   "published": "2022-01-05T19:15:08.717",
   "modified": "2026-06-17T04:11:29.860",
   "severity": "critical",
   "summary": "containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionStartIncluding": "1.5.1",
     "versionEndExcluding": "1.5.9"
    },
    {
     "product": "containerd",
     "eq": "1.5.0"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2021-46846": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00515,
   "epss_date": "2026-10-28",
   "fixed_in": "2.44",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2021-46846",
   "published": "2022-12-12T13:15:11.917",
   "modified": "2026-06-17T04:15:39.373",
   "severity": "medium",
   "summary": "Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5.\n\n",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.44"
    }
   ],
   "products": [
    "hp:3par_service_processor",
    "hp:apollo_r2000_chassis",
    "hp:integrated_lights-out_5_firmware",
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:integrated_lights-out_5",
    "hpe:proliant_bl460c_gen10_server_blade",
    "hpe:proliant_dl120_gen10_server",
    "hpe:proliant_dl160_gen10_server",
    "hpe:proliant_dl180_gen10_server"
   ]
  },
  "CVE-2022-21813": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00232,
   "epss_date": "2026-10-28",
   "published": "2022-02-07T20:15:07.773",
   "modified": "2026-06-17T04:27:02.027",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-21814": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00232,
   "epss_date": "2026-10-28",
   "published": "2022-02-07T20:15:07.830",
   "modified": "2026-06-17T04:27:02.140",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-21815": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00212,
   "epss_date": "2026-10-28",
   "published": "2022-02-07T20:15:07.887",
   "modified": "2026-06-17T04:27:02.250",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs where a NULL pointer dereference in the kernel, created within user mode code, may lead to a denial of service in the form of a system crash.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-21820": {
   "cvss": 6.3,
   "cvss_version": "3.1",
   "epss": 0.16508,
   "epss_date": "2026-10-28",
   "fixed_in": "2.3.5",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-21820",
   "published": "2022-03-24T17:15:08.230",
   "modified": "2026-06-17T04:27:02.797",
   "severity": "medium",
   "summary": "NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may lead to limited code execution, some denial of service, escalation of privileges, and limited impacts to both data confidentiality and integrity.",
   "vendors": [
    "nvidia-dcgm"
   ],
   "ranges": [
    {
     "product": "data_center_gpu_manager",
     "versionEndExcluding": "2.3.5",
     "platforms": [
      "os:linux"
     ]
    }
   ],
   "products": [
    "data_center_gpu_manager"
   ]
  },
  "CVE-2022-22488": {
   "cvss": 4.9,
   "cvss_version": "3.1",
   "epss": 0.00528,
   "epss_date": "2026-10-28",
   "published": "2022-12-12T13:15:12.050",
   "modified": "2026-06-17T04:28:28.007",
   "severity": "medium",
   "summary": "IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time.  IBM X-Force ID:  2226337.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ibm:power_system_ac922_\\(8335-gtg\\)",
    "ibm:power_system_ac922_\\(8335-gtg\\)_firmware",
    "ibm:power_system_ac922_\\(8335-gth\\)",
    "ibm:power_system_ac922_\\(8335-gth\\)_firmware",
    "ibm:power_system_ac922_\\(8335-gtx\\)",
    "ibm:power_system_ac922_\\(8335-gtx\\)_firmware"
   ]
  },
  "CVE-2022-23471": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.01109,
   "epss_date": "2026-10-28",
   "published": "2022-12-07T23:15:09.763",
   "modified": "2026-06-17T04:30:11.483",
   "severity": "medium",
   "summary": "containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16.  Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionEndExcluding": "1.5.16"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "1.6.0",
     "versionEndExcluding": "1.6.12"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2022-23648": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.27392,
   "epss_date": "2026-10-28",
   "published": "2022-03-03T14:15:07.973",
   "modified": "2026-06-17T04:30:33.620",
   "severity": "high",
   "summary": "containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionEndExcluding": "1.4.13"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "1.5.0",
     "versionEndExcluding": "1.5.10"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "1.6.0",
     "versionEndExcluding": "1.6.1"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2022-23701": {
   "cvss": 5.3,
   "cvss_version": "3.1",
   "epss": 0.00685,
   "epss_date": "2026-10-28",
   "fixed_in": "2.60",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-23701",
   "published": "2022-02-24T22:15:08.393",
   "modified": "2026-06-17T04:30:39.957",
   "severity": "medium",
   "summary": "A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior to 2.60. This vulnerability could be remotely exploited to allow an attacker to supply invalid input to the iLO 4 webserver, causing it to respond with a redirect to an attacker-controlled domain. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 4 (iLO 4).",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out",
     "versionEndExcluding": "2.60"
    }
   ],
   "products": [
    "hpe:integrated_lights-out",
    "hpe:integrated_lights-out_4"
   ]
  },
  "CVE-2022-23704": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.01947,
   "epss_date": "2026-10-28",
   "fixed_in": "2.80",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-23704",
   "published": "2022-05-09T21:15:08.047",
   "modified": "2026-06-17T04:30:40.260",
   "severity": "high",
   "summary": "A potential security vulnerability has been identified in Integrated Lights-Out 4 (iLO 4). The vulnerability could allow remote Denial of Service. The vulnerability is resolved in Integrated Lights-Out 4 (iLO 4) 2.80 and later.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.80"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hpe:apollo_4200_gen9_server",
    "hpe:proliant_bl420c_gen8_server",
    "hpe:proliant_bl460c_gen8_server_blade",
    "hpe:proliant_bl460c_gen9_server_blade",
    "hpe:proliant_bl465c_gen8_server_blade",
    "hpe:proliant_bl660c_gen8_server_blade",
    "hpe:proliant_bl660c_gen9_server",
    "hpe:proliant_dl120_gen9_server",
    "hpe:proliant_dl160_gen8_server",
    "hpe:proliant_dl160_gen9_server",
    "hpe:proliant_dl180_gen9_server"
   ]
  },
  "CVE-2022-24422": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.5854,
   "epss_date": "2026-10-28",
   "fixed_in": "5.10.10.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-24422",
   "published": "2022-05-26T16:15:08.113",
   "modified": "2026-06-17T04:31:49.270",
   "severity": "critical",
   "summary": "Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain access to the VNC Console.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9",
     "versionStartIncluding": "5.00.00.00",
     "versionEndExcluding": "5.10.10.00"
    }
   ],
   "products": [
    "dell:idrac9"
   ]
  },
  "CVE-2022-24423": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.01643,
   "epss_date": "2026-10-28",
   "fixed_in": "2.83.83.83",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-24423",
   "published": "2022-04-21T21:15:07.817",
   "modified": "2026-06-17T04:31:49.377",
   "severity": "high",
   "summary": "Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to cause resource exhaustion in the webserver, resulting in a denial of service condition.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "integrated_dell_remote_access_controller_8_firmware",
     "versionEndExcluding": "2.83.83.83"
    }
   ],
   "products": [
    "dell:integrated_dell_remote_access_controller_8",
    "dell:integrated_dell_remote_access_controller_8_firmware"
   ]
  },
  "CVE-2022-24769": {
   "cvss": 5.9,
   "cvss_version": "3.1",
   "epss": 0.00492,
   "epss_date": "2026-10-28",
   "fixed_in": "1.1.2",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-24769",
   "published": "2022-03-24T20:15:09.493",
   "modified": "2026-06-17T04:32:28.717",
   "severity": "medium",
   "summary": "Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndExcluding": "1.1.2"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2022-26872": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00764,
   "epss_date": "2026-10-28",
   "published": "2023-01-30T16:15:08.860",
   "modified": "2026-06-17T04:36:02.780",
   "severity": "high",
   "summary": "AMI Megarac Password reset interception via API",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2022-2809": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.00771,
   "epss_date": "2026-10-28",
   "published": "2022-10-27T13:15:09.633",
   "modified": "2026-06-17T04:42:37.490",
   "severity": "high",
   "summary": "A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.",
   "vendors": [
    "megarac"
   ],
   "ranges": [
    {
     "product": "openbmc",
     "versionStartIncluding": "2.10.0",
     "versionEndIncluding": "2.13.0"
    }
   ],
   "products": [
    "openbmc-project:openbmc"
   ]
  },
  "CVE-2022-28181": {
   "cvss": 9.9,
   "cvss_version": "3.1",
   "epss": 0.01133,
   "epss_date": "2026-10-28",
   "published": "2022-05-17T20:15:08.673",
   "modified": "2026-06-17T04:38:06.880",
   "severity": "critical",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on the network can cause an out-of-bounds write through a specially crafted shader, which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. The scope of the impact may extend to other components.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-28182": {
   "cvss": 8.5,
   "cvss_version": "3.1",
   "epss": 0.0163,
   "epss_date": "2026-10-28",
   "published": "2022-05-17T20:15:08.737",
   "modified": "2026-06-17T04:38:06.990",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll), where an unauthorized attacker on the network can cause an out-of-bounds write through a specially crafted shader, which may lead to code execution to cause denial of service, escalation of privileges, information disclosure, and data tampering. The scope of the impact may extend to other components.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-28183": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.00327,
   "epss_date": "2026-10-28",
   "published": "2022-05-17T20:15:08.790",
   "modified": "2026-06-17T04:38:07.100",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause an out-of-bounds read, which may lead to denial of service and information disclosure.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-28184": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00298,
   "epss_date": "2026-10-28",
   "published": "2022-05-17T20:15:08.843",
   "modified": "2026-06-17T04:38:07.207",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an unprivileged regular user can access administrator- privileged registers, which may lead to denial of service, information disclosure, and data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-28186": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00274,
   "epss_date": "2026-10-28",
   "published": "2022-05-17T20:15:08.953",
   "modified": "2026-06-17T04:38:07.427",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly, which may lead to denial of service or data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-28187": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00269,
   "epss_date": "2026-10-28",
   "published": "2022-05-17T20:15:09.007",
   "modified": "2026-06-17T04:38:07.530",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management software does not release a resource after its effective lifetime has ended, which may lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-28188": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00274,
   "epss_date": "2026-10-28",
   "published": "2022-05-17T20:15:09.063",
   "modified": "2026-06-17T04:38:07.637",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly, which may lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-28189": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00286,
   "epss_date": "2026-10-28",
   "published": "2022-05-17T20:15:09.127",
   "modified": "2026-06-17T04:38:07.743",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a NULL pointer dereference may lead to a system crash.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-28190": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00269,
   "epss_date": "2026-10-28",
   "published": "2022-05-17T20:15:09.187",
   "modified": "2026-06-17T04:38:07.850",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where improper input validation can cause denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-2827": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.01814,
   "epss_date": "2026-10-28",
   "published": "2022-12-05T22:15:10.163",
   "modified": "2026-06-17T04:42:39.440",
   "severity": "high",
   "summary": "AMI MegaRAC User Enumeration Vulnerability",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2022-28626": {
   "cvss": 6.7,
   "cvss_version": "3.1",
   "epss": 0.00223,
   "epss_date": "2026-10-28",
   "fixed_in": "2.71",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28626",
   "published": "2022-08-12T15:15:14.000",
   "modified": "2026-06-17T04:38:43.987",
   "severity": "medium",
   "summary": "A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.71"
    }
   ],
   "products": [
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:apollo_6500_gen10_system",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:edgeline_e920_server_blade",
    "hpe:edgeline_e920d_server_blade",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28627": {
   "cvss": 8.4,
   "cvss_version": "3.1",
   "epss": 0.00231,
   "epss_date": "2026-10-28",
   "fixed_in": "2.71",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28627",
   "published": "2022-08-12T15:15:14.080",
   "modified": "2026-06-17T04:38:44.100",
   "severity": "high",
   "summary": "A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.71"
    }
   ],
   "products": [
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:apollo_6500_gen10_system",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:edgeline_e920_server_blade",
    "hpe:edgeline_e920d_server_blade",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28628": {
   "cvss": 8.4,
   "cvss_version": "3.1",
   "epss": 0.00231,
   "epss_date": "2026-10-28",
   "fixed_in": "2.71",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28628",
   "published": "2022-08-12T15:15:14.123",
   "modified": "2026-06-17T04:38:44.213",
   "severity": "high",
   "summary": "A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.71"
    }
   ],
   "products": [
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:apollo_6500_gen10_system",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:edgeline_e920_server_blade",
    "hpe:edgeline_e920d_server_blade",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28629": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00224,
   "epss_date": "2026-10-28",
   "fixed_in": "2.71",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28629",
   "published": "2022-08-12T15:15:14.167",
   "modified": "2026-06-17T04:38:44.333",
   "severity": "high",
   "summary": "A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A low privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.71"
    }
   ],
   "products": [
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:apollo_6500_gen10_system",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:edgeline_e920_server_blade",
    "hpe:edgeline_e920d_server_blade",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28630": {
   "cvss": 7.3,
   "cvss_version": "3.1",
   "epss": 0.00242,
   "epss_date": "2026-10-28",
   "fixed_in": "2.71",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28630",
   "published": "2022-08-12T15:15:14.210",
   "modified": "2026-06-17T04:38:44.450",
   "severity": "high",
   "summary": "A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality and integrity, and a partial loss of availability. User interaction is required to exploit this vulnerability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.71"
    }
   ],
   "products": [
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:apollo_6500_gen10_system",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:edgeline_e920_server_blade",
    "hpe:edgeline_e920d_server_blade",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28631": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00432,
   "epss_date": "2026-10-28",
   "fixed_in": "2.71",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28631",
   "published": "2022-08-12T15:15:14.253",
   "modified": "2026-06-17T04:38:44.563",
   "severity": "high",
   "summary": "A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could exploit this vulnerability in an adjacent network to potentially execute arbitrary code in an isolated process resulting in a complete loss of confidentiality, integrity, and availability within that process. In addition, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process resulting in a complete loss of availability within...",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.71"
    }
   ],
   "products": [
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:apollo_6500_gen10_system",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:edgeline_e920_server_blade",
    "hpe:edgeline_e920d_server_blade",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28632": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00432,
   "epss_date": "2026-10-28",
   "fixed_in": "2.71",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28632",
   "published": "2022-08-12T15:15:14.297",
   "modified": "2026-06-17T04:38:44.680",
   "severity": "high",
   "summary": "A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could exploit this vulnerability in an adjacent network to potentially execute arbitrary code in an isolated process resulting in a complete loss of confidentiality, integrity, and availability within that process. In addition, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process resulting in a complete loss of availability within...",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.71"
    }
   ],
   "products": [
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:apollo_6500_gen10_system",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:edgeline_e920_server_blade",
    "hpe:edgeline_e920d_server_blade",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28633": {
   "cvss": 7.3,
   "cvss_version": "3.1",
   "epss": 0.00206,
   "epss_date": "2026-10-28",
   "fixed_in": "2.71",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28633",
   "published": "2022-08-12T15:15:14.337",
   "modified": "2026-06-17T04:38:44.800",
   "severity": "high",
   "summary": "A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to read and write to the iLO 5 firmware file system resulting in a complete loss of confidentiality and a partial loss of integrity and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.71"
    }
   ],
   "products": [
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:apollo_6500_gen10_system",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:edgeline_e920_server_blade",
    "hpe:edgeline_e920d_server_blade",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28634": {
   "cvss": 6.7,
   "cvss_version": "3.1",
   "epss": 0.00223,
   "epss_date": "2026-10-28",
   "fixed_in": "2.71",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28634",
   "published": "2022-08-12T15:15:14.383",
   "modified": "2026-06-17T04:38:44.917",
   "severity": "medium",
   "summary": "A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.71"
    }
   ],
   "products": [
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:apollo_6500_gen10_system",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:edgeline_e920_server_blade",
    "hpe:edgeline_e920d_server_blade",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28635": {
   "cvss": 7.4,
   "cvss_version": "3.1",
   "epss": 0.00195,
   "epss_date": "2026-10-28",
   "fixed_in": "2.71",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28635",
   "published": "2022-08-12T15:15:14.423",
   "modified": "2026-06-17T04:38:45.033",
   "severity": "high",
   "summary": "A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to potentially execute arbitrary code in an isolated process resulting in a complete loss of confidentiality, integrity, and availability within that process. In addition, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process resulting in a complete loss of availability within th...",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.71"
    }
   ],
   "products": [
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:apollo_6500_gen10_system",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:edgeline_e920_server_blade",
    "hpe:edgeline_e920d_server_blade",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28636": {
   "cvss": 7.4,
   "cvss_version": "3.1",
   "epss": 0.00195,
   "epss_date": "2026-10-28",
   "fixed_in": "2.71",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28636",
   "published": "2022-08-12T15:15:14.467",
   "modified": "2026-06-17T04:38:45.147",
   "severity": "high",
   "summary": "A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to potentially execute arbitrary code in an isolated process resulting in a complete loss of confidentiality, integrity, and availability within that process. In addition, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process resulting in a complete loss of availability within th...",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.71"
    }
   ],
   "products": [
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:apollo_6500_gen10_system",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:edgeline_e920_server_blade",
    "hpe:edgeline_e920d_server_blade",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28637": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00272,
   "epss_date": "2026-10-28",
   "fixed_in": "2.72",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28637",
   "published": "2022-09-20T21:15:10.377",
   "modified": "2026-06-17T04:38:45.263",
   "severity": "high",
   "summary": "A local Denial of Service (DoS) and local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses these security vulnerabilities.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.72"
    }
   ],
   "products": [
    "hp:apollo_4200_gen10_server",
    "hp:apollo_4500",
    "hp:apollo_r2000_chassis",
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_plus_system",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28638": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00269,
   "epss_date": "2026-10-28",
   "fixed_in": "2.72",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28638",
   "published": "2022-09-20T21:15:10.417",
   "modified": "2026-06-17T04:38:45.437",
   "severity": "high",
   "summary": "An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses these security vulnerabilities.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.72"
    }
   ],
   "products": [
    "hp:apollo_4200_gen10_server",
    "hp:apollo_4500",
    "hp:apollo_r2000_chassis",
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_plus_system",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28639": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00578,
   "epss_date": "2026-10-28",
   "fixed_in": "2.72",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28639",
   "published": "2022-09-20T21:15:10.457",
   "modified": "2026-06-17T04:38:45.610",
   "severity": "high",
   "summary": "A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses these security vulnerabilities.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.72"
    }
   ],
   "products": [
    "hp:apollo_4200_gen10_server",
    "hp:apollo_4500",
    "hp:apollo_r2000_chassis",
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_plus_system",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-28640": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00544,
   "epss_date": "2026-10-28",
   "fixed_in": "2.72",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-28640",
   "published": "2022-09-20T21:15:10.497",
   "modified": "2026-06-17T04:38:45.777",
   "severity": "high",
   "summary": "A potential local adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability was discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses this security vulnerability.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.72"
    }
   ],
   "products": [
    "hp:apollo_4200_gen10_server",
    "hp:apollo_4500",
    "hp:apollo_r2000_chassis",
    "hpe:apollo_2000_gen10_plus_system",
    "hpe:apollo_4200_gen10_plus_system",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2022-29162": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00393,
   "epss_date": "2026-10-28",
   "fixed_in": "1.1.2",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-29162",
   "published": "2022-05-17T21:15:08.320",
   "modified": "2026-06-17T04:39:42.730",
   "severity": "high",
   "summary": "runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndExcluding": "1.1.2"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2022-29494": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.00642,
   "epss_date": "2026-10-28",
   "published": "2023-02-16T21:15:11.817",
   "modified": "2026-06-17T04:40:18.620",
   "severity": "medium",
   "summary": "Improper input validation in firmware for OpenBMC in some Intel(R) platforms before versions egs-0.91-179 and bhs-04-45 may allow an authenticated user to potentially enable denial of service via network access.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "intel:c621a",
    "intel:c627a",
    "intel:c629a",
    "intel:openbmc",
    "intel:xeon_gold_5315y",
    "intel:xeon_gold_5317",
    "intel:xeon_gold_5318h",
    "intel:xeon_gold_5318n",
    "intel:xeon_gold_5318s",
    "intel:xeon_gold_5318y",
    "intel:xeon_gold_5320",
    "intel:xeon_gold_5320h"
   ]
  },
  "CVE-2022-31030": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00387,
   "epss_date": "2026-10-28",
   "published": "2022-06-09T14:15:08.550",
   "modified": "2026-06-17T04:44:38.587",
   "severity": "medium",
   "summary": "containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionEndExcluding": "1.5.13"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "1.6.0",
     "versionEndExcluding": "1.6.6"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2022-31606": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00403,
   "epss_date": "2026-10-28",
   "published": "2022-11-19T00:15:14.450",
   "modified": "2026-06-17T04:45:46.307",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a failure to properly validate data might allow an attacker with basic user capabilities to cause an out-of-bounds access in kernel mode, which could lead to denial of service, information disclosure, escalation of privileges, or data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "451.48",
     "versionEndExcluding": "453.64",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "472.81",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-31607": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00259,
   "epss_date": "2026-10-28",
   "published": "2022-11-19T00:15:23.190",
   "modified": "2026-06-17T04:45:46.520",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where a local user with basic capabilities can cause improper input validation, which may lead to denial of service, escalation of privileges, data tampering, and limited information disclosure.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.154",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.141.03",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.85.02",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.65.01",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.154",
     "platforms": [
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.141.03",
     "platforms": [
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.85.02",
     "platforms": [
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.65.01",
     "platforms": [
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.203.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.141.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.85.02",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.65.01",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-31608": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00283,
   "epss_date": "2026-10-28",
   "published": "2022-11-19T00:15:24.927",
   "modified": "2026-06-17T04:45:46.727",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local user with basic capabilities can impact protected D-Bus endpoints, which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.154",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.141.03",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.85.02",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.65.01",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.154",
     "platforms": [
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.141.03",
     "platforms": [
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.85.02",
     "platforms": [
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.65.01",
     "platforms": [
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.203.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.141.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.85.02",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.65.01",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-31610": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00297,
   "epss_date": "2026-10-28",
   "published": "2022-11-19T00:15:25.477",
   "modified": "2026-06-17T04:45:47.140",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local user with basic capabilities can cause an out-of-bounds write, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "451.48",
     "versionEndExcluding": "453.64",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "472.81",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-31612": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.00219,
   "epss_date": "2026-10-28",
   "published": "2022-11-19T00:15:25.877",
   "modified": "2026-06-17T04:45:47.557",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a local user with basic capabilities can cause an out-of-bounds read, which may lead to a system crash or a leak of internal kernel information.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "451.48",
     "versionEndExcluding": "453.64",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "472.81",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-31613": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.00198,
   "epss_date": "2026-10-28",
   "published": "2022-11-19T00:15:26.227",
   "modified": "2026-06-17T04:45:47.763",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where any local user can cause a null-pointer dereference, which may lead to a kernel panic.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "451.48",
     "versionEndExcluding": "453.64",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "472.81",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-31615": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00234,
   "epss_date": "2026-10-28",
   "published": "2022-11-19T00:15:26.543",
   "modified": "2026-06-17T04:45:48.173",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.154",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.141.03",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.85.02",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.65.01",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.154",
     "platforms": [
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.141.03",
     "platforms": [
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.85.02",
     "platforms": [
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.65.01",
     "platforms": [
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.203.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.141.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.85.02",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.65.01",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-31616": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.00179,
   "epss_date": "2026-10-28",
   "published": "2022-11-19T00:15:26.893",
   "modified": "2026-06-17T04:45:48.377",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a local user with basic capabilities can cause an out-of-bounds read, which may lead to denial of service, or information disclosure.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "451.48",
     "versionEndExcluding": "453.64",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "472.81",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-31617": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00297,
   "epss_date": "2026-10-28",
   "published": "2022-11-19T00:15:27.273",
   "modified": "2026-06-17T04:45:48.593",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local user with basic capabilities can cause an out-of-bounds read, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "451.48",
     "versionEndExcluding": "453.64",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "472.81",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-3409": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.00771,
   "epss_date": "2026-10-28",
   "published": "2022-10-27T13:15:11.047",
   "modified": "2026-06-17T04:59:28.353",
   "severity": "high",
   "summary": "A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.",
   "vendors": [
    "megarac"
   ],
   "ranges": [
    {
     "product": "openbmc",
     "versionStartIncluding": "2.10.0",
     "versionEndIncluding": "2.13.0"
    }
   ],
   "products": [
    "openbmc-project:openbmc"
   ]
  },
  "CVE-2022-34435": {
   "cvss": 4.9,
   "cvss_version": "3.1",
   "epss": 0.00513,
   "epss_date": "2026-10-28",
   "fixed_in": "6.00.30.00",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-34435",
   "published": "2023-01-18T12:15:10.427",
   "modified": "2026-06-17T04:50:21.123",
   "severity": "medium",
   "summary": "\nDell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could exploit this vulnerability to bypass the firmware lock-down configuration and perform a firmware update.\n\n\n\n\n\n",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "6.00.30.00"
    }
   ],
   "products": [
    "dell:idrac9",
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2022-34436": {
   "cvss": 4.9,
   "cvss_version": "3.1",
   "epss": 0.00491,
   "epss_date": "2026-10-28",
   "fixed_in": "2.84.84.84",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-34436",
   "published": "2023-01-18T12:15:10.510",
   "modified": "2026-06-17T04:50:21.237",
   "severity": "medium",
   "summary": "\nDell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could exploit this vulnerability to bypass the firmware lock-down configuration and perform a firmware update.\n\n\n\n\n\n",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac8_firmware",
     "versionEndExcluding": "2.84.84.84"
    }
   ],
   "products": [
    "dell:idrac8",
    "dell:idrac8_firmware"
   ]
  },
  "CVE-2022-34665": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.00205,
   "epss_date": "2026-10-28",
   "published": "2022-11-19T00:15:27.557",
   "modified": "2026-06-17T04:50:40.677",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "473.81",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "451.48",
     "versionEndExcluding": "453.64",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "471.11",
     "versionEndExcluding": "472.81",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "511.09",
     "versionEndExcluding": "513.46",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "516.25",
     "versionEndExcluding": "516.94",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-34670": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00279,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:09.337",
   "modified": "2026-06-17T04:50:41.247",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause truncation errors when casting a primitive to a primitive of smaller size causes data to be lost in the conversion, which may lead to denial of service or information disclosure.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.157",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-34671": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.01419,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:09.430",
   "modified": "2026-06-17T04:50:41.377",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the user-mode layer, where an unprivileged user can cause an out-of-bounds write, which may lead to code execution, information disclosure, and denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "474.14",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "514.08",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "517.88",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "527.27",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "454.02",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "474.14",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "514.08",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndIncluding": "517.88",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "527.41",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "526.98",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "474.14",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "526.98",
     "platforms": [
      "gpu:geforce"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-34673": {
   "cvss": 7.3,
   "cvss_version": "3.1",
   "epss": 0.00254,
   "epss_date": "2026-10-28",
   "fixed_in": "515.86.01",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-34673",
   "published": "2022-12-30T23:15:09.610",
   "modified": "2026-06-17T04:50:41.613",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of service, information disclosure, or data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-34674": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00278,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:09.710",
   "modified": "2026-06-17T04:50:41.727",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where a helper function maps more physical pages than were requested, which may lead to undefined behavior or an information leak.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.157",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-34675": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00225,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:09.807",
   "modified": "2026-06-17T04:50:41.853",
   "severity": "medium",
   "summary": "NVIDIA Display Driver for Linux contains a vulnerability in the Virtual GPU Manager, where it does not check the return value from a null-pointer dereference, which may lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.157",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-34677": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.00285,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:09.983",
   "modified": "2026-06-17T04:50:42.090",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause an integer to be truncated, which may lead to denial of service or data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.157",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-34680": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00281,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:10.247",
   "modified": "2026-06-17T04:50:42.460",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an integer truncation can lead to an out-of-bounds read, which may lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.157",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-34684": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.00256,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:10.583",
   "modified": "2026-06-17T04:50:42.927",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an off-by-one error may lead to data tampering or information disclosure.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-35729": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.00694,
   "epss_date": "2026-10-28",
   "fixed_in": "0.72",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-35729",
   "published": "2023-02-16T21:15:13.023",
   "modified": "2026-06-17T04:52:08.637",
   "severity": "high",
   "summary": "Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated user to potentially enable denial of service via network access.",
   "vendors": [
    "megarac"
   ],
   "ranges": [
    {
     "product": "openbmc",
     "versionEndExcluding": "0.72"
    }
   ],
   "products": [
    "intel:c621a",
    "intel:c624a",
    "intel:c627a",
    "intel:c629a",
    "intel:xeon_gold_5315y",
    "intel:xeon_gold_5317",
    "intel:xeon_gold_5318h",
    "intel:xeon_gold_5318n",
    "intel:xeon_gold_5318s",
    "intel:xeon_gold_5318y",
    "intel:xeon_gold_5320",
    "openbmc-project:openbmc"
   ]
  },
  "CVE-2022-40242": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.0068,
   "epss_date": "2026-10-28",
   "published": "2022-12-05T22:15:10.800",
   "modified": "2026-06-17T05:01:10.363",
   "severity": "critical",
   "summary": "MegaRAC Default Credentials Vulnerability",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2022-40258": {
   "cvss": 5.3,
   "cvss_version": "3.1",
   "epss": 0.00408,
   "epss_date": "2026-10-28",
   "published": "2023-01-31T01:15:11.800",
   "modified": "2026-06-17T05:01:11.043",
   "severity": "medium",
   "summary": "AMI Megarac Weak password hashes for\nRedfish \u0026 API",
   "vendors": [
    "megarac"
   ],
   "ranges": [
    {
     "product": "megarac_spx-12",
     "versionEndExcluding": "7.00"
    },
    {
     "product": "megarac_spx-13",
     "versionEndExcluding": "5.00"
    }
   ],
   "products": [
    "ami:megarac_spx-12",
    "ami:megarac_spx-13"
   ]
  },
  "CVE-2022-40259": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.00672,
   "epss_date": "2026-10-28",
   "published": "2022-12-05T22:15:10.857",
   "modified": "2026-06-17T05:01:11.157",
   "severity": "critical",
   "summary": "MegaRAC Default Credentials Vulnerability",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2022-42254": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00259,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:10.657",
   "modified": "2026-06-17T05:04:35.397",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of service, data tampering, or information disclosure.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-42257": {
   "cvss": 7.3,
   "cvss_version": "3.1",
   "epss": 0.00276,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:10.897",
   "modified": "2026-06-17T05:04:35.777",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to information disclosure, data tampering or denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.157",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-42258": {
   "cvss": 7.3,
   "cvss_version": "3.1",
   "epss": 0.00276,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:10.963",
   "modified": "2026-06-17T05:04:35.897",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service, data tampering, or information disclosure.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.157",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-42259": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00272,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:11.030",
   "modified": "2026-06-17T05:04:36.027",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "390",
     "versionEndExcluding": "390.157",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.60.11",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-42260": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.0025,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:11.097",
   "modified": "2026-06-17T05:04:36.157",
   "severity": "high",
   "summary": "NVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where an unauthorized user in the guest VM can impact protected D-Bus endpoints, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-42261": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00267,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:11.167",
   "modified": "2026-06-17T05:04:36.283",
   "severity": "high",
   "summary": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may cause data tampering, information disclosure, or denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-42262": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00228,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:11.263",
   "modified": "2026-06-17T05:04:36.403",
   "severity": "high",
   "summary": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may cause data tampering, information disclosure, or denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-42263": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.00263,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:11.360",
   "modified": "2026-06-17T05:04:36.527",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an Integer overflow may lead to denial of service or information disclosure.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-42264": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00268,
   "epss_date": "2026-10-28",
   "published": "2022-12-30T23:15:11.443",
   "modified": "2026-06-17T05:04:36.660",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause the use of an out-of-range pointer offset, which may lead to data tampering, data loss, information disclosure, or denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.216.04",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.161.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "510",
     "versionEndExcluding": "510.108.03",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-42265": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.0026,
   "epss_date": "2026-10-28",
   "fixed_in": "515.86.01",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2022-42265",
   "published": "2022-12-30T23:15:11.513",
   "modified": "2026-06-17T05:04:36.780",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to information disclosure or data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.86.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2022-43309": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00151,
   "epss_date": "2026-10-28",
   "published": "2023-04-07T21:15:06.827",
   "modified": "2026-07-09T01:17:51.310",
   "severity": "medium",
   "summary": "Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions.",
   "vendors": [
    "supermicro"
   ],
   "ranges": [
    {
     "product": "x11ssl-cf_firmware",
     "eq": "1.63"
    }
   ],
   "products": [
    "supermicro:x11dac",
    "supermicro:x11dac_firmware",
    "supermicro:x11dai-n",
    "supermicro:x11dai-n_firmware",
    "supermicro:x11ddw-l",
    "supermicro:x11ddw-l_firmware",
    "supermicro:x11ddw-nt",
    "supermicro:x11ddw-nt_firmware",
    "supermicro:x11dgo-t",
    "supermicro:x11dgo-t_firmware",
    "supermicro:x11ssl-cf",
    "supermicro:x11ssl-cf_firmware"
   ]
  },
  "CVE-2023-0184": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.0026,
   "epss_date": "2026-10-28",
   "published": "2023-04-22T03:15:08.817",
   "modified": "2026-06-17T05:24:58.867",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler which may lead to denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.182.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.105.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.105.17",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "530.41.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.236.01",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "454.14",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "474.30",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "518.03",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "528.89",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "531.41",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "474.30",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "531.41",
     "platforms": [
      "gpu:geforce"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2023-0190": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00235,
   "epss_date": "2026-10-28",
   "published": "2023-04-22T03:15:08.897",
   "modified": "2026-06-17T05:24:59.577",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a NULL pointer dereference may lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.182.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.105.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.105.17",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "530.41.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.236.01",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2023-0199": {
   "cvss": 6.1,
   "cvss_version": "3.1",
   "epss": 0.00235,
   "epss_date": "2026-10-28",
   "published": "2023-04-22T03:15:08.970",
   "modified": "2026-06-17T05:25:00.680",
   "severity": "medium",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds write can lead to denial of service and data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.182.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "515.105.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.105.17",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "530.41.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.236.01",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "454.14",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "474.30",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "515",
     "versionEndExcluding": "518.03",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "528.89",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "531.41",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "474.30",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "531.41",
     "platforms": [
      "gpu:geforce"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2023-0208": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.00178,
   "epss_date": "2026-10-28",
   "fixed_in": "3.1.7",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-0208",
   "published": "2023-04-01T04:15:08.813",
   "modified": "2026-06-17T05:25:01.787",
   "severity": "high",
   "summary": "\nNVIDIA DCGM for Linux contains a vulnerability in HostEngine (server component) where a user may cause a heap-based buffer overflow through the bound socket. A successful exploit of this vulnerability may lead to denial of service and data tampering.\n\n",
   "vendors": [
    "nvidia-dcgm"
   ],
   "ranges": [
    {
     "product": "data_center_gpu_manager",
     "versionEndExcluding": "3.1.7",
     "platforms": [
      "os:linux"
     ]
    }
   ],
   "products": [
    "data_center_gpu_manager"
   ]
  },
  "CVE-2023-0683": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00569,
   "epss_date": "2026-10-28",
   "published": "2023-05-01T15:15:09.223",
   "modified": "2026-06-17T05:26:04.850",
   "severity": "high",
   "summary": "A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_hx1021",
    "lenovo:thinkagile_hx1021_firmware",
    "lenovo:thinkagile_hx1320",
    "lenovo:thinkagile_hx1320_firmware",
    "lenovo:thinkagile_hx5530",
    "lenovo:thinkagile_hx5530_firmware",
    "lenovo:thinkagile_hx7530",
    "lenovo:thinkagile_hx7530_firmware",
    "lenovo:thinkagile_hx_enclosure",
    "lenovo:thinkagile_hx_enclosure_firmware",
    "lenovo:thinkagile_vx3331",
    "lenovo:thinkagile_vx3331_firmware"
   ]
  },
  "CVE-2023-25153": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00363,
   "epss_date": "2026-10-28",
   "published": "2023-02-16T15:15:19.477",
   "modified": "2026-06-17T05:40:47.483",
   "severity": "medium",
   "summary": "containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18.  Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionEndExcluding": "1.5.18"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "1.6.0",
     "versionEndExcluding": "1.6.18"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2023-25173": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00542,
   "epss_date": "2026-10-28",
   "published": "2023-02-16T15:15:20.057",
   "modified": "2026-06-17T05:40:50.410",
   "severity": "high",
   "summary": "containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionEndExcluding": "1.5.18"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "1.6.0",
     "versionEndExcluding": "1.6.18"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2023-25191": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.00602,
   "epss_date": "2026-10-28",
   "published": "2023-02-15T15:15:11.740",
   "modified": "2026-06-17T05:40:53.133",
   "severity": "high",
   "summary": "AMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12-update-7.00 and SPx_13-update-5.00.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-25192": {
   "cvss": 5.3,
   "cvss_version": "3.1",
   "epss": 0.00502,
   "epss_date": "2026-10-28",
   "published": "2023-02-15T15:15:11.807",
   "modified": "2026-06-17T05:40:53.340",
   "severity": "medium",
   "summary": "AMI MegaRAC SPX devices allow User Enumeration through Redfish. The fixed versions are SPx12-update-7.00 and SPx13-update-5.00.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-25492": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00506,
   "epss_date": "2026-10-28",
   "published": "2023-05-01T15:15:09.290",
   "modified": "2026-06-17T05:41:21.107",
   "severity": "high",
   "summary": "A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API.",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_hx1021",
    "lenovo:thinkagile_hx1021_firmware",
    "lenovo:thinkagile_hx1320",
    "lenovo:thinkagile_hx1320_firmware",
    "lenovo:thinkagile_hx5530",
    "lenovo:thinkagile_hx5530_firmware",
    "lenovo:thinkagile_hx7530",
    "lenovo:thinkagile_hx7530_firmware",
    "lenovo:thinkagile_hx_enclosure",
    "lenovo:thinkagile_hx_enclosure_firmware",
    "lenovo:thinkagile_vx3331",
    "lenovo:thinkagile_vx3331_firmware"
   ]
  },
  "CVE-2023-25495": {
   "cvss": 4.9,
   "cvss_version": "3.1",
   "epss": 0.00567,
   "epss_date": "2026-10-28",
   "published": "2023-04-28T22:15:08.950",
   "modified": "2026-06-17T05:41:21.580",
   "severity": "medium",
   "summary": "A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations.  There is no exposure where no LDAP client password is configured",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_hx1021",
    "lenovo:thinkagile_hx1021_firmware",
    "lenovo:thinkagile_hx1320",
    "lenovo:thinkagile_hx1320_firmware",
    "lenovo:thinkagile_hx5530",
    "lenovo:thinkagile_hx5530_firmware",
    "lenovo:thinkagile_hx7530",
    "lenovo:thinkagile_hx7530_firmware",
    "lenovo:thinkagile_hx_enclosure",
    "lenovo:thinkagile_hx_enclosure_firmware",
    "lenovo:thinkagile_vx3331",
    "lenovo:thinkagile_vx3331_firmware"
   ]
  },
  "CVE-2023-25505": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00213,
   "epss_date": "2026-10-28",
   "published": "2023-04-22T03:15:10.043",
   "modified": "2026-06-17T05:41:22.430",
   "severity": "high",
   "summary": "NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler of the AMI MegaRAC BMC , where an attacker with the appropriate level of authorization can cause a buffer overflow, which may lead to denial of service, information disclosure, or arbitrary code execution.",
   "vendors": [
    "dgx",
    "megarac"
   ],
   "products": [
    "nvidia:bmc",
    "nvidia:dgx-1"
   ]
  },
  "CVE-2023-25507": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00861,
   "epss_date": "2026-10-28",
   "published": "2023-04-22T03:15:10.167",
   "modified": "2026-06-17T05:41:22.700",
   "severity": "high",
   "summary": "NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, and data tampering.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "nvidia:bmc",
    "nvidia:dgx-1"
   ]
  },
  "CVE-2023-25508": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00237,
   "epss_date": "2026-10-28",
   "published": "2023-04-22T03:15:10.230",
   "modified": "2026-06-17T05:41:22.847",
   "severity": "high",
   "summary": "NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler, where an attacker with the appropriate level of authorization can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "nvidia:bmc",
    "nvidia:dgx-1"
   ]
  },
  "CVE-2023-25515": {
   "cvss": 7.6,
   "cvss_version": "3.1",
   "epss": 0.00225,
   "epss_date": "2026-10-28",
   "published": "2023-06-23T18:15:10.887",
   "modified": "2026-06-17T05:41:23.787",
   "severity": "high",
   "summary": "\n\n\nNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where unexpected untrusted data is parsed, which may lead to code execution, denial of service, escalation of privileges, data tampering, or information disclosure.\n\n \n\n",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "474.44",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "536.23",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "536.40",
     "platforms": [
      "gpu:studio"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "474.44",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "529.11",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "536.25",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "454.23",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "474.44",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "529.11",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "536.25",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.199.02",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.125.06",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "535.54.03",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "450",
     "versionEndExcluding": "450.248.02",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.199.02",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "525",
     "versionEndExcluding": "525.125.06",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "530",
     "versionEndExcluding": "535.54.03",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2023-25516": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.0023,
   "epss_date": "2026-10-28",
   "published": "2023-07-04T00:15:09.587",
   "modified": "2026-06-17T05:41:23.930",
   "severity": "high",
   "summary": "\nNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged user can cause an integer overflow, which may lead to information disclosure and denial of service.\n\n",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionEndIncluding": "11.12"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "13.0",
     "versionEndIncluding": "13.7"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "15.0",
     "versionEndIncluding": "15.2"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2023-25517": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.00166,
   "epss_date": "2026-10-28",
   "published": "2023-07-04T00:15:09.653",
   "modified": "2026-06-17T05:41:24.057",
   "severity": "high",
   "summary": "\nNVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest OS may be able to control resources for which it is not authorized, which may lead to information disclosure and data tampering.\n\n",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionEndExcluding": "11.13",
     "platforms": [
      "hv:citrix",
      "hv:redhat",
      "hv:vmware"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "13.0",
     "versionEndExcluding": "13.8",
     "platforms": [
      "hv:citrix",
      "hv:redhat",
      "hv:vmware"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "15.0",
     "versionEndExcluding": "15.3",
     "platforms": [
      "hv:citrix",
      "hv:redhat",
      "hv:vmware"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2023-25527": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00201,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-25527",
   "published": "2023-09-20T01:15:52.920",
   "modified": "2026-06-17T05:41:25.430",
   "severity": "high",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in the host KVM daemon, where an authenticated local attacker may cause corruption of kernel memory. A successful exploit of this vulnerability may lead to arbitrary kernel code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-25528": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.00874,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-25528",
   "published": "2023-09-20T01:15:53.253",
   "modified": "2026-06-17T05:41:25.567",
   "severity": "critical",
   "summary": "NVIDIA DGX H100 baseboard management controller (BMC) contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-25529": {
   "cvss": 8.1,
   "cvss_version": "3.1",
   "epss": 0.00625,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-25529",
   "published": "2023-09-20T01:15:53.497",
   "modified": "2026-06-17T05:41:25.707",
   "severity": "high",
   "summary": "NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of another user’s session token by observing timing discrepancies between server responses. A successful exploit of this vulnerability may lead to information disclosure, escalation of privileges, and data tampering.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-25530": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.00827,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-25530",
   "published": "2023-09-20T01:15:53.857",
   "modified": "2026-06-17T05:41:25.850",
   "severity": "critical",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in the KVM service, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, and information disclosure.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-25531": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.00478,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-25531",
   "published": "2023-09-20T01:15:54.297",
   "modified": "2026-06-17T05:41:25.987",
   "severity": "critical",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. A successful exploit of this vulnerability may lead to code execution, denial of service, information disclosure, and escalation of privileges.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-25532": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.00555,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-25532",
   "published": "2023-09-20T01:15:54.523",
   "modified": "2026-06-17T05:41:26.117",
   "severity": "high",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. A successful exploit of this vulnerability may lead to information disclosure.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-25533": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.00785,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-25533",
   "published": "2023-09-20T01:15:54.900",
   "modified": "2026-06-17T05:41:26.240",
   "severity": "critical",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in the web UI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to information disclosure, code execution, and escalation of privileges.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-25534": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.00555,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-25534",
   "published": "2023-09-20T01:15:55.260",
   "modified": "2026-06-17T05:41:26.370",
   "severity": "critical",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-25537": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.0018,
   "epss_date": "2026-10-28",
   "fixed_in": "2.18.1",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-25537",
   "published": "2023-05-22T11:15:09.333",
   "modified": "2026-06-17T05:41:26.760",
   "severity": "high",
   "summary": "\nDell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability. A local attacker with low privileges could potentially exploit this vulnerability leading to exposure of some SMRAM stack/data/code in System Management Mode, leading to arbitrary code execution or escalation of privilege.\n\n",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r540_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r540"
     ]
    },
    {
     "product": "poweredge_r440_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r440"
     ]
    },
    {
     "product": "poweredge_t440_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_t440"
     ]
    },
    {
     "product": "poweredge_xr2_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_xr2"
     ]
    },
    {
     "product": "poweredge_r740xd2_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r740xd2"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_t640_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_t640"
     ]
    },
    {
     "product": "poweredge_c6420_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_c6420"
     ]
    },
    {
     "product": "poweredge_fc640_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_fc640"
     ]
    },
    {
     "product": "poweredge_m640_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_m640"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    },
    {
     "product": "poweredge_c4140_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_c4140"
     ]
    },
    {
     "product": "poweredge_xe2420_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_xe2420"
     ]
    },
    {
     "product": "poweredge_xe7420_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_xe7420"
     ]
    },
    {
     "product": "poweredge_xe7440_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_xe7440"
     ]
    }
   ],
   "products": [
    "poweredge_c4140_firmware",
    "poweredge_c6420_firmware",
    "poweredge_fc640_firmware",
    "poweredge_m640_firmware",
    "poweredge_mx740c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r440_firmware",
    "poweredge_r540_firmware",
    "poweredge_r640_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd2_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r840_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware",
    "poweredge_t440_firmware",
    "poweredge_t640_firmware",
    "poweredge_xe2420_firmware",
    "poweredge_xe7420_firmware",
    "poweredge_xe7440_firmware",
    "poweredge_xr2_firmware"
   ]
  },
  "CVE-2023-25809": {
   "cvss": 6.3,
   "cvss_version": "3.1",
   "epss": 0.00319,
   "epss_date": "2026-10-28",
   "fixed_in": "1.1.5",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-25809",
   "published": "2023-03-29T19:15:22.170",
   "modified": "2026-06-17T05:42:01.917",
   "severity": "medium",
   "summary": "runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.\n",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndExcluding": "1.1.5"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2023-27561": {
   "cvss": 7,
   "cvss_version": "3.1",
   "epss": 0.00448,
   "epss_date": "2026-10-28",
   "fixed_in": "1.1.5",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-27561",
   "published": "2023-03-03T19:15:11.330",
   "modified": "2026-06-17T05:45:27.670",
   "severity": "high",
   "summary": "runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndExcluding": "1.1.5"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2023-28083": {
   "cvss": 5.4,
   "cvss_version": "3.1",
   "epss": 0.00445,
   "epss_date": "2026-10-28",
   "published": "2023-03-22T06:15:10.950",
   "modified": "2026-06-17T05:46:49.443",
   "severity": "medium",
   "summary": "A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). HPE has provided software updates to resolve this vulnerability in HPE Integrated Lights-Out.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_4",
     "versionEndExcluding": "2.82"
    },
    {
     "product": "integrated_lights-out_5",
     "versionEndExcluding": "2.78"
    },
    {
     "product": "integrated_lights-out_6",
     "versionEndExcluding": "1.20"
    }
   ],
   "products": [
    "hp:integrated_lights-out_4",
    "hpe:apollo_4200_gen9_server",
    "hpe:apollo_r2000_chassis",
    "hpe:proliant_bl420c_gen8_server",
    "hpe:proliant_bl460c_gen8_server_blade",
    "hpe:proliant_bl460c_gen9_server_blade",
    "hpe:proliant_bl465c_gen8_server_blade",
    "hpe:proliant_bl660c_gen8_server_blade",
    "hpe:proliant_bl660c_gen9_server",
    "hpe:proliant_dl120_gen9_server",
    "hpe:proliant_dl160_gen8_server",
    "hpe:proliant_dl160_gen9_server"
   ]
  },
  "CVE-2023-28642": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00343,
   "epss_date": "2026-10-28",
   "fixed_in": "1.1.5",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-28642",
   "published": "2023-03-29T19:15:22.397",
   "modified": "2026-06-17T05:48:27.157",
   "severity": "high",
   "summary": "runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.\n\n",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndExcluding": "1.1.5"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2023-28863": {
   "cvss": 9.1,
   "cvss_version": "3.1",
   "epss": 0.0035,
   "epss_date": "2026-10-28",
   "published": "2023-04-18T14:15:07.383",
   "modified": "2026-06-17T05:48:56.307",
   "severity": "critical",
   "summary": "AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-29056": {
   "cvss": 5.9,
   "cvss_version": "3.1",
   "epss": 0.00445,
   "epss_date": "2026-10-28",
   "published": "2023-04-28T22:15:09.073",
   "modified": "2026-06-17T05:49:16.320",
   "severity": "medium",
   "summary": "A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined.",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_hx1021",
    "lenovo:thinkagile_hx1021_firmware",
    "lenovo:thinkagile_hx1320",
    "lenovo:thinkagile_hx1320_firmware",
    "lenovo:thinkagile_hx5530",
    "lenovo:thinkagile_hx5530_firmware",
    "lenovo:thinkagile_hx7530",
    "lenovo:thinkagile_hx7530_firmware",
    "lenovo:thinkagile_hx_enclosure",
    "lenovo:thinkagile_hx_enclosure_firmware",
    "lenovo:thinkagile_vx3331",
    "lenovo:thinkagile_vx3331_firmware"
   ]
  },
  "CVE-2023-29057": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.005,
   "epss_date": "2026-10-28",
   "published": "2023-04-28T21:15:08.673",
   "modified": "2026-06-17T05:49:16.550",
   "severity": "high",
   "summary": "A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”.",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_hx1021",
    "lenovo:thinkagile_hx1021_firmware",
    "lenovo:thinkagile_hx1320",
    "lenovo:thinkagile_hx1320_firmware",
    "lenovo:thinkagile_hx5530",
    "lenovo:thinkagile_hx5530_firmware",
    "lenovo:thinkagile_hx7530",
    "lenovo:thinkagile_hx7530_firmware",
    "lenovo:thinkagile_hx_enclosure",
    "lenovo:thinkagile_hx_enclosure_firmware",
    "lenovo:thinkagile_vx3331",
    "lenovo:thinkagile_vx3331_firmware"
   ]
  },
  "CVE-2023-29058": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.0036,
   "epss_date": "2026-10-28",
   "published": "2023-04-28T21:15:08.750",
   "modified": "2026-06-17T05:49:16.770",
   "severity": "medium",
   "summary": "A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions.",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_hx1021",
    "lenovo:thinkagile_hx1021_firmware",
    "lenovo:thinkagile_hx1320",
    "lenovo:thinkagile_hx1320_firmware",
    "lenovo:thinkagile_hx5530",
    "lenovo:thinkagile_hx5530_firmware",
    "lenovo:thinkagile_hx7530",
    "lenovo:thinkagile_hx7530_firmware",
    "lenovo:thinkagile_hx_enclosure",
    "lenovo:thinkagile_hx_enclosure_firmware",
    "lenovo:thinkagile_vx3331",
    "lenovo:thinkagile_vx3331_firmware"
   ]
  },
  "CVE-2023-3043": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00308,
   "epss_date": "2026-10-28",
   "published": "2024-01-09T23:15:09.290",
   "modified": "2026-06-17T06:13:14.533",
   "severity": "high",
   "summary": "\n\n\n\n\n\n\n\n\nAMI’s SPx contains\na vulnerability in the BMC where an Attacker may\ncause a stack-based buffer overflow via an adjacent network. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability. \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-30911": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.00595,
   "epss_date": "2026-10-28",
   "published": "2023-10-18T18:15:09.033",
   "modified": "2026-06-17T05:55:52.870",
   "severity": "high",
   "summary": "HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionEndExcluding": "2.98"
    },
    {
     "product": "integrated_lights-out_6_firmware",
     "versionEndExcluding": "1.53"
    }
   ],
   "products": [
    "hpe:apollo_2000_system",
    "hpe:apollo_4200_gen10_plus_system",
    "hpe:apollo_4200_gen10_server",
    "hpe:apollo_4510_gen10_system",
    "hpe:apollo_6500_gen10_plus_system",
    "hpe:apollo_6500_gen10_system",
    "hpe:apollo_n2600_gen10_plus",
    "hpe:apollo_n2800_gen10_plus",
    "hpe:apollo_r2200_gen10",
    "hpe:apollo_r2600_gen10",
    "hpe:apollo_r2800_gen10",
    "hpe:integrated_lights-out_5_firmware"
   ]
  },
  "CVE-2023-31008": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00206,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-31008",
   "published": "2023-09-20T01:15:55.453",
   "modified": "2026-06-17T05:56:04.200",
   "severity": "high",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial of services, escalation of privileges, and information disclosure.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-31009": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.00708,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-31009",
   "published": "2023-09-20T01:15:55.823",
   "modified": "2026-06-17T05:56:04.367",
   "severity": "critical",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, and information disclosure.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-31010": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00693,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-31010",
   "published": "2023-09-20T02:15:18.130",
   "modified": "2026-06-17T05:56:04.523",
   "severity": "high",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges, information disclosure, and denial of service.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-31011": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00568,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-31011",
   "published": "2023-09-20T02:15:19.207",
   "modified": "2026-06-17T05:56:04.673",
   "severity": "high",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges and information disclosure.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-31012": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00639,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-31012",
   "published": "2023-09-20T02:15:19.680",
   "modified": "2026-06-17T05:56:04.830",
   "severity": "high",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges and information disclosure.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-31013": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00639,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-31013",
   "published": "2023-09-20T02:15:20.310",
   "modified": "2026-06-17T05:56:04.980",
   "severity": "high",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges and information disclosure.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-31015": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00192,
   "epss_date": "2026-10-28",
   "fixed_in": "23.08.18",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-31015",
   "published": "2023-09-20T02:15:21.413",
   "modified": "2026-06-17T05:56:05.270",
   "severity": "high",
   "summary": "NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication issue. A successful exploit of this vulnerability may lead to escalation of privileges, information disclosure, code execution, and denial of service.",
   "vendors": [
    "dgx"
   ],
   "ranges": [
    {
     "product": "dgx_h100_firmware",
     "versionEndExcluding": "23.08.18"
    }
   ],
   "products": [
    "nvidia:dgx_h100",
    "nvidia:dgx_h100_firmware"
   ]
  },
  "CVE-2023-31024": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.00644,
   "epss_date": "2026-10-28",
   "published": "2024-01-12T19:15:09.397",
   "modified": "2026-06-17T05:56:06.677",
   "severity": "critical",
   "summary": "NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause stack memory corruption by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "nvidia:dgx_a100",
    "nvidia:dgx_a100_firmware"
   ]
  },
  "CVE-2023-31025": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.00488,
   "epss_date": "2026-10-28",
   "published": "2024-01-12T19:15:09.627",
   "modified": "2026-06-17T05:56:06.833",
   "severity": "high",
   "summary": "NVIDIA DGX A100 BMC contains a vulnerability where an attacker may cause an LDAP user injection. A successful exploit of this vulnerability may lead to information disclosure.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "nvidia:dgx_a100",
    "nvidia:dgx_a100_firmware"
   ]
  },
  "CVE-2023-31030": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.00603,
   "epss_date": "2026-10-28",
   "published": "2024-01-12T19:15:10.067",
   "modified": "2026-06-17T05:56:07.573",
   "severity": "critical",
   "summary": "NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "nvidia:dgx_a100",
    "nvidia:dgx_a100_firmware"
   ]
  },
  "CVE-2023-31033": {
   "cvss": 8,
   "cvss_version": "3.1",
   "epss": 0.00305,
   "epss_date": "2026-10-28",
   "published": "2024-01-12T19:15:10.680",
   "modified": "2026-06-17T05:56:08.023",
   "severity": "high",
   "summary": "NVIDIA DGX A100 BMC contains a vulnerability where a user may cause a missing authentication issue for a critical function by an adjacent network . A successful exploit of this vulnerability may lead to escalation of privileges, code execution, denial of service, information disclosure, and data tampering.",
   "vendors": [
    "dgx"
   ],
   "products": [
    "nvidia:dgx_a100",
    "nvidia:dgx_a100_firmware"
   ]
  },
  "CVE-2023-31189": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00213,
   "epss_date": "2026-10-28",
   "published": "2024-02-14T14:15:50.310",
   "modified": "2026-06-17T05:56:30.307",
   "severity": "high",
   "summary": "Improper authentication in some Intel(R) Server Product OpenBMC firmware before version egs-1.09 may allow an authenticated user to enable escalation of privilege via local access.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "intel:openbmc",
    "intel:xeon_bronze_3408u",
    "intel:xeon_gold_5403n",
    "intel:xeon_gold_5411n",
    "intel:xeon_gold_5412u",
    "intel:xeon_gold_5415\\+",
    "intel:xeon_gold_5416s",
    "intel:xeon_gold_5418n",
    "intel:xeon_gold_5418y",
    "intel:xeon_gold_5420\\+",
    "intel:xeon_gold_5423n",
    "intel:xeon_gold_5433n"
   ]
  },
  "CVE-2023-32280": {
   "cvss": 5.3,
   "cvss_version": "3.1",
   "epss": 0.00484,
   "epss_date": "2026-10-28",
   "published": "2024-02-14T14:15:50.687",
   "modified": "2026-06-17T05:58:28.940",
   "severity": "medium",
   "summary": "Insufficiently protected credentials in some Intel(R) Server Product OpenBMC firmware before versions egs-1.05 may allow an unauthenticated user to enable information disclosure via network access.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "intel:openbmc",
    "intel:xeon_bronze_3408u",
    "intel:xeon_gold_5403n",
    "intel:xeon_gold_5411n",
    "intel:xeon_gold_5412u",
    "intel:xeon_gold_5415\\+",
    "intel:xeon_gold_5416s",
    "intel:xeon_gold_5418n",
    "intel:xeon_gold_5418y",
    "intel:xeon_gold_5420\\+",
    "intel:xeon_gold_5423n",
    "intel:xeon_gold_5433n"
   ]
  },
  "CVE-2023-32460": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00192,
   "epss_date": "2026-10-28",
   "published": "2023-12-08T06:15:45.427",
   "modified": "2026-06-17T05:58:53.037",
   "severity": "high",
   "summary": "\nDell PowerEdge BIOS contains an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.\n\n",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r660_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_r660"
     ]
    },
    {
     "product": "poweredge_r760_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_r760"
     ]
    },
    {
     "product": "poweredge_c6620_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_c6620"
     ]
    },
    {
     "product": "poweredge_mx760c_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_mx760c"
     ]
    },
    {
     "product": "poweredge_r860_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_r860"
     ]
    },
    {
     "product": "poweredge_r960_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_r960"
     ]
    },
    {
     "product": "poweredge_hs5610_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_hs5610"
     ]
    },
    {
     "product": "poweredge_hs5620_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_hs5620"
     ]
    },
    {
     "product": "poweredge_r660xs_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_r660xs"
     ]
    },
    {
     "product": "poweredge_r760xs_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_r760xs"
     ]
    },
    {
     "product": "poweredge_r760xd2_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_r760xd2"
     ]
    },
    {
     "product": "poweredge_t560_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_t560"
     ]
    },
    {
     "product": "poweredge_r760xa_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_r760xa"
     ]
    },
    {
     "product": "poweredge_xr5610_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_xr5610"
     ]
    },
    {
     "product": "poweredge_xr8610t_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_xr8610t"
     ]
    },
    {
     "product": "poweredge_xr8620t_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_xr8620t"
     ]
    },
    {
     "product": "poweredge_r6615_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_r6615"
     ]
    },
    {
     "product": "poweredge_r7615_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_r7615"
     ]
    },
    {
     "product": "poweredge_xr7620_firmware",
     "versionEndExcluding": "1.6.6",
     "platforms": [
      "cpe:dell:poweredge_xr7620"
     ]
    },
    {
     "product": "poweredge_xe8640_firmware",
     "versionEndExcluding": "1.3.6",
     "platforms": [
      "cpe:dell:poweredge_xe8640"
     ]
    },
    {
     "product": "poweredge_xe9640_firmware",
     "versionEndExcluding": "1.3.6",
     "platforms": [
      "cpe:dell:poweredge_xe9640"
     ]
    },
    {
     "product": "poweredge_xe9680_firmware",
     "versionEndExcluding": "1.3.6",
     "platforms": [
      "cpe:dell:poweredge_xe9680"
     ]
    },
    {
     "product": "poweredge_r6625_firmware",
     "versionEndExcluding": "1.6.8",
     "platforms": [
      "cpe:dell:poweredge_r6625"
     ]
    },
    {
     "product": "poweredge_r7625_firmware",
     "versionEndExcluding": "1.6.8",
     "platforms": [
      "cpe:dell:poweredge_r7625"
     ]
    },
    {
     "product": "poweredge_c6615_firmware",
     "versionEndExcluding": "1.1.2",
     "platforms": [
      "cpe:dell:poweredge_c6615"
     ]
    },
    {
     "product": "poweredge_r650_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_r650"
     ]
    },
    {
     "product": "poweredge_r750_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_r750"
     ]
    },
    {
     "product": "poweredge_r750xa_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_r750xa"
     ]
    },
    {
     "product": "poweredge_c6520_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_c6520"
     ]
    },
    {
     "product": "poweredge_mx750c_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_mx750c"
     ]
    },
    {
     "product": "poweredge_r550_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_r550"
     ]
    },
    {
     "product": "poweredge_r450_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_r450"
     ]
    },
    {
     "product": "poweredge_r650xs_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_r650xs"
     ]
    },
    {
     "product": "poweredge_r750xs_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_r750xs"
     ]
    },
    {
     "product": "poweredge_t550_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_t550"
     ]
    },
    {
     "product": "poweredge_xr11_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_xr11"
     ]
    },
    {
     "product": "poweredge_xr12_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_xr12"
     ]
    },
    {
     "product": "poweredge_t150_firmware",
     "versionEndExcluding": "1.8.1",
     "platforms": [
      "cpe:dell:poweredge_t150"
     ]
    },
    {
     "product": "poweredge_t350_firmware",
     "versionEndExcluding": "1.8.1",
     "platforms": [
      "cpe:dell:poweredge_t350"
     ]
    },
    {
     "product": "poweredge_r250_firmware",
     "versionEndExcluding": "1.8.1",
     "platforms": [
      "cpe:dell:poweredge_r250"
     ]
    },
    {
     "product": "poweredge_r350_firmware",
     "versionEndExcluding": "1.8.1",
     "platforms": [
      "cpe:dell:poweredge_r350"
     ]
    },
    {
     "product": "poweredge_xr4510c_firmware",
     "versionEndExcluding": "1.13.3",
     "platforms": [
      "cpe:dell:poweredge_xr4510c"
     ]
    },
    {
     "product": "poweredge_xr4520c_firmware",
     "versionEndExcluding": "1.13.3",
     "platforms": [
      "cpe:dell:poweredge_xr4520c"
     ]
    },
    {
     "product": "poweredge_r6515_firmware",
     "versionEndExcluding": "2.13.3",
     "platforms": [
      "cpe:dell:poweredge_r6515"
     ]
    },
    {
     "product": "poweredge_r6525_firmware",
     "versionEndExcluding": "2.13.3",
     "platforms": [
      "cpe:dell:poweredge_r6525"
     ]
    },
    {
     "product": "poweredge_r7515_firmware",
     "versionEndExcluding": "2.13.3",
     "platforms": [
      "cpe:dell:poweredge_r7515"
     ]
    },
    {
     "product": "poweredge_r7525_firmware",
     "versionEndExcluding": "2.13.3",
     "platforms": [
      "cpe:dell:poweredge_r7525"
     ]
    },
    {
     "product": "poweredge_c6525_firmware",
     "versionEndExcluding": "2.13.3",
     "platforms": [
      "cpe:dell:poweredge_c6525"
     ]
    },
    {
     "product": "poweredge_xe8545_firmware",
     "versionEndExcluding": "2.13.3",
     "platforms": [
      "cpe:dell:poweredge_xe8545"
     ]
    },
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    },
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r540_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_r540"
     ]
    },
    {
     "product": "poweredge_r440_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_r440"
     ]
    },
    {
     "product": "poweredge_t440_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_t440"
     ]
    },
    {
     "product": "poweredge_xr2_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_xr2"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_t640_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_t640"
     ]
    },
    {
     "product": "poweredge_c6420_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_c6420"
     ]
    },
    {
     "product": "poweredge_fc640_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_fc640"
     ]
    },
    {
     "product": "poweredge_m640_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_m640"
     ]
    },
    {
     "product": "poweredge_c4140_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_c4140"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r740xd2_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_r740xd2"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_xe2420_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_xe2420"
     ]
    },
    {
     "product": "poweredge_xe7420_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_xe7420"
     ]
    },
    {
     "product": "poweredge_xe7440_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_xe7440"
     ]
    },
    {
     "product": "poweredge_t140_firmware",
     "versionEndExcluding": "2.15.1",
     "platforms": [
      "cpe:dell:poweredge_t140"
     ]
    },
    {
     "product": "poweredge_t340_firmware",
     "versionEndExcluding": "2.15.1",
     "platforms": [
      "cpe:dell:poweredge_t340"
     ]
    },
    {
     "product": "poweredge_r240_firmware",
     "versionEndExcluding": "2.15.1",
     "platforms": [
      "cpe:dell:poweredge_r240"
     ]
    },
    {
     "product": "poweredge_r340_firmware",
     "versionEndExcluding": "2.15.1",
     "platforms": [
      "cpe:dell:poweredge_r340"
     ]
    },
    {
     "product": "poweredge_r6415_firmware",
     "versionEndExcluding": "1.21.0",
     "platforms": [
      "cpe:dell:poweredge_r6415"
     ]
    },
    {
     "product": "poweredge_r7415_firmware",
     "versionEndExcluding": "1.21.0",
     "platforms": [
      "cpe:dell:poweredge_r7415"
     ]
    },
    {
     "product": "poweredge_r7425_firmware",
     "versionEndExcluding": "1.21.0",
     "platforms": [
      "cpe:dell:poweredge_r7425"
     ]
    },
    {
     "product": "poweredge_r930_firmware",
     "versionEndExcluding": "2.13.0",
     "platforms": [
      "cpe:dell:poweredge_r930"
     ]
    },
    {
     "product": "poweredge_r730_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r730"
     ]
    },
    {
     "product": "poweredge_r730xd_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r730xd"
     ]
    },
    {
     "product": "poweredge_r630_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r630"
     ]
    },
    {
     "product": "poweredge_c4130_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_c4130"
     ]
    },
    {
     "product": "poweredge_m630_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_m630"
     ]
    },
    {
     "product": "poweredge_fc630_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_fc630"
     ]
    },
    {
     "product": "poweredge_fc430_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_fc430"
     ]
    },
    {
     "product": "poweredge_m830_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_m830"
     ]
    },
    {
     "product": "poweredge_fc830_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_fc830"
     ]
    },
    {
     "product": "poweredge_t630_firmware",
     "versionEndExcluding": "2.18.2",
     "platforms": [
      "cpe:dell:poweredge_t630"
     ]
    },
    {
     "product": "poweredge_r530_firmware",
     "versionEndExcluding": "2.18.2",
     "platforms": [
      "cpe:dell:poweredge_r530"
     ]
    },
    {
     "product": "poweredge_r430_firmware",
     "versionEndExcluding": "2.18.2",
     "platforms": [
      "cpe:dell:poweredge_r430"
     ]
    },
    {
     "product": "poweredge_t430_firmware",
     "versionEndExcluding": "2.18.2",
     "platforms": [
      "cpe:dell:poweredge_t430"
     ]
    },
    {
     "product": "poweredge_c6320_firmware",
     "versionEndExcluding": "2.18.2",
     "platforms": [
      "cpe:dell:poweredge_c6320"
     ]
    },
    {
     "product": "poweredge_t130_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_t130"
     ]
    },
    {
     "product": "poweredge_r230_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_r230"
     ]
    },
    {
     "product": "poweredge_t330_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_t330"
     ]
    },
    {
     "product": "poweredge_r330_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_r330"
     ]
    },
    {
     "product": "poweredge_r830_firmware",
     "versionEndExcluding": "1.18.1",
     "platforms": [
      "cpe:dell:poweredge_r830"
     ]
    },
    {
     "product": "poweredge_m640_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.20.1",
     "platforms": [
      "cpe:dell:poweredge_m640_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_m630_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_m630_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_m830_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_m830_\\(pe_vrtx\\)"
     ]
    }
   ],
   "products": [
    "poweredge_c4130_firmware",
    "poweredge_c4140_firmware",
    "poweredge_c6320_firmware",
    "poweredge_c6420_firmware",
    "poweredge_c6520_firmware",
    "poweredge_c6525_firmware",
    "poweredge_c6615_firmware",
    "poweredge_c6620_firmware",
    "poweredge_fc430_firmware",
    "poweredge_fc630_firmware",
    "poweredge_fc640_firmware",
    "poweredge_fc830_firmware",
    "poweredge_hs5610_firmware",
    "poweredge_hs5620_firmware",
    "poweredge_m630_\\(pe_vrtx\\)_firmware",
    "poweredge_m630_firmware",
    "poweredge_m640_\\(pe_vrtx\\)_firmware",
    "poweredge_m640_firmware",
    "poweredge_m830_\\(pe_vrtx\\)_firmware",
    "poweredge_m830_firmware",
    "poweredge_mx740c_firmware",
    "poweredge_mx750c_firmware",
    "poweredge_mx760c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r230_firmware",
    "poweredge_r240_firmware",
    "poweredge_r250_firmware",
    "poweredge_r330_firmware",
    "poweredge_r340_firmware",
    "poweredge_r350_firmware",
    "poweredge_r430_firmware",
    "poweredge_r440_firmware",
    "poweredge_r450_firmware",
    "poweredge_r530_firmware",
    "poweredge_r540_firmware",
    "poweredge_r550_firmware",
    "poweredge_r630_firmware",
    "poweredge_r640_firmware",
    "poweredge_r6415_firmware",
    "poweredge_r650_firmware",
    "poweredge_r650xs_firmware",
    "poweredge_r6515_firmware",
    "poweredge_r6525_firmware",
    "poweredge_r660_firmware",
    "poweredge_r660xs_firmware",
    "poweredge_r6615_firmware",
    "poweredge_r6625_firmware",
    "poweredge_r730_firmware",
    "poweredge_r730xd_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd2_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r7415_firmware",
    "poweredge_r7425_firmware",
    "poweredge_r750_firmware",
    "poweredge_r750xa_firmware",
    "poweredge_r750xs_firmware",
    "poweredge_r7515_firmware",
    "poweredge_r7525_firmware",
    "poweredge_r760_firmware",
    "poweredge_r760xa_firmware",
    "poweredge_r760xd2_firmware",
    "poweredge_r760xs_firmware",
    "poweredge_r7615_firmware",
    "poweredge_r7625_firmware",
    "poweredge_r830_firmware",
    "poweredge_r840_firmware",
    "poweredge_r860_firmware",
    "poweredge_r930_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware",
    "poweredge_r960_firmware",
    "poweredge_t130_firmware",
    "poweredge_t140_firmware",
    "poweredge_t150_firmware",
    "poweredge_t330_firmware",
    "poweredge_t340_firmware",
    "poweredge_t350_firmware",
    "poweredge_t430_firmware",
    "poweredge_t440_firmware",
    "poweredge_t550_firmware",
    "poweredge_t560_firmware",
    "poweredge_t630_firmware",
    "poweredge_t640_firmware",
    "poweredge_xe2420_firmware",
    "poweredge_xe7420_firmware",
    "poweredge_xe7440_firmware",
    "poweredge_xe8545_firmware",
    "poweredge_xe8640_firmware",
    "poweredge_xe9640_firmware",
    "poweredge_xe9680_firmware",
    "poweredge_xr11_firmware",
    "poweredge_xr12_firmware",
    "poweredge_xr2_firmware",
    "poweredge_xr4510c_firmware",
    "poweredge_xr4520c_firmware",
    "poweredge_xr5610_firmware",
    "poweredge_xr7620_firmware",
    "poweredge_xr8610t_firmware",
    "poweredge_xr8620t_firmware"
   ]
  },
  "CVE-2023-32461": {
   "cvss": 6.7,
   "cvss_version": "3.1",
   "epss": 0.00174,
   "epss_date": "2026-10-28",
   "published": "2023-09-15T07:15:09.550",
   "modified": "2026-06-17T05:58:53.280",
   "severity": "medium",
   "summary": "\nDell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability.  A local malicious user with high privileges could potentially exploit this vulnerability, leading to corrupt memory and potentially escalate privileges.  \n\n",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r660_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r660"
     ]
    },
    {
     "product": "poweredge_r760_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r760"
     ]
    },
    {
     "product": "poweredge_c6620_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_c6620"
     ]
    },
    {
     "product": "poweredge_mx760c_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_mx760c"
     ]
    },
    {
     "product": "poweredge_r860_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r860"
     ]
    },
    {
     "product": "poweredge_r960_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r960"
     ]
    },
    {
     "product": "poweredge_hs5610_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_hs5610"
     ]
    },
    {
     "product": "poweredge_hs5620_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_hs5620"
     ]
    },
    {
     "product": "poweredge_r660xs_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r660xs"
     ]
    },
    {
     "product": "poweredge_r760xs_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r760xs"
     ]
    },
    {
     "product": "poweredge_r760xd2_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r760xd2"
     ]
    },
    {
     "product": "poweredge_t560_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_t560"
     ]
    },
    {
     "product": "poweredge_r760xa_firmware",
     "versionEndExcluding": "1.1.3",
     "platforms": [
      "cpe:dell:poweredge_r760xa"
     ]
    },
    {
     "product": "poweredge_xe9680_firmware",
     "versionEndExcluding": "1.1.3",
     "platforms": [
      "cpe:dell:poweredge_xe9680"
     ]
    },
    {
     "product": "poweredge_xr5610_firmware",
     "versionEndExcluding": "1.1.4",
     "platforms": [
      "cpe:dell:poweredge_xr5610"
     ]
    },
    {
     "product": "poweredge_xr8620t_firmware",
     "versionEndExcluding": "1.1.3",
     "platforms": [
      "cpe:dell:poweredge_xr8620t"
     ]
    },
    {
     "product": "poweredge_xr7620_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_xr7620"
     ]
    },
    {
     "product": "poweredge_xe8640_firmware",
     "versionEndExcluding": "1.2.5",
     "platforms": [
      "cpe:dell:poweredge_xe8640"
     ]
    },
    {
     "product": "poweredge_r6615_firmware",
     "versionEndExcluding": "1.3.11",
     "platforms": [
      "cpe:dell:poweredge_r6615"
     ]
    },
    {
     "product": "poweredge_r7615_firmware",
     "versionEndExcluding": "1.3.11",
     "platforms": [
      "cpe:dell:poweredge_r7615"
     ]
    },
    {
     "product": "poweredge_r6625_firmware",
     "versionEndExcluding": "1.3.11",
     "platforms": [
      "cpe:dell:poweredge_r6625"
     ]
    },
    {
     "product": "poweredge_r7625_firmware",
     "versionEndExcluding": "1.3.11",
     "platforms": [
      "cpe:dell:poweredge_r7625"
     ]
    },
    {
     "product": "poweredge_r650_firmware",
     "versionEndExcluding": "1.10.2",
     "platforms": [
      "cpe:dell:poweredge_r650"
     ]
    },
    {
     "product": "poweredge_r750_firmware",
     "versionEndExcluding": "1.10.2",
     "platforms": [
      "cpe:dell:poweredge_r750"
     ]
    },
    {
     "product": "poweredge_r750xa_firmware",
     "versionEndExcluding": "1.10.2",
     "platforms": [
      "cpe:dell:poweredge_r750xa"
     ]
    },
    {
     "product": "poweredge_c6520_firmware",
     "versionEndExcluding": "1.10.2",
     "platforms": [
      "cpe:dell:poweredge_c6520"
     ]
    },
    {
     "product": "poweredge_mx750c_firmware",
     "versionEndExcluding": "1.10.2",
     "platforms": [
      "cpe:dell:poweredge_mx750c"
     ]
    },
    {
     "product": "poweredge_r550_firmware",
     "versionEndExcluding": "1.10.2",
     "platforms": [
      "cpe:dell:poweredge_r550"
     ]
    },
    {
     "product": "poweredge_r450_firmware",
     "versionEndExcluding": "1.10.2",
     "platforms": [
      "cpe:dell:poweredge_r450"
     ]
    },
    {
     "product": "poweredge_r650xs_firmware",
     "versionEndExcluding": "1.10.2",
     "platforms": [
      "cpe:dell:poweredge_r650xs"
     ]
    },
    {
     "product": "poweredge_r750xs_firmware",
     "versionEndExcluding": "1.10.2",
     "platforms": [
      "cpe:dell:poweredge_r750xs"
     ]
    },
    {
     "product": "poweredge_t550_firmware",
     "versionEndExcluding": "1.10.2",
     "platforms": [
      "cpe:dell:poweredge_t550"
     ]
    },
    {
     "product": "poweredge_xr11_firmware",
     "versionEndExcluding": "1.10.2",
     "platforms": [
      "cpe:dell:poweredge_xr11"
     ]
    },
    {
     "product": "poweredge_xr12_firmware",
     "versionEndExcluding": "1.10.2",
     "platforms": [
      "cpe:dell:poweredge_xr12"
     ]
    },
    {
     "product": "poweredge_t150_firmware",
     "versionEndExcluding": "1.6.3",
     "platforms": [
      "cpe:dell:poweredge_t150"
     ]
    },
    {
     "product": "poweredge_t350_firmware",
     "versionEndExcluding": "1.6.3",
     "platforms": [
      "cpe:dell:poweredge_t350"
     ]
    },
    {
     "product": "poweredge_r250_firmware",
     "versionEndExcluding": "1.6.3",
     "platforms": [
      "cpe:dell:poweredge_r250"
     ]
    },
    {
     "product": "poweredge_r350_firmware",
     "versionEndExcluding": "1.6.3",
     "platforms": [
      "cpe:dell:poweredge_r350"
     ]
    },
    {
     "product": "poweredge_xr4510c_firmware",
     "versionEndExcluding": "1.10.4",
     "platforms": [
      "cpe:dell:poweredge_xr4510c"
     ]
    },
    {
     "product": "poweredge_xr4520c_firmware",
     "versionEndExcluding": "1.10.4",
     "platforms": [
      "cpe:dell:poweredge_xr4520c"
     ]
    },
    {
     "product": "poweredge_xr4520c_firmware",
     "eq": "1.10.4",
     "platforms": [
      "cpe:dell:poweredge_xr4520c"
     ]
    },
    {
     "product": "poweredge_r6515_firmware",
     "versionEndExcluding": "2.11.4",
     "platforms": [
      "cpe:dell:poweredge_r6515"
     ]
    },
    {
     "product": "poweredge_r6525_firmware",
     "versionEndExcluding": "2.11.3",
     "platforms": [
      "cpe:dell:poweredge_r6525"
     ]
    },
    {
     "product": "poweredge_r7515_firmware",
     "versionEndExcluding": "2.11.4",
     "platforms": [
      "cpe:dell:poweredge_r7515"
     ]
    },
    {
     "product": "poweredge_r7525_firmware",
     "versionEndExcluding": "2.11.3",
     "platforms": [
      "cpe:dell:poweredge_r7525"
     ]
    },
    {
     "product": "poweredge_c6525_firmware",
     "versionEndExcluding": "2.11.3",
     "platforms": [
      "cpe:dell:poweredge_c6525"
     ]
    },
    {
     "product": "poweredge_xe8545_firmware",
     "versionEndExcluding": "2.11.3",
     "platforms": [
      "cpe:dell:poweredge_xe8545"
     ]
    }
   ],
   "products": [
    "poweredge_c6520_firmware",
    "poweredge_c6525_firmware",
    "poweredge_c6620_firmware",
    "poweredge_hs5610_firmware",
    "poweredge_hs5620_firmware",
    "poweredge_mx750c_firmware",
    "poweredge_mx760c_firmware",
    "poweredge_r250_firmware",
    "poweredge_r350_firmware",
    "poweredge_r450_firmware",
    "poweredge_r550_firmware",
    "poweredge_r650_firmware",
    "poweredge_r650xs_firmware",
    "poweredge_r6515_firmware",
    "poweredge_r6525_firmware",
    "poweredge_r660_firmware",
    "poweredge_r660xs_firmware",
    "poweredge_r6615_firmware",
    "poweredge_r6625_firmware",
    "poweredge_r750_firmware",
    "poweredge_r750xa_firmware",
    "poweredge_r750xs_firmware",
    "poweredge_r7515_firmware",
    "poweredge_r7525_firmware",
    "poweredge_r760_firmware",
    "poweredge_r760xa_firmware",
    "poweredge_r760xd2_firmware",
    "poweredge_r760xs_firmware",
    "poweredge_r7615_firmware",
    "poweredge_r7625_firmware",
    "poweredge_r860_firmware",
    "poweredge_r960_firmware",
    "poweredge_t150_firmware",
    "poweredge_t350_firmware",
    "poweredge_t550_firmware",
    "poweredge_t560_firmware",
    "poweredge_xe8545_firmware",
    "poweredge_xe8640_firmware",
    "poweredge_xe9680_firmware",
    "poweredge_xr11_firmware",
    "poweredge_xr12_firmware",
    "poweredge_xr4510c_firmware",
    "poweredge_xr4520c_firmware",
    "poweredge_xr5610_firmware",
    "poweredge_xr7620_firmware",
    "poweredge_xr8620t_firmware"
   ]
  },
  "CVE-2023-34329": {
   "cvss": 8,
   "cvss_version": "3.1",
   "epss": 0.01186,
   "epss_date": "2026-10-28",
   "published": "2023-07-18T18:15:12.193",
   "modified": "2026-06-17T06:03:24.403",
   "severity": "high",
   "summary": "AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-34330": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00563,
   "epss_date": "2026-10-28",
   "published": "2023-07-18T18:15:12.287",
   "modified": "2026-06-17T06:03:24.540",
   "severity": "high",
   "summary": "AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-34332": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00178,
   "epss_date": "2026-10-28",
   "published": "2024-01-09T23:15:07.817",
   "modified": "2026-06-17T06:03:24.673",
   "severity": "high",
   "summary": "\n\n\n\n\n\n\n\n\n\n\nAMI’s SPx contains\na vulnerability in the BMC where an Attacker\nmay cause an untrusted pointer to dereference by a local network. A successful\nexploitation of this vulnerability may lead to a loss of confidentiality,\nintegrity, and/or availability. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-34333": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00178,
   "epss_date": "2026-10-28",
   "published": "2024-01-09T23:15:08.223",
   "modified": "2026-06-17T06:03:24.803",
   "severity": "high",
   "summary": "\n\n\n\n\n\n\n\n\n\n\nAMI’s SPx contains\na vulnerability in the BMC where an Attacker may cause an\nuntrusted pointer to dereference via a local network. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability.\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-34335": {
   "cvss": 9.1,
   "cvss_version": "3.1",
   "epss": 0.00393,
   "epss_date": "2026-10-28",
   "published": "2023-06-12T18:15:10.320",
   "modified": "2026-06-17T06:03:25.073",
   "severity": "critical",
   "summary": "AMI BMC contains a vulnerability in the IPMI handler, where an\nunauthenticated host is allowed to write to a host SPI flash, bypassing secure\nboot protections. An exploitation of this vulnerability may lead to a loss of\nintegrity or denial of service.\n\n\n\n\n\n \n\n\n\n\n\n\n\n",
   "vendors": [
    "megarac"
   ],
   "ranges": [
    {
     "product": "megarac_spx",
     "versionStartIncluding": "12.0",
     "versionEndExcluding": "12.7"
    },
    {
     "product": "megarac_spx",
     "versionStartIncluding": "13.0",
     "versionEndExcluding": "13.5"
    }
   ],
   "products": [
    "ami:megarac_spx"
   ]
  },
  "CVE-2023-34337": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00197,
   "epss_date": "2026-10-28",
   "published": "2023-07-05T19:15:09.800",
   "modified": "2026-06-17T06:03:25.330",
   "severity": "high",
   "summary": "\nAMI SPx contains a vulnerability in the BMC where a user may cause an inadequate encryption strength by hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability. \n\n\n\n",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-34338": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.0029,
   "epss_date": "2026-10-28",
   "published": "2023-07-05T19:15:09.877",
   "modified": "2026-06-17T06:03:25.467",
   "severity": "critical",
   "summary": "AMI SPx contains a vulnerability in the BMC where an Attacker may cause a use of hard-coded cryptographic key by a hard-coded certificate. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability. ",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-34471": {
   "cvss": 8.1,
   "cvss_version": "3.1",
   "epss": 0.00304,
   "epss_date": "2026-10-28",
   "published": "2023-07-05T19:15:09.947",
   "modified": "2026-06-17T06:03:43.327",
   "severity": "high",
   "summary": "\n AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to the loss confidentiality, integrity, and authentication.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-34472": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.00482,
   "epss_date": "2026-10-28",
   "published": "2023-07-05T19:15:10.017",
   "modified": "2026-06-17T06:03:43.443",
   "severity": "medium",
   "summary": "AMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A successful exploit of this vulnerability may lead to a loss of integrity.\n\n\n\n",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-34473": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00468,
   "epss_date": "2026-10-28",
   "published": "2023-07-05T19:15:10.083",
   "modified": "2026-06-17T06:03:43.567",
   "severity": "high",
   "summary": "\nAMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability. \n\n",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-35123": {
   "cvss": 5.9,
   "cvss_version": "4.0",
   "epss": 0.00443,
   "epss_date": "2026-10-28",
   "published": "2024-08-14T14:15:13.273",
   "modified": "2026-06-17T06:04:26.580",
   "severity": "medium",
   "summary": "Uncaught exception in OpenBMC Firmware for some Intel(R) Server Platforms before versions egs-1.14-0, bhs-0.27 may allow an authenticated user to potentially enable denial of service via network access.",
   "vendors": [
    "megarac"
   ]
  },
  "CVE-2023-35861": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.02108,
   "epss_date": "2026-10-28",
   "fixed_in": "03.10.35",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2023-35861",
   "published": "2023-07-31T13:15:09.833",
   "modified": "2026-06-17T06:05:21.837",
   "severity": "critical",
   "summary": "A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC.",
   "vendors": [
    "supermicro"
   ],
   "ranges": [
    {
     "product": "h12dst-b_firmware",
     "versionEndExcluding": "03.10.35"
    }
   ],
   "products": [
    "supermicro:h12dst-b",
    "supermicro:h12dst-b_firmware",
    "supermicro:x13dai-t",
    "supermicro:x13dai-t_firmware",
    "supermicro:x13ddw-a",
    "supermicro:x13ddw-a_firmware",
    "supermicro:x13deg-oa",
    "supermicro:x13deg-oa_firmware",
    "supermicro:x13deg-oad",
    "supermicro:x13deg-oad_firmware",
    "supermicro:x13deg-pvc",
    "supermicro:x13deg-pvc_firmware"
   ]
  },
  "CVE-2023-37293": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00308,
   "epss_date": "2026-10-28",
   "published": "2024-01-09T23:15:08.413",
   "modified": "2026-06-17T06:07:54.310",
   "severity": "high",
   "summary": "AMI’s SPx contains\na vulnerability in the BMC where an Attacker may cause a\nstack-based buffer overflow via an adjacent network. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability. \n\n\n\n\n\n\n\n",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-37294": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00259,
   "epss_date": "2026-10-28",
   "published": "2024-01-09T23:15:08.600",
   "modified": "2026-06-17T06:07:54.527",
   "severity": "high",
   "summary": "\n\n\n\n\n\n\nAMI’s\nSPx contains a vulnerability in the BMC where an Attacker may\ncause a heap memory corruption via an adjacent network. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability. \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-37295": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00259,
   "epss_date": "2026-10-28",
   "published": "2024-01-09T23:15:08.770",
   "modified": "2026-06-17T06:07:54.650",
   "severity": "high",
   "summary": "\n\n\n\n\nAMI’s\nSPx contains a vulnerability in the BMC where an Attacker may\ncause a heap memory corruption via an adjacent network. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability. \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-37296": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00259,
   "epss_date": "2026-10-28",
   "published": "2024-01-09T23:15:08.940",
   "modified": "2026-06-17T06:07:54.777",
   "severity": "high",
   "summary": "\n\n\nAMI’s\nSPx contains a vulnerability in the BMC where an Attacker may\ncause a stack memory corruption via an adjacent network. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability. \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-37297": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00259,
   "epss_date": "2026-10-28",
   "published": "2024-01-09T23:15:09.110",
   "modified": "2026-06-17T06:07:54.897",
   "severity": "high",
   "summary": "\nAMI’s\nSPx contains a vulnerability in the BMC where an Attacker may\ncause a heap memory corruption via an adjacent network. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability. \n\n\n\n\n\n\n\n \n\n\n\n\n\n\n\n",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x"
   ]
  },
  "CVE-2023-40289": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.18408,
   "epss_date": "2026-10-28",
   "published": "2024-03-27T04:15:10.220",
   "modified": "2026-06-17T06:17:05.183",
   "severity": "high",
   "summary": "A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges.",
   "vendors": [
    "supermicro"
   ],
   "ranges": [
    {
     "product": "x11ssm-f_firmware",
     "eq": "1.66"
    },
    {
     "product": "x11sae-f_firmware",
     "eq": "1.66"
    },
    {
     "product": "x11sse-f_firmware",
     "eq": "1.66"
    }
   ],
   "products": [
    "supermicro:x11sae-f",
    "supermicro:x11sae-f_firmware",
    "supermicro:x11sse-f",
    "supermicro:x11sse-f_firmware",
    "supermicro:x11ssm-f",
    "supermicro:x11ssm-f_firmware"
   ]
  },
  "CVE-2023-44297": {
   "cvss": 6.8,
   "cvss_version": "3.1",
   "epss": 0.00253,
   "epss_date": "2026-10-28",
   "published": "2023-12-05T16:15:07.097",
   "modified": "2026-06-17T06:27:19.113",
   "severity": "medium",
   "summary": "\nDell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information disclosure, information tampering, code execution, denial of service.\n\n",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r660_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r660"
     ]
    },
    {
     "product": "poweredge_r760_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r760"
     ]
    },
    {
     "product": "poweredge_c6620_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_c6620"
     ]
    },
    {
     "product": "poweredge_mx760c_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_mx760c"
     ]
    },
    {
     "product": "poweredge_r860_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r860"
     ]
    },
    {
     "product": "poweredge_r960_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r960"
     ]
    },
    {
     "product": "poweredge_hs5610_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_hs5610"
     ]
    },
    {
     "product": "poweredge_hs5620_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_hs5620"
     ]
    },
    {
     "product": "poweredge_r660xs_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r660xs"
     ]
    },
    {
     "product": "poweredge_r760xs_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r760xs"
     ]
    },
    {
     "product": "poweredge_r760xd2_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r760xd2"
     ]
    },
    {
     "product": "poweredge_t560_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_t560"
     ]
    },
    {
     "product": "poweredge_r760xa_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r760xa"
     ]
    }
   ],
   "products": [
    "poweredge_c6620_firmware",
    "poweredge_hs5610_firmware",
    "poweredge_hs5620_firmware",
    "poweredge_mx760c_firmware",
    "poweredge_r660_firmware",
    "poweredge_r660xs_firmware",
    "poweredge_r760_firmware",
    "poweredge_r760xa_firmware",
    "poweredge_r760xd2_firmware",
    "poweredge_r760xs_firmware",
    "poweredge_r860_firmware",
    "poweredge_r960_firmware",
    "poweredge_t560_firmware"
   ]
  },
  "CVE-2023-44298": {
   "cvss": 6.8,
   "cvss_version": "3.1",
   "epss": 0.00244,
   "epss_date": "2026-10-28",
   "published": "2023-12-05T16:15:07.333",
   "modified": "2026-06-17T06:27:19.263",
   "severity": "medium",
   "summary": "\nDell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information tampering, code execution, denial of service.\n\n",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r660_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r660"
     ]
    },
    {
     "product": "poweredge_r760_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r760"
     ]
    },
    {
     "product": "poweredge_c6620_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_c6620"
     ]
    },
    {
     "product": "poweredge_mx760c_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_mx760c"
     ]
    },
    {
     "product": "poweredge_r860_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r860"
     ]
    },
    {
     "product": "poweredge_r960_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r960"
     ]
    },
    {
     "product": "poweredge_hs5610_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_hs5610"
     ]
    },
    {
     "product": "poweredge_hs5620_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_hs5620"
     ]
    },
    {
     "product": "poweredge_r660xs_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r660xs"
     ]
    },
    {
     "product": "poweredge_r760xs_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r760xs"
     ]
    },
    {
     "product": "poweredge_r760xd2_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r760xd2"
     ]
    },
    {
     "product": "poweredge_t560_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_t560"
     ]
    },
    {
     "product": "poweredge_r760xa_firmware",
     "eq": "1.4.4",
     "platforms": [
      "cpe:dell:poweredge_r760xa"
     ]
    }
   ],
   "products": [
    "poweredge_c6620_firmware",
    "poweredge_hs5610_firmware",
    "poweredge_hs5620_firmware",
    "poweredge_mx760c_firmware",
    "poweredge_r660_firmware",
    "poweredge_r660xs_firmware",
    "poweredge_r760_firmware",
    "poweredge_r760xa_firmware",
    "poweredge_r760xd2_firmware",
    "poweredge_r760xs_firmware",
    "poweredge_r860_firmware",
    "poweredge_r960_firmware",
    "poweredge_t560_firmware"
   ]
  },
  "CVE-2023-4606": {
   "cvss": 8.1,
   "cvss_version": "3.1",
   "epss": 0.00556,
   "epss_date": "2026-10-28",
   "published": "2023-10-25T18:17:41.487",
   "modified": "2026-06-17T06:38:12.253",
   "severity": "high",
   "summary": "An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.  \n\nThis affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_hx1331",
    "lenovo:thinkagile_hx1331_firmware",
    "lenovo:thinkagile_hx2330",
    "lenovo:thinkagile_hx2330_firmware",
    "lenovo:thinkagile_hx2331",
    "lenovo:thinkagile_hx2331_firmware",
    "lenovo:thinkagile_hx5530",
    "lenovo:thinkagile_hx5530_firmware",
    "lenovo:thinkagile_hx7530",
    "lenovo:thinkagile_hx7530_firmware",
    "lenovo:thinkagile_vx3331",
    "lenovo:thinkagile_vx3331_firmware"
   ]
  },
  "CVE-2023-4607": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00517,
   "epss_date": "2026-10-28",
   "published": "2023-10-25T18:17:41.560",
   "modified": "2026-06-17T06:38:12.437",
   "severity": "high",
   "summary": "An authenticated XCC user can change permissions for any user through a crafted API command.",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_hx1331",
    "lenovo:thinkagile_hx1331_firmware",
    "lenovo:thinkagile_hx2330",
    "lenovo:thinkagile_hx2330_firmware",
    "lenovo:thinkagile_hx2331",
    "lenovo:thinkagile_hx2331_firmware",
    "lenovo:thinkagile_hx5530",
    "lenovo:thinkagile_hx5530_firmware",
    "lenovo:thinkagile_hx7530",
    "lenovo:thinkagile_hx7530_firmware",
    "lenovo:thinkagile_vx3331",
    "lenovo:thinkagile_vx3331_firmware"
   ]
  },
  "CVE-2023-4608": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.00405,
   "epss_date": "2026-10-28",
   "published": "2023-10-25T18:17:41.670",
   "modified": "2026-06-17T06:38:13.017",
   "severity": "high",
   "summary": "An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. \n\nThis affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.",
   "vendors": [
    "xcc"
   ],
   "products": [
    "lenovo:thinkagile_hx1331",
    "lenovo:thinkagile_hx1331_firmware",
    "lenovo:thinkagile_hx2330",
    "lenovo:thinkagile_hx2330_firmware",
    "lenovo:thinkagile_hx2331",
    "lenovo:thinkagile_hx2331_firmware",
    "lenovo:thinkagile_hx5530",
    "lenovo:thinkagile_hx5530_firmware",
    "lenovo:thinkagile_hx7530",
    "lenovo:thinkagile_hx7530_firmware",
    "lenovo:thinkagile_vx3331",
    "lenovo:thinkagile_vx3331_firmware"
   ]
  },
  "CVE-2023-49144": {
   "cvss": 8.1,
   "cvss_version": "4.0",
   "epss": 0.00192,
   "epss_date": "2026-10-28",
   "published": "2024-08-14T14:15:15.207",
   "modified": "2026-06-17T06:35:27.840",
   "severity": "high",
   "summary": "Out of bounds read in OpenBMC Firmware for some Intel(R) Server Platforms before versions egs-1.15-0, bhs-0.27 may allow a privileged user to potentially enable information disclosure via local access.",
   "vendors": [
    "megarac"
   ]
  },
  "CVE-2023-50272": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.00613,
   "epss_date": "2026-10-28",
   "published": "2023-12-19T16:15:12.347",
   "modified": "2026-06-17T06:39:25.780",
   "severity": "critical",
   "summary": "A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulnerability could be remotely exploited to allow authentication bypass.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_5_firmware",
     "versionStartIncluding": "2.63",
     "versionEndIncluding": "3.00"
    },
    {
     "product": "integrated_lights-out_6_firmware",
     "versionStartIncluding": "1.05",
     "versionEndIncluding": "1.55"
    }
   ],
   "products": [
    "hpe:integrated_lights-out_5",
    "hpe:integrated_lights-out_5_firmware",
    "hpe:integrated_lights-out_6",
    "hpe:integrated_lights-out_6_firmware"
   ]
  },
  "CVE-2023-52916": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00218,
   "epss_date": "2026-10-28",
   "published": "2024-09-06T09:15:03.327",
   "modified": "2026-08-04T10:18:48.870",
   "severity": "high",
   "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: aspeed: Fix memory overwrite if timing is 1600x900\n\nWhen capturing 1600x900, system could crash when system memory usage is\ntight.\n\nThe way to reproduce this issue:\n1. Use 1600x900 to display on host\n2. Mount ISO through 'Virtual media' on OpenBMC's web\n3. Run script as below on host to do sha continuously\n  #!/bin/bash\n  while [ [1] ];\n  do\n\tfind /media -type f -printf '\"%h/%f\"\\n' | xargs sha256sum\n  done\n4. Open KVM on OpenBMC's web\n\nThe size of macro block captured is 8x8. Therefore, we should make sure\nthe heigh...",
   "vendors": [
    "megarac"
   ],
   "products": [
    "linux:linux_kernel"
   ]
  },
  "CVE-2024-0089": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00234,
   "epss_date": "2026-10-28",
   "published": "2024-06-13T22:15:11.940",
   "modified": "2026-06-17T06:52:45.633",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability where the information from a previous client or another process could be disclosed. A successful exploit of this vulnerability might lead to code execution, information disclosure, or data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "475.06",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "538.67",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "550",
     "versionEndExcluding": "552.55",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "555",
     "versionEndExcluding": "555.99",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2024-0090": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00275,
   "epss_date": "2026-10-28",
   "published": "2024-06-13T22:15:12.170",
   "modified": "2026-06-17T06:52:45.760",
   "severity": "high",
   "summary": "NVIDIA GPU driver for Windows and Linux contains a vulnerability where a user can cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "475.06",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "538.67",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "550",
     "versionEndExcluding": "552.55",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "555",
     "versionEndExcluding": "555.99",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.256.02",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.180.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "550",
     "versionEndExcluding": "550.90.07",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "555",
     "versionEndExcluding": "555.52.04",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2024-0091": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00237,
   "epss_date": "2026-10-28",
   "published": "2024-06-13T22:15:12.430",
   "modified": "2026-06-17T06:52:45.900",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an untrusted pointer dereference by executing a driver API. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "550",
     "versionEndExcluding": "552.55",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "555",
     "versionEndExcluding": "555.99",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "550",
     "versionEndExcluding": "550.90.07",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "555",
     "versionEndExcluding": "555.52.04",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2024-0092": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.0019,
   "epss_date": "2026-10-28",
   "published": "2024-06-13T22:15:12.647",
   "modified": "2026-06-17T06:52:46.040",
   "severity": "medium",
   "summary": "NVIDIA GPU Driver for Windows and Linux contains a vulnerability where an improper check or improper handling of exception conditions might lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "475.06",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "538.67",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "550",
     "versionEndExcluding": "552.55",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "555",
     "versionEndExcluding": "555.99",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:studio",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "470.256.02",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.180.01",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "550",
     "versionEndExcluding": "550.90.07",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "555",
     "versionEndExcluding": "555.52.04",
     "platforms": [
      "gpu:geforce",
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2024-0107": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00455,
   "epss_date": "2026-10-28",
   "published": "2024-08-08T17:15:18.240",
   "modified": "2026-06-17T06:52:47.827",
   "severity": "high",
   "summary": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "475.14",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "555",
     "versionEndExcluding": "556.12",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "470",
     "versionEndExcluding": "475.14",
     "platforms": [
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "538.78",
     "platforms": [
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "550",
     "versionEndExcluding": "552.74",
     "platforms": [
      "gpu:quadro",
      "gpu:rtx",
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2024-0114": {
   "cvss": 8.1,
   "cvss_version": "3.1",
   "epss": 0.00212,
   "epss_date": "2026-10-28",
   "published": "2025-03-05T02:15:35.830",
   "modified": "2026-06-17T06:52:48.663",
   "severity": "high",
   "summary": "NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the BMC to access the HMC as an administrator. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "dgx"
   ]
  },
  "CVE-2024-0132": {
   "cvss": 8.3,
   "cvss_version": "3.1",
   "epss": 0.40842,
   "epss_date": "2026-10-28",
   "fixed_in": "1.16.2",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2024-0132",
   "published": "2024-09-26T06:15:02.397",
   "modified": "2026-06-17T06:52:50.660",
   "severity": "high",
   "summary": "NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "nvidia-container-toolkit"
   ],
   "ranges": [
    {
     "product": "nvidia_container_toolkit",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "os:linux"
     ]
    }
   ],
   "products": [
    "nvidia_container_toolkit"
   ]
  },
  "CVE-2024-0133": {
   "cvss": 3.4,
   "cvss_version": "3.1",
   "epss": 0.00249,
   "epss_date": "2026-10-28",
   "fixed_in": "1.16.2",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2024-0133",
   "published": "2024-09-26T06:15:04.053",
   "modified": "2026-06-17T06:52:50.780",
   "severity": "low",
   "summary": "NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.",
   "vendors": [
    "nvidia-container-toolkit"
   ],
   "ranges": [
    {
     "product": "nvidia_container_toolkit",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "os:linux"
     ]
    }
   ],
   "products": [
    "nvidia_container_toolkit"
   ]
  },
  "CVE-2024-0134": {
   "cvss": 4.1,
   "cvss_version": "3.1",
   "epss": 0.00391,
   "epss_date": "2026-10-28",
   "fixed_in": "1.17",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2024-0134",
   "published": "2024-11-05T19:15:05.203",
   "modified": "2026-06-17T06:52:50.893",
   "severity": "medium",
   "summary": "NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this vulnerability might lead to data tampering.",
   "vendors": [
    "nvidia-container-toolkit"
   ],
   "ranges": [
    {
     "product": "nvidia_container_toolkit",
     "versionEndExcluding": "1.17",
     "platforms": [
      "os:linux"
     ]
    }
   ],
   "products": [
    "nvidia_container_toolkit"
   ]
  },
  "CVE-2024-0135": {
   "cvss": 7.6,
   "cvss_version": "3.1",
   "epss": 0.01107,
   "epss_date": "2026-10-28",
   "fixed_in": "1.17.3",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2024-0135",
   "published": "2025-01-28T03:15:07.283",
   "modified": "2026-06-17T06:52:51.017",
   "severity": "high",
   "summary": "NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to modification of a host binary. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "nvidia-container-toolkit"
   ],
   "ranges": [
    {
     "product": "nvidia_container_toolkit",
     "versionEndExcluding": "1.17.3",
     "platforms": [
      "os:linux"
     ]
    }
   ],
   "products": [
    "nvidia_container_toolkit"
   ]
  },
  "CVE-2024-0136": {
   "cvss": 8.4,
   "cvss_version": "3.1",
   "epss": 0.00672,
   "epss_date": "2026-10-28",
   "fixed_in": "1.17.3",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2024-0136",
   "published": "2025-01-28T03:15:07.433",
   "modified": "2026-06-17T06:52:51.133",
   "severity": "high",
   "summary": "NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and write access to host devices. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "nvidia-container-toolkit"
   ],
   "ranges": [
    {
     "product": "nvidia_container_toolkit",
     "versionEndExcluding": "1.17.3",
     "platforms": [
      "os:linux"
     ]
    }
   ],
   "products": [
    "nvidia_container_toolkit"
   ]
  },
  "CVE-2024-0137": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.0033,
   "epss_date": "2026-10-28",
   "fixed_in": "1.17.3",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2024-0137",
   "published": "2025-01-28T03:15:07.567",
   "modified": "2026-06-17T06:52:51.247",
   "severity": "medium",
   "summary": "NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespace. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to denial of service and escalation of privileges.",
   "vendors": [
    "nvidia-container-toolkit"
   ],
   "ranges": [
    {
     "product": "nvidia_container_toolkit",
     "versionEndExcluding": "1.17.3",
     "platforms": [
      "os:linux"
     ]
    }
   ],
   "products": [
    "nvidia_container_toolkit"
   ]
  },
  "CVE-2024-0154": {
   "cvss": 3.3,
   "cvss_version": "3.1",
   "epss": 0.00203,
   "epss_date": "2026-10-28",
   "published": "2024-03-13T17:15:46.400",
   "modified": "2026-06-17T06:52:52.997",
   "severity": "low",
   "summary": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read the contents of non-SMM stack memory.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r660_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r660"
     ]
    },
    {
     "product": "poweredge_r760_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760"
     ]
    },
    {
     "product": "poweredge_c6620_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_c6620"
     ]
    },
    {
     "product": "poweredge_mx760c_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_mx760c"
     ]
    },
    {
     "product": "poweredge_r860_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_r860"
     ]
    },
    {
     "product": "poweredge_r960_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_r960"
     ]
    },
    {
     "product": "poweredge_hs5610_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_hs5610"
     ]
    },
    {
     "product": "poweredge_hs5620_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_hs5620"
     ]
    },
    {
     "product": "poweredge_r660xs_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r660xs"
     ]
    },
    {
     "product": "poweredge_r760xs_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760xs"
     ]
    },
    {
     "product": "poweredge_r760xd2_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760xd2"
     ]
    },
    {
     "product": "poweredge_t560_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_t560"
     ]
    },
    {
     "product": "poweredge_r760xa_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760xa"
     ]
    },
    {
     "product": "poweredge_xe9680_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xe9680"
     ]
    },
    {
     "product": "poweredge_xr5610_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr5610"
     ]
    },
    {
     "product": "poweredge_xr8610t_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr8610t"
     ]
    },
    {
     "product": "poweredge_xr8620t_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr8620t"
     ]
    },
    {
     "product": "poweredge_xr7620_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr7620"
     ]
    },
    {
     "product": "poweredge_xe8640_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xe8640"
     ]
    },
    {
     "product": "poweredge_xe9640_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xe9640"
     ]
    },
    {
     "product": "poweredge_r6615_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r6615"
     ]
    },
    {
     "product": "poweredge_r7615_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r7615"
     ]
    },
    {
     "product": "poweredge_r6625_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r6625"
     ]
    },
    {
     "product": "poweredge_r7625_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r7625"
     ]
    },
    {
     "product": "poweredge_c6615_firmware",
     "versionEndExcluding": "1.2.3",
     "platforms": [
      "cpe:dell:poweredge_c6615"
     ]
    },
    {
     "product": "poweredge_r650_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r650"
     ]
    },
    {
     "product": "poweredge_r750_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750"
     ]
    },
    {
     "product": "poweredge_r750xa_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750xa"
     ]
    },
    {
     "product": "poweredge_c6520_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_c6520"
     ]
    },
    {
     "product": "poweredge_mx750c_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_mx750c"
     ]
    },
    {
     "product": "poweredge_r550_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r550"
     ]
    },
    {
     "product": "poweredge_r450_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r450"
     ]
    },
    {
     "product": "poweredge_r650xs_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r650xs"
     ]
    },
    {
     "product": "poweredge_r750xs_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750xs"
     ]
    },
    {
     "product": "poweredge_t550_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_t550"
     ]
    },
    {
     "product": "poweredge_xr11_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_xr11"
     ]
    },
    {
     "product": "poweredge_xr12_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_xr12"
     ]
    },
    {
     "product": "poweredge_xr4510c_firmware",
     "versionEndExcluding": "1.14.1",
     "platforms": [
      "cpe:dell:poweredge_xr4510c"
     ]
    },
    {
     "product": "poweredge_xr4520c_firmware",
     "versionEndExcluding": "1.14.1",
     "platforms": [
      "cpe:dell:poweredge_xr4520c"
     ]
    },
    {
     "product": "poweredge_t150_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_t150"
     ]
    },
    {
     "product": "poweredge_t350_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_t350"
     ]
    },
    {
     "product": "poweredge_r250_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_r250"
     ]
    },
    {
     "product": "poweredge_r350_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_r350"
     ]
    },
    {
     "product": "poweredge_r6515_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r6515"
     ]
    },
    {
     "product": "poweredge_r6525_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r6525"
     ]
    },
    {
     "product": "poweredge_r7515_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r7515"
     ]
    },
    {
     "product": "poweredge_r7525_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r7525"
     ]
    },
    {
     "product": "poweredge_c6525_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_c6525"
     ]
    },
    {
     "product": "poweredge_xe8545_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_xe8545"
     ]
    },
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.21.2",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.21.2",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.21.2",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.21.2",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r540_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_r540"
     ]
    },
    {
     "product": "poweredge_r440_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_r440"
     ]
    },
    {
     "product": "poweredge_t440_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_t440"
     ]
    },
    {
     "product": "poweredge_xr2_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_xr2"
     ]
    },
    {
     "product": "poweredge_r740xd2_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_r740xd2"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_t640_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_t640"
     ]
    },
    {
     "product": "poweredge_c6420_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_c6420"
     ]
    },
    {
     "product": "poweredge_fc640_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_fc640"
     ]
    },
    {
     "product": "poweredge_m640_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_m640"
     ]
    },
    {
     "product": "poweredge_m640_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_m640_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    },
    {
     "product": "poweredge_c4140_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_c4140"
     ]
    },
    {
     "product": "poweredge_xe2420_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_xe2420"
     ]
    },
    {
     "product": "poweredge_xe7420_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_xe7420"
     ]
    },
    {
     "product": "poweredge_xe7440_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_xe7440"
     ]
    },
    {
     "product": "poweredge_t140_firmware",
     "versionEndExcluding": "2.16.0",
     "platforms": [
      "cpe:dell:poweredge_t140"
     ]
    },
    {
     "product": "poweredge_t340_firmware",
     "versionEndExcluding": "2.16.0",
     "platforms": [
      "cpe:dell:poweredge_t340"
     ]
    },
    {
     "product": "poweredge_r240_firmware",
     "versionEndExcluding": "2.16.0",
     "platforms": [
      "cpe:dell:poweredge_r240"
     ]
    },
    {
     "product": "poweredge_r340_firmware",
     "versionEndExcluding": "2.16.0",
     "platforms": [
      "cpe:dell:poweredge_r340"
     ]
    },
    {
     "product": "poweredge_r730_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r730"
     ]
    },
    {
     "product": "poweredge_r730xd_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r730xd"
     ]
    },
    {
     "product": "poweredge_r630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r630"
     ]
    },
    {
     "product": "poweredge_c4130_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_c4130"
     ]
    },
    {
     "product": "poweredge_r930_firmware",
     "versionEndExcluding": "2.14.0",
     "platforms": [
      "cpe:dell:poweredge_r930"
     ]
    },
    {
     "product": "poweredge_m630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m630"
     ]
    },
    {
     "product": "poweredge_m630_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m630_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_fc630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc630"
     ]
    },
    {
     "product": "poweredge_fc430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc430"
     ]
    },
    {
     "product": "poweredge_m830_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m830"
     ]
    },
    {
     "product": "poweredge_m830_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m830_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_fc830_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc830"
     ]
    },
    {
     "product": "poweredge_t630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_t630"
     ]
    },
    {
     "product": "poweredge_r530_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r530"
     ]
    },
    {
     "product": "poweredge_r430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r430"
     ]
    },
    {
     "product": "poweredge_t430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_t430"
     ]
    },
    {
     "product": "poweredge_r830_firmware",
     "versionEndExcluding": "1.19.0",
     "platforms": [
      "cpe:dell:poweredge_r830"
     ]
    },
    {
     "product": "poweredge_c6320_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_c6320"
     ]
    },
    {
     "product": "poweredge_t130_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_t130"
     ]
    },
    {
     "product": "poweredge_r230_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_r230"
     ]
    },
    {
     "product": "poweredge_t330_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_t330"
     ]
    },
    {
     "product": "poweredge_r330_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_r330"
     ]
    }
   ],
   "products": [
    "poweredge_c4130_firmware",
    "poweredge_c4140_firmware",
    "poweredge_c6320_firmware",
    "poweredge_c6420_firmware",
    "poweredge_c6520_firmware",
    "poweredge_c6525_firmware",
    "poweredge_c6615_firmware",
    "poweredge_c6620_firmware",
    "poweredge_fc430_firmware",
    "poweredge_fc630_firmware",
    "poweredge_fc640_firmware",
    "poweredge_fc830_firmware",
    "poweredge_hs5610_firmware",
    "poweredge_hs5620_firmware",
    "poweredge_m630_\\(pe_vrtx\\)_firmware",
    "poweredge_m630_firmware",
    "poweredge_m640_\\(pe_vrtx\\)_firmware",
    "poweredge_m640_firmware",
    "poweredge_m830_\\(pe_vrtx\\)_firmware",
    "poweredge_m830_firmware",
    "poweredge_mx740c_firmware",
    "poweredge_mx750c_firmware",
    "poweredge_mx760c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r230_firmware",
    "poweredge_r240_firmware",
    "poweredge_r250_firmware",
    "poweredge_r330_firmware",
    "poweredge_r340_firmware",
    "poweredge_r350_firmware",
    "poweredge_r430_firmware",
    "poweredge_r440_firmware",
    "poweredge_r450_firmware",
    "poweredge_r530_firmware",
    "poweredge_r540_firmware",
    "poweredge_r550_firmware",
    "poweredge_r630_firmware",
    "poweredge_r640_firmware",
    "poweredge_r650_firmware",
    "poweredge_r650xs_firmware",
    "poweredge_r6515_firmware",
    "poweredge_r6525_firmware",
    "poweredge_r660_firmware",
    "poweredge_r660xs_firmware",
    "poweredge_r6615_firmware",
    "poweredge_r6625_firmware",
    "poweredge_r730_firmware",
    "poweredge_r730xd_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd2_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r750_firmware",
    "poweredge_r750xa_firmware",
    "poweredge_r750xs_firmware",
    "poweredge_r7515_firmware",
    "poweredge_r7525_firmware",
    "poweredge_r760_firmware",
    "poweredge_r760xa_firmware",
    "poweredge_r760xd2_firmware",
    "poweredge_r760xs_firmware",
    "poweredge_r7615_firmware",
    "poweredge_r7625_firmware",
    "poweredge_r830_firmware",
    "poweredge_r840_firmware",
    "poweredge_r860_firmware",
    "poweredge_r930_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware",
    "poweredge_r960_firmware",
    "poweredge_t130_firmware",
    "poweredge_t140_firmware",
    "poweredge_t150_firmware",
    "poweredge_t330_firmware",
    "poweredge_t340_firmware",
    "poweredge_t350_firmware",
    "poweredge_t430_firmware",
    "poweredge_t440_firmware",
    "poweredge_t550_firmware",
    "poweredge_t560_firmware",
    "poweredge_t630_firmware",
    "poweredge_t640_firmware",
    "poweredge_xe2420_firmware",
    "poweredge_xe7420_firmware",
    "poweredge_xe7440_firmware",
    "poweredge_xe8545_firmware",
    "poweredge_xe8640_firmware",
    "poweredge_xe9640_firmware",
    "poweredge_xe9680_firmware",
    "poweredge_xr11_firmware",
    "poweredge_xr12_firmware",
    "poweredge_xr2_firmware",
    "poweredge_xr4510c_firmware",
    "poweredge_xr4520c_firmware",
    "poweredge_xr5610_firmware",
    "poweredge_xr7620_firmware",
    "poweredge_xr8610t_firmware",
    "poweredge_xr8620t_firmware"
   ]
  },
  "CVE-2024-0161": {
   "cvss": 8.4,
   "cvss_version": "3.1",
   "epss": 0.00204,
   "epss_date": "2026-10-28",
   "published": "2024-03-13T16:15:10.143",
   "modified": "2026-06-17T06:52:54.380",
   "severity": "high",
   "summary": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to arbitrary writes to SMRAM.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_t360_firmware",
     "versionEndExcluding": "1.1.1",
     "platforms": [
      "cpe:dell:poweredge_t360"
     ]
    },
    {
     "product": "poweredge_r360_firmware",
     "versionEndExcluding": "1.1.1",
     "platforms": [
      "cpe:dell:poweredge_r360"
     ]
    },
    {
     "product": "poweredge_r650_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r650"
     ]
    },
    {
     "product": "poweredge_r750_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750"
     ]
    },
    {
     "product": "poweredge_r750xa_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750xa"
     ]
    },
    {
     "product": "poweredge_c6520_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_c6520"
     ]
    },
    {
     "product": "poweredge_mx750c_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_mx750c"
     ]
    },
    {
     "product": "poweredge_r550_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r550"
     ]
    },
    {
     "product": "poweredge_r450_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r450"
     ]
    },
    {
     "product": "poweredge_r650xs_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r650xs"
     ]
    },
    {
     "product": "poweredge_r750xs_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750xs"
     ]
    },
    {
     "product": "poweredge_t550_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_t550"
     ]
    },
    {
     "product": "poweredge_xr11_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_xr11"
     ]
    },
    {
     "product": "poweredge_xr12_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_xr12"
     ]
    },
    {
     "product": "poweredge_xr4510c_firmware",
     "versionEndExcluding": "1.14.1",
     "platforms": [
      "cpe:dell:poweredge_xr4510c"
     ]
    },
    {
     "product": "poweredge_xr4520c_firmware",
     "versionEndExcluding": "1.14.1",
     "platforms": [
      "cpe:dell:poweredge_xr4520c"
     ]
    },
    {
     "product": "poweredge_t150_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_t150"
     ]
    },
    {
     "product": "poweredge_t350_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_t350"
     ]
    },
    {
     "product": "poweredge_r250_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_r250"
     ]
    },
    {
     "product": "poweredge_r350_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_r350"
     ]
    },
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.21.2",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.21.2",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.21.2",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.21.2",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r540_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_r540"
     ]
    },
    {
     "product": "poweredge_r440_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_r440"
     ]
    },
    {
     "product": "poweredge_t440_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_t440"
     ]
    },
    {
     "product": "poweredge_xr2_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_xr2"
     ]
    },
    {
     "product": "poweredge_r740xd2_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_r740xd2"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_t640_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_t640"
     ]
    },
    {
     "product": "poweredge_c6420_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_c6420"
     ]
    },
    {
     "product": "poweredge_fc640_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_fc640"
     ]
    },
    {
     "product": "poweredge_m640_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_m640"
     ]
    },
    {
     "product": "poweredge_m640_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_m640_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    },
    {
     "product": "poweredge_c4140_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_c4140"
     ]
    },
    {
     "product": "poweredge_xe2420_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_xe2420"
     ]
    },
    {
     "product": "poweredge_xe7420_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_xe7420"
     ]
    },
    {
     "product": "poweredge_xe7440_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_xe7440"
     ]
    },
    {
     "product": "poweredge_r730_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r730"
     ]
    },
    {
     "product": "poweredge_r730xd_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r730xd"
     ]
    },
    {
     "product": "poweredge_r630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r630"
     ]
    },
    {
     "product": "poweredge_c4130_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_c4130"
     ]
    },
    {
     "product": "poweredge_r930_firmware",
     "versionEndExcluding": "2.14.0",
     "platforms": [
      "cpe:dell:poweredge_r930"
     ]
    },
    {
     "product": "poweredge_m630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m630"
     ]
    },
    {
     "product": "poweredge_m630_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m630_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_fc630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc630"
     ]
    },
    {
     "product": "poweredge_fc430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc430"
     ]
    },
    {
     "product": "poweredge_m830_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m830"
     ]
    },
    {
     "product": "poweredge_m830_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m830_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_fc830_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc830"
     ]
    },
    {
     "product": "poweredge_t630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_t630"
     ]
    },
    {
     "product": "poweredge_r530_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r530"
     ]
    },
    {
     "product": "poweredge_r430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r430"
     ]
    },
    {
     "product": "poweredge_t430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_t430"
     ]
    },
    {
     "product": "poweredge_r830_firmware",
     "versionEndExcluding": "1.19.0",
     "platforms": [
      "cpe:dell:poweredge_r830"
     ]
    },
    {
     "product": "poweredge_c6320_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_c6320"
     ]
    },
    {
     "product": "poweredge_t130_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_t130"
     ]
    },
    {
     "product": "poweredge_r230_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_r230"
     ]
    },
    {
     "product": "poweredge_t330_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_t330"
     ]
    },
    {
     "product": "poweredge_r330_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_r330"
     ]
    }
   ],
   "products": [
    "poweredge_c4130_firmware",
    "poweredge_c4140_firmware",
    "poweredge_c6320_firmware",
    "poweredge_c6420_firmware",
    "poweredge_c6520_firmware",
    "poweredge_fc430_firmware",
    "poweredge_fc630_firmware",
    "poweredge_fc640_firmware",
    "poweredge_fc830_firmware",
    "poweredge_m630_\\(pe_vrtx\\)_firmware",
    "poweredge_m630_firmware",
    "poweredge_m640_\\(pe_vrtx\\)_firmware",
    "poweredge_m640_firmware",
    "poweredge_m830_\\(pe_vrtx\\)_firmware",
    "poweredge_m830_firmware",
    "poweredge_mx740c_firmware",
    "poweredge_mx750c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r230_firmware",
    "poweredge_r250_firmware",
    "poweredge_r330_firmware",
    "poweredge_r350_firmware",
    "poweredge_r360_firmware",
    "poweredge_r430_firmware",
    "poweredge_r440_firmware",
    "poweredge_r450_firmware",
    "poweredge_r530_firmware",
    "poweredge_r540_firmware",
    "poweredge_r550_firmware",
    "poweredge_r630_firmware",
    "poweredge_r640_firmware",
    "poweredge_r650_firmware",
    "poweredge_r650xs_firmware",
    "poweredge_r730_firmware",
    "poweredge_r730xd_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd2_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r750_firmware",
    "poweredge_r750xa_firmware",
    "poweredge_r750xs_firmware",
    "poweredge_r830_firmware",
    "poweredge_r840_firmware",
    "poweredge_r930_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware",
    "poweredge_t130_firmware",
    "poweredge_t150_firmware",
    "poweredge_t330_firmware",
    "poweredge_t350_firmware",
    "poweredge_t360_firmware",
    "poweredge_t430_firmware",
    "poweredge_t440_firmware",
    "poweredge_t550_firmware",
    "poweredge_t630_firmware",
    "poweredge_t640_firmware",
    "poweredge_xe2420_firmware",
    "poweredge_xe7420_firmware",
    "poweredge_xe7440_firmware",
    "poweredge_xr11_firmware",
    "poweredge_xr12_firmware",
    "poweredge_xr2_firmware",
    "poweredge_xr4510c_firmware",
    "poweredge_xr4520c_firmware"
   ]
  },
  "CVE-2024-0162": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00151,
   "epss_date": "2026-10-28",
   "published": "2024-03-13T17:15:46.617",
   "modified": "2026-06-17T06:52:54.570",
   "severity": "high",
   "summary": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to out-of-bound read/writes to SMRAM.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r660_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r660"
     ]
    },
    {
     "product": "poweredge_r760_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760"
     ]
    },
    {
     "product": "poweredge_c6620_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_c6620"
     ]
    },
    {
     "product": "poweredge_mx760c_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_mx760c"
     ]
    },
    {
     "product": "poweredge_r860_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_r860"
     ]
    },
    {
     "product": "poweredge_r960_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_r960"
     ]
    },
    {
     "product": "poweredge_hs5610_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_hs5610"
     ]
    },
    {
     "product": "poweredge_hs5620_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_hs5620"
     ]
    },
    {
     "product": "poweredge_r660xs_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r660xs"
     ]
    },
    {
     "product": "poweredge_r760xs_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760xs"
     ]
    },
    {
     "product": "poweredge_r760xd2_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760xd2"
     ]
    },
    {
     "product": "poweredge_t560_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_t560"
     ]
    },
    {
     "product": "poweredge_r760xa_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760xa"
     ]
    },
    {
     "product": "poweredge_xe9680_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xe9680"
     ]
    },
    {
     "product": "poweredge_xr5610_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr5610"
     ]
    },
    {
     "product": "poweredge_xr8610t_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr8610t"
     ]
    },
    {
     "product": "poweredge_xr8620t_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr8620t"
     ]
    },
    {
     "product": "poweredge_xr7620_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr7620"
     ]
    },
    {
     "product": "poweredge_xe8640_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xe8640"
     ]
    },
    {
     "product": "poweredge_xe9640_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xe9640"
     ]
    },
    {
     "product": "poweredge_r6615_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r6615"
     ]
    },
    {
     "product": "poweredge_r7615_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r7615"
     ]
    },
    {
     "product": "poweredge_r6625_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r6625"
     ]
    },
    {
     "product": "poweredge_r7625_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r7625"
     ]
    },
    {
     "product": "poweredge_c6615_firmware",
     "versionEndExcluding": "1.2.3",
     "platforms": [
      "cpe:dell:poweredge_c6615"
     ]
    },
    {
     "product": "poweredge_r650_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r650"
     ]
    },
    {
     "product": "poweredge_r750_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750"
     ]
    },
    {
     "product": "poweredge_r750xa_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750xa"
     ]
    },
    {
     "product": "poweredge_c6520_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_c6520"
     ]
    },
    {
     "product": "poweredge_mx750c_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_mx750c"
     ]
    },
    {
     "product": "poweredge_r550_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r550"
     ]
    },
    {
     "product": "poweredge_r450_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r450"
     ]
    },
    {
     "product": "poweredge_r650xs_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r650xs"
     ]
    },
    {
     "product": "poweredge_r750xs_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750xs"
     ]
    },
    {
     "product": "poweredge_t550_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_t550"
     ]
    },
    {
     "product": "poweredge_xr11_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_xr11"
     ]
    },
    {
     "product": "poweredge_xr12_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_xr12"
     ]
    },
    {
     "product": "poweredge_t150_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_t150"
     ]
    },
    {
     "product": "poweredge_t350_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_t350"
     ]
    },
    {
     "product": "poweredge_r250_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_r250"
     ]
    },
    {
     "product": "poweredge_r350_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_r350"
     ]
    },
    {
     "product": "poweredge_xr4510c_firmware",
     "versionEndExcluding": "1.14.1",
     "platforms": [
      "cpe:dell:poweredge_xr4510c"
     ]
    },
    {
     "product": "poweredge_xr4520c_firmware",
     "versionEndExcluding": "1.14.1",
     "platforms": [
      "cpe:dell:poweredge_xr4520c"
     ]
    },
    {
     "product": "poweredge_r6515_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r6515"
     ]
    },
    {
     "product": "poweredge_r6525_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r6525"
     ]
    },
    {
     "product": "poweredge_r7515_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r7515"
     ]
    },
    {
     "product": "poweredge_r7525_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r7525"
     ]
    },
    {
     "product": "poweredge_c6525_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_c6525"
     ]
    },
    {
     "product": "poweredge_xe8545_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_xe8545"
     ]
    }
   ],
   "products": [
    "poweredge_c6520_firmware",
    "poweredge_c6525_firmware",
    "poweredge_c6615_firmware",
    "poweredge_c6620_firmware",
    "poweredge_hs5610_firmware",
    "poweredge_hs5620_firmware",
    "poweredge_mx750c_firmware",
    "poweredge_mx760c_firmware",
    "poweredge_r250_firmware",
    "poweredge_r350_firmware",
    "poweredge_r450_firmware",
    "poweredge_r550_firmware",
    "poweredge_r650_firmware",
    "poweredge_r650xs_firmware",
    "poweredge_r6515_firmware",
    "poweredge_r6525_firmware",
    "poweredge_r660_firmware",
    "poweredge_r660xs_firmware",
    "poweredge_r6615_firmware",
    "poweredge_r6625_firmware",
    "poweredge_r750_firmware",
    "poweredge_r750xa_firmware",
    "poweredge_r750xs_firmware",
    "poweredge_r7515_firmware",
    "poweredge_r7525_firmware",
    "poweredge_r760_firmware",
    "poweredge_r760xa_firmware",
    "poweredge_r760xd2_firmware",
    "poweredge_r760xs_firmware",
    "poweredge_r7615_firmware",
    "poweredge_r7625_firmware",
    "poweredge_r860_firmware",
    "poweredge_r960_firmware",
    "poweredge_t150_firmware",
    "poweredge_t350_firmware",
    "poweredge_t550_firmware",
    "poweredge_t560_firmware",
    "poweredge_xe8545_firmware",
    "poweredge_xe8640_firmware",
    "poweredge_xe9640_firmware",
    "poweredge_xe9680_firmware",
    "poweredge_xr11_firmware",
    "poweredge_xr12_firmware",
    "poweredge_xr4510c_firmware",
    "poweredge_xr4520c_firmware",
    "poweredge_xr5610_firmware",
    "poweredge_xr7620_firmware",
    "poweredge_xr8610t_firmware",
    "poweredge_xr8620t_firmware"
   ]
  },
  "CVE-2024-0163": {
   "cvss": 6.3,
   "cvss_version": "3.1",
   "epss": 0.00115,
   "epss_date": "2026-10-28",
   "published": "2024-03-13T17:15:46.807",
   "modified": "2026-06-17T06:52:54.737",
   "severity": "medium",
   "summary": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r660_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r660"
     ]
    },
    {
     "product": "poweredge_r760_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760"
     ]
    },
    {
     "product": "poweredge_c6620_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_c6620"
     ]
    },
    {
     "product": "poweredge_mx760c_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_mx760c"
     ]
    },
    {
     "product": "poweredge_r860_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_r860"
     ]
    },
    {
     "product": "poweredge_r960_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_r960"
     ]
    },
    {
     "product": "poweredge_hs5610_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_hs5610"
     ]
    },
    {
     "product": "poweredge_hs5620_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_hs5620"
     ]
    },
    {
     "product": "poweredge_r660xs_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r660xs"
     ]
    },
    {
     "product": "poweredge_r760xs_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760xs"
     ]
    },
    {
     "product": "poweredge_r760xd2_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760xd2"
     ]
    },
    {
     "product": "poweredge_t560_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_t560"
     ]
    },
    {
     "product": "poweredge_r760xa_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760xa"
     ]
    },
    {
     "product": "poweredge_xe9680_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xe9680"
     ]
    },
    {
     "product": "poweredge_xr5610_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr5610"
     ]
    },
    {
     "product": "poweredge_xr8610t_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr8610t"
     ]
    },
    {
     "product": "poweredge_xr8620t_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr8620t"
     ]
    },
    {
     "product": "poweredge_xr7620_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr7620"
     ]
    },
    {
     "product": "poweredge_xe8640_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xe8640"
     ]
    },
    {
     "product": "poweredge_xe9640_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xe9640"
     ]
    },
    {
     "product": "poweredge_r6615_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r6615"
     ]
    },
    {
     "product": "poweredge_r7615_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r7615"
     ]
    },
    {
     "product": "poweredge_r6625_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r6625"
     ]
    },
    {
     "product": "poweredge_r7625_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r7625"
     ]
    },
    {
     "product": "poweredge_c6615_firmware",
     "versionEndExcluding": "1.2.3",
     "platforms": [
      "cpe:dell:poweredge_c6615"
     ]
    },
    {
     "product": "poweredge_r650_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r650"
     ]
    },
    {
     "product": "poweredge_r750_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750"
     ]
    },
    {
     "product": "poweredge_r750xa_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750xa"
     ]
    },
    {
     "product": "poweredge_c6520_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_c6520"
     ]
    },
    {
     "product": "poweredge_mx750c_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_mx750c"
     ]
    },
    {
     "product": "poweredge_r550_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r550"
     ]
    },
    {
     "product": "poweredge_r450_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r450"
     ]
    },
    {
     "product": "poweredge_r650xs_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r650xs"
     ]
    },
    {
     "product": "poweredge_r750xs_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750xs"
     ]
    },
    {
     "product": "poweredge_t550_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_t550"
     ]
    },
    {
     "product": "poweredge_xr11_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_xr11"
     ]
    },
    {
     "product": "poweredge_xr12_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_xr12"
     ]
    },
    {
     "product": "poweredge_t150_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_t150"
     ]
    },
    {
     "product": "poweredge_t350_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_t350"
     ]
    },
    {
     "product": "poweredge_r250_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_r250"
     ]
    },
    {
     "product": "poweredge_r350_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_r350"
     ]
    },
    {
     "product": "poweredge_xr4510c_firmware",
     "versionEndExcluding": "1.14.1",
     "platforms": [
      "cpe:dell:poweredge_xr4510c"
     ]
    },
    {
     "product": "poweredge_xr4520c_firmware",
     "versionEndExcluding": "1.14.1",
     "platforms": [
      "cpe:dell:poweredge_xr4520c"
     ]
    },
    {
     "product": "poweredge_r6515_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r6515"
     ]
    },
    {
     "product": "poweredge_r6525_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r6525"
     ]
    },
    {
     "product": "poweredge_r7515_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r7515"
     ]
    },
    {
     "product": "poweredge_r7525_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r7525"
     ]
    },
    {
     "product": "poweredge_c6525_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_c6525"
     ]
    },
    {
     "product": "poweredge_xe8545_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_xe8545"
     ]
    }
   ],
   "products": [
    "poweredge_c6520_firmware",
    "poweredge_c6525_firmware",
    "poweredge_c6615_firmware",
    "poweredge_c6620_firmware",
    "poweredge_hs5610_firmware",
    "poweredge_hs5620_firmware",
    "poweredge_mx750c_firmware",
    "poweredge_mx760c_firmware",
    "poweredge_r250_firmware",
    "poweredge_r350_firmware",
    "poweredge_r450_firmware",
    "poweredge_r550_firmware",
    "poweredge_r650_firmware",
    "poweredge_r650xs_firmware",
    "poweredge_r6515_firmware",
    "poweredge_r6525_firmware",
    "poweredge_r660_firmware",
    "poweredge_r660xs_firmware",
    "poweredge_r6615_firmware",
    "poweredge_r6625_firmware",
    "poweredge_r750_firmware",
    "poweredge_r750xa_firmware",
    "poweredge_r750xs_firmware",
    "poweredge_r7515_firmware",
    "poweredge_r7525_firmware",
    "poweredge_r760_firmware",
    "poweredge_r760xa_firmware",
    "poweredge_r760xd2_firmware",
    "poweredge_r760xs_firmware",
    "poweredge_r7615_firmware",
    "poweredge_r7625_firmware",
    "poweredge_r860_firmware",
    "poweredge_r960_firmware",
    "poweredge_t150_firmware",
    "poweredge_t350_firmware",
    "poweredge_t550_firmware",
    "poweredge_t560_firmware",
    "poweredge_xe8545_firmware",
    "poweredge_xe8640_firmware",
    "poweredge_xe9640_firmware",
    "poweredge_xe9680_firmware",
    "poweredge_xr11_firmware",
    "poweredge_xr12_firmware",
    "poweredge_xr4510c_firmware",
    "poweredge_xr4520c_firmware",
    "poweredge_xr5610_firmware",
    "poweredge_xr7620_firmware",
    "poweredge_xr8610t_firmware",
    "poweredge_xr8620t_firmware"
   ]
  },
  "CVE-2024-0171": {
   "cvss": 5.3,
   "cvss_version": "3.1",
   "epss": 0.00098,
   "epss_date": "2026-10-28",
   "published": "2024-06-25T16:15:24.197",
   "modified": "2026-06-17T06:52:55.850",
   "severity": "medium",
   "summary": "Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r6615_firmware",
     "versionEndExcluding": "1.8.3",
     "platforms": [
      "cpe:dell:poweredge_r6615"
     ]
    },
    {
     "product": "poweredge_r7615_firmware",
     "versionEndExcluding": "1.8.3",
     "platforms": [
      "cpe:dell:poweredge_r7615"
     ]
    },
    {
     "product": "poweredge_r6625_firmware",
     "versionEndExcluding": "1.8.3",
     "platforms": [
      "cpe:dell:poweredge_r6625"
     ]
    },
    {
     "product": "poweredge_r7625_firmware",
     "versionEndExcluding": "1.8.3",
     "platforms": [
      "cpe:dell:poweredge_r7625"
     ]
    },
    {
     "product": "poweredge_c6615_firmware",
     "versionEndExcluding": "1.3.3",
     "platforms": [
      "cpe:dell:poweredge_c6615"
     ]
    }
   ],
   "products": [
    "poweredge_c6615_firmware",
    "poweredge_r6615_firmware",
    "poweredge_r6625_firmware",
    "poweredge_r7615_firmware",
    "poweredge_r7625_firmware"
   ]
  },
  "CVE-2024-0172": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00146,
   "epss_date": "2026-10-28",
   "published": "2024-04-03T10:15:08.030",
   "modified": "2026-06-17T06:52:55.990",
   "severity": "high",
   "summary": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r660_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r660"
     ]
    },
    {
     "product": "poweredge_r760_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r760"
     ]
    },
    {
     "product": "poweredge_c6620_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_c6620"
     ]
    },
    {
     "product": "poweredge_mx760c_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_mx760c"
     ]
    },
    {
     "product": "poweredge_r860_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r860"
     ]
    },
    {
     "product": "poweredge_r960_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r960"
     ]
    },
    {
     "product": "poweredge_hs5610_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_hs5610"
     ]
    },
    {
     "product": "poweredge_hs5620_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_hs5620"
     ]
    },
    {
     "product": "poweredge_r660xs_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r660xs"
     ]
    },
    {
     "product": "poweredge_r760xs_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r760xs"
     ]
    },
    {
     "product": "poweredge_r760xd2_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_r760xd2"
     ]
    },
    {
     "product": "poweredge_t560_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_t560"
     ]
    },
    {
     "product": "poweredge_r760xa_firmware",
     "versionEndExcluding": "1.1.3",
     "platforms": [
      "cpe:dell:poweredge_r760xa"
     ]
    },
    {
     "product": "poweredge_xe9680_firmware",
     "versionEndExcluding": "1.1.3",
     "platforms": [
      "cpe:dell:poweredge_xe9680"
     ]
    },
    {
     "product": "poweredge_xr5610_firmware",
     "versionEndExcluding": "1.1.4",
     "platforms": [
      "cpe:dell:poweredge_xr5610"
     ]
    },
    {
     "product": "poweredge_xr8610t_firmware",
     "versionEndExcluding": "1.1.3",
     "platforms": [
      "cpe:dell:poweredge_xr8610t"
     ]
    },
    {
     "product": "poweredge_xr8620t_firmware",
     "versionEndExcluding": "1.1.3",
     "platforms": [
      "cpe:dell:poweredge_xr8620t"
     ]
    },
    {
     "product": "poweredge_xr7620_firmware",
     "versionEndExcluding": "1.5.6",
     "platforms": [
      "cpe:dell:poweredge_xr7620"
     ]
    },
    {
     "product": "poweredge_xe8640_firmware",
     "versionEndExcluding": "1.2.5",
     "platforms": [
      "cpe:dell:poweredge_xe8640"
     ]
    },
    {
     "product": "poweredge_xe9640_firmware",
     "versionEndExcluding": "1.3.6",
     "platforms": [
      "cpe:dell:poweredge_xe9640"
     ]
    },
    {
     "product": "poweredge_r6615_firmware",
     "versionEndExcluding": "1.4.6",
     "platforms": [
      "cpe:dell:poweredge_r6615"
     ]
    },
    {
     "product": "poweredge_r7615_firmware",
     "versionEndExcluding": "1.4.6",
     "platforms": [
      "cpe:dell:poweredge_r7615"
     ]
    },
    {
     "product": "poweredge_r6625_firmware",
     "versionEndExcluding": "1.4.6",
     "platforms": [
      "cpe:dell:poweredge_r6625"
     ]
    },
    {
     "product": "poweredge_r7625_firmware",
     "versionEndExcluding": "1.4.6",
     "platforms": [
      "cpe:dell:poweredge_r7625"
     ]
    },
    {
     "product": "poweredge_r650_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_r650"
     ]
    },
    {
     "product": "poweredge_r750_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_r750"
     ]
    },
    {
     "product": "poweredge_r750xa_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_r750xa"
     ]
    },
    {
     "product": "poweredge_c6520_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_c6520"
     ]
    },
    {
     "product": "poweredge_mx750c_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_mx750c"
     ]
    },
    {
     "product": "poweredge_r550_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_r550"
     ]
    },
    {
     "product": "poweredge_r450_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_r450"
     ]
    },
    {
     "product": "poweredge_r650xs_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_r650xs"
     ]
    },
    {
     "product": "poweredge_r750xs_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_r750xs"
     ]
    },
    {
     "product": "poweredge_t550_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_t550"
     ]
    },
    {
     "product": "poweredge_xr11_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_xr11"
     ]
    },
    {
     "product": "poweredge_xr12_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_xr12"
     ]
    },
    {
     "product": "poweredge_t150_firmware",
     "versionEndExcluding": "1.7.3",
     "platforms": [
      "cpe:dell:poweredge_t150"
     ]
    },
    {
     "product": "poweredge_t350_firmware",
     "versionEndExcluding": "1.7.3",
     "platforms": [
      "cpe:dell:poweredge_t350"
     ]
    },
    {
     "product": "poweredge_r250_firmware",
     "versionEndExcluding": "1.7.3",
     "platforms": [
      "cpe:dell:poweredge_r250"
     ]
    },
    {
     "product": "poweredge_r350_firmware",
     "versionEndExcluding": "1.7.3",
     "platforms": [
      "cpe:dell:poweredge_r350"
     ]
    },
    {
     "product": "poweredge_xr4510c_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_xr4510c"
     ]
    },
    {
     "product": "poweredge_xr4520c_firmware",
     "versionEndExcluding": "1.12.1",
     "platforms": [
      "cpe:dell:poweredge_xr4520c"
     ]
    },
    {
     "product": "poweredge_r6515_firmware",
     "versionEndExcluding": "2.12.4",
     "platforms": [
      "cpe:dell:poweredge_r6515"
     ]
    },
    {
     "product": "poweredge_r6525_firmware",
     "versionEndExcluding": "2.12.4",
     "platforms": [
      "cpe:dell:poweredge_r6525"
     ]
    },
    {
     "product": "poweredge_r7515_firmware",
     "versionEndExcluding": "2.12.4",
     "platforms": [
      "cpe:dell:poweredge_r7515"
     ]
    },
    {
     "product": "poweredge_r7525_firmware",
     "versionEndExcluding": "2.12.4",
     "platforms": [
      "cpe:dell:poweredge_r7525"
     ]
    },
    {
     "product": "poweredge_c6525_firmware",
     "versionEndExcluding": "2.12.4",
     "platforms": [
      "cpe:dell:poweredge_c6525"
     ]
    },
    {
     "product": "poweredge_xe8545_firmware",
     "versionEndExcluding": "2.12.4",
     "platforms": [
      "cpe:dell:poweredge_xe8545"
     ]
    },
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r540_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_r540"
     ]
    },
    {
     "product": "poweredge_r440_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_r440"
     ]
    },
    {
     "product": "poweredge_t440_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_t440"
     ]
    },
    {
     "product": "poweredge_xr2_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_xr2"
     ]
    },
    {
     "product": "poweredge_r740xd2_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_r740xd2"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_t640_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_t640"
     ]
    },
    {
     "product": "poweredge_c6420_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_c6420"
     ]
    },
    {
     "product": "poweredge_fc640_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_fc640"
     ]
    },
    {
     "product": "poweredge_m640_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_m640"
     ]
    },
    {
     "product": "poweredge_m640_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_m640_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    },
    {
     "product": "poweredge_c4140_firmware",
     "versionEndExcluding": "2.19.1",
     "platforms": [
      "cpe:dell:poweredge_c4140"
     ]
    },
    {
     "product": "poweredge_xe2420_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_xe2420"
     ]
    },
    {
     "product": "poweredge_xe7420_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_xe7420"
     ]
    },
    {
     "product": "poweredge_xe7440_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_xe7440"
     ]
    },
    {
     "product": "poweredge_t140_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_t140"
     ]
    },
    {
     "product": "poweredge_t340_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_t340"
     ]
    },
    {
     "product": "poweredge_r240_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r240"
     ]
    },
    {
     "product": "poweredge_r340_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r340"
     ]
    },
    {
     "product": "poweredge_r6415_firmware",
     "versionEndExcluding": "1.20.0",
     "platforms": [
      "cpe:dell:poweredge_r6415"
     ]
    },
    {
     "product": "poweredge_r7415_firmware",
     "versionEndExcluding": "1.20.0",
     "platforms": [
      "cpe:dell:poweredge_r7415"
     ]
    },
    {
     "product": "poweredge_r7425_firmware",
     "versionEndExcluding": "1.20.0",
     "platforms": [
      "cpe:dell:poweredge_r7425"
     ]
    }
   ],
   "products": [
    "poweredge_c4140_firmware",
    "poweredge_c6420_firmware",
    "poweredge_c6520_firmware",
    "poweredge_c6525_firmware",
    "poweredge_c6620_firmware",
    "poweredge_fc640_firmware",
    "poweredge_hs5610_firmware",
    "poweredge_hs5620_firmware",
    "poweredge_m640_\\(pe_vrtx\\)_firmware",
    "poweredge_m640_firmware",
    "poweredge_mx740c_firmware",
    "poweredge_mx750c_firmware",
    "poweredge_mx760c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r240_firmware",
    "poweredge_r250_firmware",
    "poweredge_r340_firmware",
    "poweredge_r350_firmware",
    "poweredge_r440_firmware",
    "poweredge_r450_firmware",
    "poweredge_r540_firmware",
    "poweredge_r550_firmware",
    "poweredge_r640_firmware",
    "poweredge_r6415_firmware",
    "poweredge_r650_firmware",
    "poweredge_r650xs_firmware",
    "poweredge_r6515_firmware",
    "poweredge_r6525_firmware",
    "poweredge_r660_firmware",
    "poweredge_r660xs_firmware",
    "poweredge_r6615_firmware",
    "poweredge_r6625_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd2_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r7415_firmware",
    "poweredge_r7425_firmware",
    "poweredge_r750_firmware",
    "poweredge_r750xa_firmware",
    "poweredge_r750xs_firmware",
    "poweredge_r7515_firmware",
    "poweredge_r7525_firmware",
    "poweredge_r760_firmware",
    "poweredge_r760xa_firmware",
    "poweredge_r760xd2_firmware",
    "poweredge_r760xs_firmware",
    "poweredge_r7615_firmware",
    "poweredge_r7625_firmware",
    "poweredge_r840_firmware",
    "poweredge_r860_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware",
    "poweredge_r960_firmware",
    "poweredge_t140_firmware",
    "poweredge_t150_firmware",
    "poweredge_t340_firmware",
    "poweredge_t350_firmware",
    "poweredge_t440_firmware",
    "poweredge_t550_firmware",
    "poweredge_t560_firmware",
    "poweredge_t640_firmware",
    "poweredge_xe2420_firmware",
    "poweredge_xe7420_firmware",
    "poweredge_xe7440_firmware",
    "poweredge_xe8545_firmware",
    "poweredge_xe8640_firmware",
    "poweredge_xe9640_firmware",
    "poweredge_xe9680_firmware",
    "poweredge_xr11_firmware",
    "poweredge_xr12_firmware",
    "poweredge_xr2_firmware",
    "poweredge_xr4510c_firmware",
    "poweredge_xr4520c_firmware",
    "poweredge_xr5610_firmware",
    "poweredge_xr7620_firmware",
    "poweredge_xr8610t_firmware",
    "poweredge_xr8620t_firmware"
   ]
  },
  "CVE-2024-0173": {
   "cvss": 3.3,
   "cvss_version": "3.1",
   "epss": 0.00169,
   "epss_date": "2026-10-28",
   "published": "2024-03-13T17:15:47.000",
   "modified": "2026-06-17T06:52:56.380",
   "severity": "low",
   "summary": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read the contents of non-SMM stack memory.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r660_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r660"
     ]
    },
    {
     "product": "poweredge_r760_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760"
     ]
    },
    {
     "product": "poweredge_c6620_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_c6620"
     ]
    },
    {
     "product": "poweredge_mx760c_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_mx760c"
     ]
    },
    {
     "product": "poweredge_r860_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_r860"
     ]
    },
    {
     "product": "poweredge_r960_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_r960"
     ]
    },
    {
     "product": "poweredge_hs5610_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_hs5610"
     ]
    },
    {
     "product": "poweredge_hs5620_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_hs5620"
     ]
    },
    {
     "product": "poweredge_r660xs_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r660xs"
     ]
    },
    {
     "product": "poweredge_r760xs_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760xs"
     ]
    },
    {
     "product": "poweredge_r760xd2_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760xd2"
     ]
    },
    {
     "product": "poweredge_t560_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_t560"
     ]
    },
    {
     "product": "poweredge_r760xa_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r760xa"
     ]
    },
    {
     "product": "poweredge_xe9680_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xe9680"
     ]
    },
    {
     "product": "poweredge_xr5610_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr5610"
     ]
    },
    {
     "product": "poweredge_xr8610t_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr8610t"
     ]
    },
    {
     "product": "poweredge_xr8620t_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr8620t"
     ]
    },
    {
     "product": "poweredge_xr7620_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xr7620"
     ]
    },
    {
     "product": "poweredge_xe8640_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xe8640"
     ]
    },
    {
     "product": "poweredge_xe9640_firmware",
     "versionEndExcluding": "1.8.0",
     "platforms": [
      "cpe:dell:poweredge_xe9640"
     ]
    },
    {
     "product": "poweredge_r6615_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r6615"
     ]
    },
    {
     "product": "poweredge_r7615_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r7615"
     ]
    },
    {
     "product": "poweredge_r6625_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r6625"
     ]
    },
    {
     "product": "poweredge_r7625_firmware",
     "versionEndExcluding": "1.7.2",
     "platforms": [
      "cpe:dell:poweredge_r7625"
     ]
    },
    {
     "product": "poweredge_c6615_firmware",
     "versionEndExcluding": "1.2.3",
     "platforms": [
      "cpe:dell:poweredge_c6615"
     ]
    },
    {
     "product": "poweredge_r650_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r650"
     ]
    },
    {
     "product": "poweredge_r750_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750"
     ]
    },
    {
     "product": "poweredge_r750xa_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750xa"
     ]
    },
    {
     "product": "poweredge_c6520_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_c6520"
     ]
    },
    {
     "product": "poweredge_mx750c_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_mx750c"
     ]
    },
    {
     "product": "poweredge_r550_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r550"
     ]
    },
    {
     "product": "poweredge_r450_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r450"
     ]
    },
    {
     "product": "poweredge_r650xs_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r650xs"
     ]
    },
    {
     "product": "poweredge_r750xs_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_r750xs"
     ]
    },
    {
     "product": "poweredge_t550_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_t550"
     ]
    },
    {
     "product": "poweredge_xr11_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_xr11"
     ]
    },
    {
     "product": "poweredge_xr12_firmware",
     "versionEndExcluding": "1.13.2",
     "platforms": [
      "cpe:dell:poweredge_xr12"
     ]
    },
    {
     "product": "poweredge_xr4510c_firmware",
     "versionEndExcluding": "1.14.1",
     "platforms": [
      "cpe:dell:poweredge_xr4510c"
     ]
    },
    {
     "product": "poweredge_xr4520c_firmware",
     "versionEndExcluding": "1.14.1",
     "platforms": [
      "cpe:dell:poweredge_xr4520c"
     ]
    },
    {
     "product": "poweredge_t150_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_t150"
     ]
    },
    {
     "product": "poweredge_t350_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_t350"
     ]
    },
    {
     "product": "poweredge_r250_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_r250"
     ]
    },
    {
     "product": "poweredge_r350_firmware",
     "versionEndExcluding": "1.9.1",
     "platforms": [
      "cpe:dell:poweredge_r350"
     ]
    },
    {
     "product": "poweredge_r6515_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r6515"
     ]
    },
    {
     "product": "poweredge_r6525_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r6525"
     ]
    },
    {
     "product": "poweredge_r7515_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r7515"
     ]
    },
    {
     "product": "poweredge_r7525_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_r7525"
     ]
    },
    {
     "product": "poweredge_c6525_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_c6525"
     ]
    },
    {
     "product": "poweredge_xe8545_firmware",
     "versionEndExcluding": "2.14.1",
     "platforms": [
      "cpe:dell:poweredge_xe8545"
     ]
    },
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.21.2",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.21.2",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.21.2",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.21.2",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r540_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_r540"
     ]
    },
    {
     "product": "poweredge_r440_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_r440"
     ]
    },
    {
     "product": "poweredge_t440_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_t440"
     ]
    },
    {
     "product": "poweredge_xr2_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_xr2"
     ]
    },
    {
     "product": "poweredge_r740xd2_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_r740xd2"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_t640_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_t640"
     ]
    },
    {
     "product": "poweredge_c6420_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_c6420"
     ]
    },
    {
     "product": "poweredge_fc640_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_fc640"
     ]
    },
    {
     "product": "poweredge_m640_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_m640"
     ]
    },
    {
     "product": "poweredge_m640_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_m640_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    },
    {
     "product": "poweredge_c4140_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_c4140"
     ]
    },
    {
     "product": "poweredge_xe2420_firmware",
     "versionEndExcluding": "2.21.1",
     "platforms": [
      "cpe:dell:poweredge_xe2420"
     ]
    },
    {
     "product": "poweredge_xe7420_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_xe7420"
     ]
    },
    {
     "product": "poweredge_xe7440_firmware",
     "versionEndExcluding": "2.21.0",
     "platforms": [
      "cpe:dell:poweredge_xe7440"
     ]
    },
    {
     "product": "poweredge_t140_firmware",
     "versionEndExcluding": "2.16.0",
     "platforms": [
      "cpe:dell:poweredge_t140"
     ]
    },
    {
     "product": "poweredge_t340_firmware",
     "versionEndExcluding": "2.16.0",
     "platforms": [
      "cpe:dell:poweredge_t340"
     ]
    },
    {
     "product": "poweredge_r240_firmware",
     "versionEndExcluding": "2.16.0",
     "platforms": [
      "cpe:dell:poweredge_r240"
     ]
    },
    {
     "product": "poweredge_r340_firmware",
     "versionEndExcluding": "2.16.0",
     "platforms": [
      "cpe:dell:poweredge_r340"
     ]
    },
    {
     "product": "poweredge_r730_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r730"
     ]
    },
    {
     "product": "poweredge_r730xd_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r730xd"
     ]
    },
    {
     "product": "poweredge_r630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r630"
     ]
    },
    {
     "product": "poweredge_c4130_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_c4130"
     ]
    },
    {
     "product": "poweredge_r930_firmware",
     "versionEndExcluding": "2.14.0",
     "platforms": [
      "cpe:dell:poweredge_r930"
     ]
    },
    {
     "product": "poweredge_m630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m630"
     ]
    },
    {
     "product": "poweredge_m630_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m630_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_fc630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc630"
     ]
    },
    {
     "product": "poweredge_fc430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc430"
     ]
    },
    {
     "product": "poweredge_m830_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m830"
     ]
    },
    {
     "product": "poweredge_m830_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m830_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_fc830_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc830"
     ]
    },
    {
     "product": "poweredge_t630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_t630"
     ]
    },
    {
     "product": "poweredge_r530_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r530"
     ]
    },
    {
     "product": "poweredge_r430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r430"
     ]
    },
    {
     "product": "poweredge_t430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_t430"
     ]
    },
    {
     "product": "poweredge_r830_firmware",
     "versionEndExcluding": "1.19.0",
     "platforms": [
      "cpe:dell:poweredge_r830"
     ]
    },
    {
     "product": "poweredge_c6320_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_c6320"
     ]
    },
    {
     "product": "poweredge_t130_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_t130"
     ]
    },
    {
     "product": "poweredge_r230_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_r230"
     ]
    },
    {
     "product": "poweredge_t330_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_t330"
     ]
    },
    {
     "product": "poweredge_r330_firmware",
     "versionEndExcluding": "2.20.0",
     "platforms": [
      "cpe:dell:poweredge_r330"
     ]
    }
   ],
   "products": [
    "poweredge_c4130_firmware",
    "poweredge_c4140_firmware",
    "poweredge_c6320_firmware",
    "poweredge_c6420_firmware",
    "poweredge_c6520_firmware",
    "poweredge_c6525_firmware",
    "poweredge_c6615_firmware",
    "poweredge_c6620_firmware",
    "poweredge_fc430_firmware",
    "poweredge_fc630_firmware",
    "poweredge_fc640_firmware",
    "poweredge_fc830_firmware",
    "poweredge_hs5610_firmware",
    "poweredge_hs5620_firmware",
    "poweredge_m630_\\(pe_vrtx\\)_firmware",
    "poweredge_m630_firmware",
    "poweredge_m640_\\(pe_vrtx\\)_firmware",
    "poweredge_m640_firmware",
    "poweredge_m830_\\(pe_vrtx\\)_firmware",
    "poweredge_m830_firmware",
    "poweredge_mx740c_firmware",
    "poweredge_mx750c_firmware",
    "poweredge_mx760c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r230_firmware",
    "poweredge_r240_firmware",
    "poweredge_r250_firmware",
    "poweredge_r330_firmware",
    "poweredge_r340_firmware",
    "poweredge_r350_firmware",
    "poweredge_r430_firmware",
    "poweredge_r440_firmware",
    "poweredge_r450_firmware",
    "poweredge_r530_firmware",
    "poweredge_r540_firmware",
    "poweredge_r550_firmware",
    "poweredge_r630_firmware",
    "poweredge_r640_firmware",
    "poweredge_r650_firmware",
    "poweredge_r650xs_firmware",
    "poweredge_r6515_firmware",
    "poweredge_r6525_firmware",
    "poweredge_r660_firmware",
    "poweredge_r660xs_firmware",
    "poweredge_r6615_firmware",
    "poweredge_r6625_firmware",
    "poweredge_r730_firmware",
    "poweredge_r730xd_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd2_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r750_firmware",
    "poweredge_r750xa_firmware",
    "poweredge_r750xs_firmware",
    "poweredge_r7515_firmware",
    "poweredge_r7525_firmware",
    "poweredge_r760_firmware",
    "poweredge_r760xa_firmware",
    "poweredge_r760xd2_firmware",
    "poweredge_r760xs_firmware",
    "poweredge_r7615_firmware",
    "poweredge_r7625_firmware",
    "poweredge_r830_firmware",
    "poweredge_r840_firmware",
    "poweredge_r860_firmware",
    "poweredge_r930_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware",
    "poweredge_r960_firmware",
    "poweredge_t130_firmware",
    "poweredge_t140_firmware",
    "poweredge_t150_firmware",
    "poweredge_t330_firmware",
    "poweredge_t340_firmware",
    "poweredge_t350_firmware",
    "poweredge_t430_firmware",
    "poweredge_t440_firmware",
    "poweredge_t550_firmware",
    "poweredge_t560_firmware",
    "poweredge_t630_firmware",
    "poweredge_t640_firmware",
    "poweredge_xe2420_firmware",
    "poweredge_xe7420_firmware",
    "poweredge_xe7440_firmware",
    "poweredge_xe8545_firmware",
    "poweredge_xe8640_firmware",
    "poweredge_xe9640_firmware",
    "poweredge_xe9680_firmware",
    "poweredge_xr11_firmware",
    "poweredge_xr12_firmware",
    "poweredge_xr2_firmware",
    "poweredge_xr4510c_firmware",
    "poweredge_xr4520c_firmware",
    "poweredge_xr5610_firmware",
    "poweredge_xr7620_firmware",
    "poweredge_xr8610t_firmware",
    "poweredge_xr8620t_firmware"
   ]
  },
  "CVE-2024-10237": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.00249,
   "epss_date": "2026-10-28",
   "published": "2025-02-04T08:15:27.920",
   "modified": "2026-06-17T06:55:13.367",
   "severity": "high",
   "summary": "There is a vulnerability in the BMC firmware image authentication design \n\n at Supermicro MBD-X12DPG-OA6\n\n. An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process",
   "vendors": [
    "supermicro"
   ]
  },
  "CVE-2024-21626": {
   "cvss": 8.6,
   "cvss_version": "3.1",
   "epss": 0.18923,
   "epss_date": "2026-10-28",
   "fixed_in": "1.1.12",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2024-21626",
   "published": "2024-01-31T22:15:53.780",
   "modified": "2026-09-17T12:17:08.273",
   "severity": "high",
   "summary": "runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem (\"attack 2\"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run (\"attack 1\"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes (\"attack 3a\" and \"attack 3b\"). runc 1.1.12 includes patches for this issue.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndExcluding": "1.1.12"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2024-21927": {
   "cvss": 5,
   "cvss_version": "3.1",
   "epss": 0.00281,
   "epss_date": "2026-10-28",
   "published": "2025-09-23T22:15:33.033",
   "modified": "2026-06-17T07:10:25.613",
   "severity": "medium",
   "summary": "Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to use certain special characters in manipulated Redfish® API commands, causing service processes like OpenBMC to crash and reset, potentially resulting in denial of service.",
   "vendors": [
    "megarac"
   ]
  },
  "CVE-2024-22453": {
   "cvss": 6,
   "cvss_version": "3.1",
   "epss": 0.00187,
   "epss_date": "2026-10-28",
   "published": "2024-03-19T08:15:06.480",
   "modified": "2026-06-17T07:11:26.833",
   "severity": "medium",
   "summary": "Dell PowerEdge Server BIOS contains a heap-based buffer overflow vulnerability. A local high privileged attacker could potentially exploit this vulnerability to write to otherwise unauthorized memory.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r730_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r730"
     ]
    },
    {
     "product": "poweredge_r730xd_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r730xd"
     ]
    },
    {
     "product": "poweredge_r630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r630"
     ]
    },
    {
     "product": "poweredge_c4130_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_c4130"
     ]
    },
    {
     "product": "poweredge_r930_firmware",
     "versionEndExcluding": "2.14.0",
     "platforms": [
      "cpe:dell:poweredge_r930"
     ]
    },
    {
     "product": "poweredge_m630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m630"
     ]
    },
    {
     "product": "poweredge_m630_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m630_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_fc630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc630"
     ]
    },
    {
     "product": "poweredge_fc430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc430"
     ]
    },
    {
     "product": "poweredge_m830_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m830"
     ]
    },
    {
     "product": "poweredge_m830_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m830_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_fc830_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc830"
     ]
    },
    {
     "product": "poweredge_t630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_t630"
     ]
    },
    {
     "product": "poweredge_r530_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r530"
     ]
    },
    {
     "product": "poweredge_r430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r430"
     ]
    },
    {
     "product": "poweredge_t430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_t430"
     ]
    },
    {
     "product": "poweredge_r830_firmware",
     "versionEndExcluding": "1.19.0",
     "platforms": [
      "cpe:dell:poweredge_r830"
     ]
    },
    {
     "product": "poweredge_c6320_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_c6320"
     ]
    }
   ],
   "products": [
    "poweredge_c4130_firmware",
    "poweredge_c6320_firmware",
    "poweredge_fc430_firmware",
    "poweredge_fc630_firmware",
    "poweredge_fc830_firmware",
    "poweredge_m630_\\(pe_vrtx\\)_firmware",
    "poweredge_m630_firmware",
    "poweredge_m830_\\(pe_vrtx\\)_firmware",
    "poweredge_m830_firmware",
    "poweredge_r430_firmware",
    "poweredge_r530_firmware",
    "poweredge_r630_firmware",
    "poweredge_r730_firmware",
    "poweredge_r730xd_firmware",
    "poweredge_r830_firmware",
    "poweredge_r930_firmware",
    "poweredge_t430_firmware",
    "poweredge_t630_firmware"
   ]
  },
  "CVE-2024-25621": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00168,
   "epss_date": "2026-10-28",
   "published": "2025-11-06T19:15:40.090",
   "modified": "2026-06-17T07:16:18.617",
   "severity": "high",
   "summary": "containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionEndExcluding": "1.7.29"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.0.0",
     "versionEndExcluding": "2.0.7"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.1.0",
     "versionEndExcluding": "2.1.5"
    },
    {
     "product": "containerd",
     "eq": "2.2.0"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2024-25942": {
   "cvss": 6.8,
   "cvss_version": "3.1",
   "epss": 0.00233,
   "epss_date": "2026-10-28",
   "published": "2024-03-19T08:15:06.713",
   "modified": "2026-06-17T07:16:46.250",
   "severity": "medium",
   "summary": "Dell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability. A physical high privileged attacker could potentially exploit this vulnerability leading to arbitrary writes to SMRAM.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r730_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r730"
     ]
    },
    {
     "product": "poweredge_r730xd_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r730xd"
     ]
    },
    {
     "product": "poweredge_r630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r630"
     ]
    },
    {
     "product": "poweredge_c4130_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_c4130"
     ]
    },
    {
     "product": "poweredge_r930_firmware",
     "versionEndExcluding": "2.14.0",
     "platforms": [
      "cpe:dell:poweredge_r930"
     ]
    },
    {
     "product": "poweredge_m630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m630"
     ]
    },
    {
     "product": "poweredge_m630_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m630_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_fc630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc630"
     ]
    },
    {
     "product": "poweredge_fc430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc430"
     ]
    },
    {
     "product": "poweredge_m830_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m830"
     ]
    },
    {
     "product": "poweredge_m830_\\(pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_m830_\\(pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_fc830_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_fc830"
     ]
    },
    {
     "product": "poweredge_t630_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_t630"
     ]
    },
    {
     "product": "poweredge_r530_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r530"
     ]
    },
    {
     "product": "poweredge_r430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_r430"
     ]
    },
    {
     "product": "poweredge_t430_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_t430"
     ]
    },
    {
     "product": "poweredge_r830_firmware",
     "versionEndExcluding": "1.19.0",
     "platforms": [
      "cpe:dell:poweredge_r830"
     ]
    },
    {
     "product": "poweredge_c6320_firmware",
     "versionEndExcluding": "2.19.0",
     "platforms": [
      "cpe:dell:poweredge_c6320"
     ]
    }
   ],
   "products": [
    "poweredge_c4130_firmware",
    "poweredge_c6320_firmware",
    "poweredge_fc430_firmware",
    "poweredge_fc630_firmware",
    "poweredge_fc830_firmware",
    "poweredge_m630_\\(pe_vrtx\\)_firmware",
    "poweredge_m630_firmware",
    "poweredge_m830_\\(pe_vrtx\\)_firmware",
    "poweredge_m830_firmware",
    "poweredge_r430_firmware",
    "poweredge_r530_firmware",
    "poweredge_r630_firmware",
    "poweredge_r730_firmware",
    "poweredge_r730xd_firmware",
    "poweredge_r830_firmware",
    "poweredge_r930_firmware",
    "poweredge_t430_firmware",
    "poweredge_t630_firmware"
   ]
  },
  "CVE-2024-25943": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.0066,
   "epss_date": "2026-10-28",
   "published": "2024-06-29T13:15:10.403",
   "modified": "2026-06-17T07:16:46.473",
   "severity": "critical",
   "summary": "iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A remote attacker could potentially exploit this vulnerability, leading to arbitrary code execution on the vulnerable application.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9",
     "versionEndExcluding": "7.00.00.172"
    },
    {
     "product": "idrac9",
     "versionEndExcluding": "7.10.50.00"
    }
   ],
   "products": [
    "dell:idrac9"
   ]
  },
  "CVE-2024-31916": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.0055,
   "epss_date": "2026-10-28",
   "published": "2024-06-27T18:15:17.857",
   "modified": "2026-06-17T07:28:56.120",
   "severity": "high",
   "summary": "IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels.  IBM X-ForceID:  290026.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ibm:openbmc"
   ]
  },
  "CVE-2024-35124": {
   "cvss": 7.5,
   "cvss_version": "3.1",
   "epss": 0.00511,
   "epss_date": "2026-10-28",
   "published": "2024-08-13T12:15:06.163",
   "modified": "2026-06-17T07:34:24.693",
   "severity": "high",
   "summary": "A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC.  IBM X-Force ID:  290674.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ibm:openbmc"
   ]
  },
  "CVE-2024-36435": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.01293,
   "epss_date": "2026-10-28",
   "published": "2024-07-11T21:15:12.507",
   "modified": "2026-06-17T07:36:42.800",
   "severity": "critical",
   "summary": "An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules). An unauthenticated user can post crafted data to the interface that triggers a stack buffer overflow, and may lead to arbitrary remote code execution on a BMC.",
   "vendors": [
    "supermicro"
   ]
  },
  "CVE-2024-38303": {
   "cvss": 6,
   "cvss_version": "3.1",
   "epss": 0.00144,
   "epss_date": "2026-10-28",
   "published": "2024-08-29T11:15:25.970",
   "modified": "2026-06-17T07:39:54.270",
   "severity": "medium",
   "summary": "Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Improper Input Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_xe7440_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_xe7440"
     ]
    },
    {
     "product": "poweredge_xe7420_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_xe7420"
     ]
    },
    {
     "product": "poweredge_xe2420_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_xe2420"
     ]
    },
    {
     "product": "poweredge_c4140_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_c4140"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_m640_\\(for_pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_m640_\\(for_pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_m640_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_m640"
     ]
    },
    {
     "product": "poweredge_fc640_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_fc640"
     ]
    },
    {
     "product": "poweredge_c6420_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_c6420"
     ]
    },
    {
     "product": "poweredge_t640_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_t640"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_r740xd2_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_r740xd2"
     ]
    },
    {
     "product": "poweredge_xr2_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_xr2"
     ]
    },
    {
     "product": "poweredge_t440_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_t440"
     ]
    },
    {
     "product": "poweredge_r440_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_r440"
     ]
    },
    {
     "product": "poweredge_r540_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_r540"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    }
   ],
   "products": [
    "poweredge_c4140_firmware",
    "poweredge_c6420_firmware",
    "poweredge_fc640_firmware",
    "poweredge_m640_\\(for_pe_vrtx\\)_firmware",
    "poweredge_m640_firmware",
    "poweredge_mx740c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r440_firmware",
    "poweredge_r540_firmware",
    "poweredge_r640_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd2_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r840_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware",
    "poweredge_t440_firmware",
    "poweredge_t640_firmware",
    "poweredge_xe2420_firmware",
    "poweredge_xe7420_firmware",
    "poweredge_xe7440_firmware",
    "poweredge_xr2_firmware"
   ]
  },
  "CVE-2024-38304": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.00149,
   "epss_date": "2026-10-28",
   "published": "2024-08-29T11:15:26.187",
   "modified": "2026-06-17T07:39:54.420",
   "severity": "medium",
   "summary": "Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_xe7440_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_xe7440"
     ]
    },
    {
     "product": "poweredge_xe7420_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_xe7420"
     ]
    },
    {
     "product": "poweredge_xe2420_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_xe2420"
     ]
    },
    {
     "product": "poweredge_c4140_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_c4140"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_m640_\\(for_pe_vrtx\\)_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_m640_\\(for_pe_vrtx\\)"
     ]
    },
    {
     "product": "poweredge_m640_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_m640"
     ]
    },
    {
     "product": "poweredge_fc640_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_fc640"
     ]
    },
    {
     "product": "poweredge_c6420_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_c6420"
     ]
    },
    {
     "product": "poweredge_t640_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_t640"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_r740xd2_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_r740xd2"
     ]
    },
    {
     "product": "poweredge_xr2_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_xr2"
     ]
    },
    {
     "product": "poweredge_t440_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_t440"
     ]
    },
    {
     "product": "poweredge_r440_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_r440"
     ]
    },
    {
     "product": "poweredge_r540_firmware",
     "versionEndExcluding": "2.22.1",
     "platforms": [
      "cpe:dell:poweredge_r540"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.22.2",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    }
   ],
   "products": [
    "poweredge_c4140_firmware",
    "poweredge_c6420_firmware",
    "poweredge_fc640_firmware",
    "poweredge_m640_\\(for_pe_vrtx\\)_firmware",
    "poweredge_m640_firmware",
    "poweredge_mx740c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r440_firmware",
    "poweredge_r540_firmware",
    "poweredge_r640_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd2_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r840_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware",
    "poweredge_t440_firmware",
    "poweredge_t640_firmware",
    "poweredge_xe2420_firmware",
    "poweredge_xe7420_firmware",
    "poweredge_xe7440_firmware",
    "poweredge_xr2_firmware"
   ]
  },
  "CVE-2024-38508": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.01017,
   "epss_date": "2026-10-28",
   "published": "2024-07-26T20:15:03.597",
   "modified": "2026-06-17T07:40:25.077",
   "severity": "high",
   "summary": "A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via a specially crafted request.",
   "vendors": [
    "xcc"
   ]
  },
  "CVE-2024-38509": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.0055,
   "epss_date": "2026-10-28",
   "published": "2024-07-26T20:15:03.830",
   "modified": "2026-06-17T07:40:25.460",
   "severity": "high",
   "summary": "A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command.",
   "vendors": [
    "xcc"
   ]
  },
  "CVE-2024-38510": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.01071,
   "epss_date": "2026-10-28",
   "published": "2024-07-26T20:15:04.053",
   "modified": "2026-06-17T07:40:25.840",
   "severity": "high",
   "summary": "A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.",
   "vendors": [
    "xcc"
   ]
  },
  "CVE-2024-38511": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.01006,
   "epss_date": "2026-10-28",
   "published": "2024-07-26T20:15:04.263",
   "modified": "2026-06-17T07:40:26.250",
   "severity": "high",
   "summary": "A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.",
   "vendors": [
    "xcc"
   ]
  },
  "CVE-2024-38512": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.01006,
   "epss_date": "2026-10-28",
   "published": "2024-07-26T20:15:04.470",
   "modified": "2026-06-17T07:40:26.633",
   "severity": "high",
   "summary": "A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.",
   "vendors": [
    "xcc"
   ]
  },
  "CVE-2024-40635": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00304,
   "epss_date": "2026-10-28",
   "published": "2025-03-17T22:15:13.150",
   "modified": "2026-06-17T07:46:12.817",
   "severity": "high",
   "summary": "containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionEndExcluding": "1.6.38"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "1.7.0",
     "versionEndExcluding": "1.7.27"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.0.0",
     "versionEndExcluding": "2.0.4"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2024-41660": {
   "cvss": 9.8,
   "cvss_version": "3.1",
   "epss": 0.00856,
   "epss_date": "2026-10-28",
   "published": "2024-07-31T20:15:06.147",
   "modified": "2026-06-17T07:48:00.183",
   "severity": "critical",
   "summary": "slpd-lite is a unicast SLP UDP server. Any OpenBMC system that includes the slpd-lite package is impacted. Installing this package is the default when building OpenBMC. Nefarious users can send slp packets to the BMC using UDP port 427 to cause memory overflow issues within the slpd-lite daemon on the BMC. Patches will be available in the latest openbmc/slpd-lite repository.",
   "vendors": [
    "megarac"
   ]
  },
  "CVE-2024-45101": {
   "cvss": 6.8,
   "cvss_version": "3.1",
   "epss": 0.00203,
   "epss_date": "2026-10-28",
   "published": "2024-09-13T18:15:04.437",
   "modified": "2026-06-17T07:53:34.313",
   "severity": "medium",
   "summary": "A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user’s XCC session if they can convince the user to click on a specially crafted URL.",
   "vendors": [
    "xcc"
   ]
  },
  "CVE-2024-45102": {
   "cvss": 6.8,
   "cvss_version": "3.1",
   "epss": 0.00205,
   "epss_date": "2026-10-28",
   "published": "2025-01-14T22:15:26.820",
   "modified": "2026-06-17T07:53:34.413",
   "severity": "medium",
   "summary": "A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a connected XCC instance when using LXCA as a Single Sign On (SSO) provider for XCC instances.",
   "vendors": [
    "xcc"
   ]
  },
  "CVE-2024-45310": {
   "cvss": 3.6,
   "cvss_version": "3.1",
   "epss": 0.00317,
   "epss_date": "2026-10-28",
   "fixed_in": "1.1.14",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2024-45310",
   "published": "2024-09-03T19:15:15.243",
   "modified": "2026-06-17T07:54:00.017",
   "severity": "low",
   "summary": "runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack's scope but the exact scope of protection hasn't been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3.\n\nSome workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the remapped root user/group has write access to. Unless the root user is remapped to an actual\nuser on the host (such as with rootless containers that don't use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict the scope if a specific label is applied to the runc runtime, though neither the extent to which the standard existing policies block this attack nor what exact policies are needed to sufficiently restrict this attack have been thoroughly tested.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndExcluding": "1.1.14"
    },
    {
     "product": "runc",
     "eq": "1.2.0"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2024-54085": {
   "cvss": 10,
   "cvss_version": "4.0",
   "kev": true,
   "kev_added": "2025-06-25",
   "epss": 0.60747,
   "epss_date": "2026-10-28",
   "published": "2025-03-11T14:15:22.893",
   "modified": "2026-06-17T08:09:44.677",
   "severity": "critical",
   "summary": "AMI’s SPx contains\na vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ami:megarac_sp-x",
    "netapp:h300s",
    "netapp:h300s_firmware",
    "netapp:h410c",
    "netapp:h410c_firmware",
    "netapp:h410s",
    "netapp:h410s_firmware",
    "netapp:h500s",
    "netapp:h500s_firmware",
    "netapp:h700s",
    "netapp:h700s_firmware",
    "netapp:sg6160_firmware"
   ]
  },
  "CVE-2024-8059": {
   "cvss": 4.3,
   "cvss_version": "3.1",
   "epss": 0.00195,
   "epss_date": "2026-10-28",
   "published": "2024-09-13T18:15:06.430",
   "modified": "2026-06-17T08:21:47.093",
   "severity": "medium",
   "summary": "IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters.",
   "vendors": [
    "xcc"
   ]
  },
  "CVE-2024-8278": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.01099,
   "epss_date": "2026-10-28",
   "published": "2024-09-13T18:15:06.703",
   "modified": "2026-06-17T08:22:15.030",
   "severity": "high",
   "summary": "A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.",
   "vendors": [
    "xcc"
   ]
  },
  "CVE-2024-8279": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.01099,
   "epss_date": "2026-10-28",
   "published": "2024-09-13T18:15:06.973",
   "modified": "2026-06-17T08:22:15.503",
   "severity": "high",
   "summary": "A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.",
   "vendors": [
    "xcc"
   ]
  },
  "CVE-2024-8280": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.01032,
   "epss_date": "2026-10-28",
   "published": "2024-09-13T18:15:07.270",
   "modified": "2026-06-17T08:22:15.973",
   "severity": "high",
   "summary": "An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or cause a recoverable denial of service using a specially crafted file.",
   "vendors": [
    "xcc"
   ]
  },
  "CVE-2024-8281": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.01032,
   "epss_date": "2026-10-28",
   "published": "2024-09-13T18:15:07.603",
   "modified": "2026-06-17T08:22:16.447",
   "severity": "high",
   "summary": "An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line input in the XCC SSH captive shell.",
   "vendors": [
    "xcc"
   ]
  },
  "CVE-2025-12006": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.00301,
   "epss_date": "2026-10-28",
   "published": "2026-01-16T09:15:58.510",
   "modified": "2026-06-17T08:31:33.827",
   "severity": "high",
   "summary": "There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW-F . An attacker can update the system firmware with a specially crafted image.",
   "vendors": [
    "supermicro"
   ]
  },
  "CVE-2025-12007": {
   "cvss": 8.4,
   "cvss_version": "3.1",
   "epss": 0.00131,
   "epss_date": "2026-10-28",
   "published": "2026-01-16T09:15:59.520",
   "modified": "2026-06-17T08:31:33.933",
   "severity": "high",
   "summary": "There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image.",
   "vendors": [
    "supermicro"
   ]
  },
  "CVE-2025-20097": {
   "cvss": 5.3,
   "cvss_version": "4.0",
   "epss": 0.00473,
   "epss_date": "2026-10-28",
   "published": "2025-02-12T22:15:41.850",
   "modified": "2026-06-17T08:40:40.130",
   "severity": "medium",
   "summary": "Uncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before version R01.02.0002 may allow an authenticated user to potentially enable denial of service via network access.",
   "vendors": [
    "megarac"
   ]
  },
  "CVE-2025-22397": {
   "cvss": 4.9,
   "cvss_version": "3.1",
   "epss": 0.00461,
   "epss_date": "2026-10-28",
   "published": "2025-11-06T19:15:41.153",
   "modified": "2026-10-18T21:10:00.120",
   "severity": "medium",
   "summary": "Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionStartIncluding": "6.10.80.00",
     "versionEndExcluding": "7.00.00.181"
    },
    {
     "product": "idrac9_firmware",
     "versionStartIncluding": "7.00.00.183",
     "versionEndExcluding": "7.20.10.50"
    },
    {
     "product": "idrac10_firmware",
     "versionEndExcluding": "1.20.25.00"
    }
   ],
   "products": [
    "dell:idrac10",
    "dell:idrac10_firmware",
    "dell:idrac9",
    "dell:idrac9_firmware"
   ]
  },
  "CVE-2025-23337": {
   "cvss": 6.7,
   "cvss_version": "3.1",
   "epss": 0.00154,
   "epss_date": "2026-10-28",
   "published": "2025-09-17T23:15:36.500",
   "modified": "2026-06-17T08:53:37.543",
   "severity": "medium",
   "summary": "NVIDIA HGX \u0026 DGX GB200, GB300, B300  contain a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the BMC to access the HMC as an administrator. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "dgx"
   ]
  },
  "CVE-2025-23359": {
   "cvss": 8.1,
   "cvss_version": "3.1",
   "epss": 0.03669,
   "epss_date": "2026-10-28",
   "fixed_in": "1.17.4",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2025-23359",
   "published": "2025-02-12T01:15:09.230",
   "modified": "2026-06-17T08:53:46.810",
   "severity": "high",
   "summary": "NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
   "vendors": [
    "nvidia-container-toolkit"
   ],
   "ranges": [
    {
     "product": "nvidia_container_toolkit",
     "versionEndExcluding": "1.17.4",
     "platforms": [
      "os:linux"
     ]
    }
   ],
   "products": [
    "nvidia_container_toolkit"
   ]
  },
  "CVE-2025-26482": {
   "cvss": 4.9,
   "cvss_version": "3.1",
   "epss": 0.00304,
   "epss_date": "2026-10-28",
   "published": "2025-09-25T21:15:31.720",
   "modified": "2026-06-17T09:01:52.730",
   "severity": "medium",
   "summary": "Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure.",
   "vendors": [
    "dell-poweredge-bios",
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "7.00.00.181"
    },
    {
     "product": "idrac9_firmware",
     "versionEndExcluding": "7.20.10.50"
    },
    {
     "product": "poweredge_r770_firmware",
     "versionEndExcluding": "1.2.6",
     "platforms": [
      "cpe:dell:poweredge_r770"
     ]
    },
    {
     "product": "poweredge_r670_firmware",
     "versionEndExcluding": "1.2.6",
     "platforms": [
      "cpe:dell:poweredge_r670"
     ]
    },
    {
     "product": "poweredge_r570_firmware",
     "versionEndExcluding": "1.2.6",
     "platforms": [
      "cpe:dell:poweredge_r570"
     ]
    },
    {
     "product": "poweredge_r470_firmware",
     "versionEndExcluding": "1.2.6",
     "platforms": [
      "cpe:dell:poweredge_r470"
     ]
    },
    {
     "product": "poweredge_r6715_firmware",
     "versionEndExcluding": "1.1.2",
     "platforms": [
      "cpe:dell:poweredge_r6715"
     ]
    },
    {
     "product": "poweredge_r7715_firmware",
     "versionEndExcluding": "1.1.2",
     "platforms": [
      "cpe:dell:poweredge_r7715"
     ]
    },
    {
     "product": "poweredge_r6725_firmware",
     "versionEndExcluding": "1.1.3",
     "platforms": [
      "cpe:dell:poweredge_r6725"
     ]
    },
    {
     "product": "poweredge_r7725_firmware",
     "versionEndExcluding": "1.1.3",
     "platforms": [
      "cpe:dell:poweredge_r7725"
     ]
    },
    {
     "product": "poweredge_r660_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_r660"
     ]
    },
    {
     "product": "poweredge_r760_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_r760"
     ]
    },
    {
     "product": "poweredge_c6620_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_c6620"
     ]
    },
    {
     "product": "poweredge_mx760c_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_mx760c"
     ]
    },
    {
     "product": "poweredge_r860_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_r860"
     ]
    },
    {
     "product": "poweredge_r960_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_r960"
     ]
    },
    {
     "product": "poweredge_hs5610_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_hs5610"
     ]
    },
    {
     "product": "poweredge_hs5620_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_hs5620"
     ]
    },
    {
     "product": "poweredge_r660xs_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_r660xs"
     ]
    },
    {
     "product": "poweredge_r760xs_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_r760xs"
     ]
    },
    {
     "product": "poweredge_r760xd2_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_r760xd2"
     ]
    },
    {
     "product": "poweredge_t560_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_t560"
     ]
    },
    {
     "product": "poweredge_r760xa_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_r760xa"
     ]
    },
    {
     "product": "poweredge_xe9680_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_xe9680"
     ]
    },
    {
     "product": "poweredge_xe9680l_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_xe9680l"
     ]
    },
    {
     "product": "poweredge_xr5610_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_xr5610"
     ]
    },
    {
     "product": "poweredge_xr8610t_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_xr8610t"
     ]
    },
    {
     "product": "poweredge_xr8620t_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_xr8620t"
     ]
    },
    {
     "product": "poweredge_xr7620_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_xr7620"
     ]
    },
    {
     "product": "poweredge_xe8640_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_xe8640"
     ]
    },
    {
     "product": "poweredge_xe9640_firmware",
     "versionEndExcluding": "2.5.4",
     "platforms": [
      "cpe:dell:poweredge_xe9640"
     ]
    },
    {
     "product": "poweredge_t160_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_t160"
     ]
    },
    {
     "product": "poweredge_t360_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_t360"
     ]
    },
    {
     "product": "poweredge_r260_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r260"
     ]
    },
    {
     "product": "poweredge_r360_firmware",
     "versionEndExcluding": "2.0.0",
     "platforms": [
      "cpe:dell:poweredge_r360"
     ]
    },
    {
     "product": "poweredge_r650_firmware",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "cpe:dell:poweredge_r650"
     ]
    },
    {
     "product": "poweredge_r750_firmware",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "cpe:dell:poweredge_r750"
     ]
    },
    {
     "product": "poweredge_r750xa_firmware",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "cpe:dell:poweredge_r750xa"
     ]
    },
    {
     "product": "poweredge_c6520_firmware",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "cpe:dell:poweredge_c6520"
     ]
    },
    {
     "product": "poweredge_mx750c_firmware",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "cpe:dell:poweredge_mx750c"
     ]
    },
    {
     "product": "poweredge_r550_firmware",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "cpe:dell:poweredge_r550"
     ]
    },
    {
     "product": "poweredge_r450_firmware",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "cpe:dell:poweredge_r450"
     ]
    },
    {
     "product": "poweredge_r650xs_firmware",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "cpe:dell:poweredge_r650xs"
     ]
    },
    {
     "product": "poweredge_r750xs_firmware",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "cpe:dell:poweredge_r750xs"
     ]
    },
    {
     "product": "poweredge_t550_firmware",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "cpe:dell:poweredge_t550"
     ]
    },
    {
     "product": "poweredge_xr11_firmware",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "cpe:dell:poweredge_xr11"
     ]
    },
    {
     "product": "poweredge_xr12_firmware",
     "versionEndExcluding": "1.16.2",
     "platforms": [
      "cpe:dell:poweredge_xr12"
     ]
    },
    {
     "product": "poweredge_xr4510c_firmware",
     "versionEndExcluding": "1.17.3",
     "platforms": [
      "cpe:dell:poweredge_xr4510c"
     ]
    },
    {
     "product": "poweredge_xr4520c_firmware",
     "versionEndExcluding": "1.17.3",
     "platforms": [
      "cpe:dell:poweredge_xr4520c"
     ]
    },
    {
     "product": "poweredge_t150_firmware",
     "versionEndExcluding": "1.11.1",
     "platforms": [
      "cpe:dell:poweredge_t150"
     ]
    },
    {
     "product": "poweredge_t350_firmware",
     "versionEndExcluding": "1.11.1",
     "platforms": [
      "cpe:dell:poweredge_t350"
     ]
    },
    {
     "product": "poweredge_r250_firmware",
     "versionEndExcluding": "1.11.1",
     "platforms": [
      "cpe:dell:poweredge_r250"
     ]
    },
    {
     "product": "poweredge_r350_firmware",
     "versionEndExcluding": "1.11.1",
     "platforms": [
      "cpe:dell:poweredge_r350"
     ]
    },
    {
     "product": "poweredge_r740_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_r740"
     ]
    },
    {
     "product": "poweredge_r740xd_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_r740xd"
     ]
    },
    {
     "product": "poweredge_r640_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_r640"
     ]
    },
    {
     "product": "poweredge_r940_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_r940"
     ]
    },
    {
     "product": "poweredge_r540_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_r540"
     ]
    },
    {
     "product": "poweredge_r440_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_r440"
     ]
    },
    {
     "product": "poweredge_t440_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_t440"
     ]
    },
    {
     "product": "poweredge_xr2_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_xr2"
     ]
    },
    {
     "product": "poweredge_r740xd2_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_r740xd2"
     ]
    },
    {
     "product": "poweredge_r840_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_r840"
     ]
    },
    {
     "product": "poweredge_r940xa_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_r940xa"
     ]
    },
    {
     "product": "poweredge_t640_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_t640"
     ]
    },
    {
     "product": "poweredge_c6420_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_c6420"
     ]
    },
    {
     "product": "poweredge_fc640_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_fc640"
     ]
    },
    {
     "product": "poweredge_m640_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_m640"
     ]
    },
    {
     "product": "poweredge_mx740c_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_mx740c"
     ]
    },
    {
     "product": "poweredge_r6615_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_r6615"
     ]
    },
    {
     "product": "poweredge_r7615_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_r7615"
     ]
    },
    {
     "product": "poweredge_r6625_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_r6625"
     ]
    },
    {
     "product": "poweredge_r7625_firmware",
     "versionEndExcluding": "1.11.2",
     "platforms": [
      "cpe:dell:poweredge_r7625"
     ]
    },
    {
     "product": "poweredge_c6615_firmware",
     "versionEndExcluding": "1.6.2",
     "platforms": [
      "cpe:dell:poweredge_c6615"
     ]
    },
    {
     "product": "poweredge_r6515_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r6515"
     ]
    },
    {
     "product": "poweredge_r6525_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r6525"
     ]
    },
    {
     "product": "poweredge_r7515_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r7515"
     ]
    },
    {
     "product": "poweredge_r7525_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_r7525"
     ]
    },
    {
     "product": "poweredge_c6525_firmware",
     "versionEndExcluding": "2.18.1",
     "platforms": [
      "cpe:dell:poweredge_c6525"
     ]
    },
    {
     "product": "poweredge_xe8545_firmware",
     "versionEndExcluding": "2.17.1",
     "platforms": [
      "cpe:dell:poweredge_xe8545"
     ]
    },
    {
     "product": "poweredge_r6415_firmware",
     "versionEndExcluding": "1.25.0",
     "platforms": [
      "cpe:dell:poweredge_r6415"
     ]
    },
    {
     "product": "poweredge_r7415_firmware",
     "versionEndExcluding": "1.25.0",
     "platforms": [
      "cpe:dell:poweredge_r7415"
     ]
    },
    {
     "product": "poweredge_r7425_firmware",
     "versionEndExcluding": "1.25.0",
     "platforms": [
      "cpe:dell:poweredge_r7425"
     ]
    },
    {
     "product": "poweredge_r340_firmware",
     "versionEndExcluding": "2.18.0",
     "platforms": [
      "cpe:dell:poweredge_r340"
     ]
    },
    {
     "product": "poweredge_r240_firmware",
     "versionEndExcluding": "2.18.0",
     "platforms": [
      "cpe:dell:poweredge_r240"
     ]
    },
    {
     "product": "poweredge_t340_firmware",
     "versionEndExcluding": "2.18.0",
     "platforms": [
      "cpe:dell:poweredge_t340"
     ]
    },
    {
     "product": "poweredge_t140_firmware",
     "versionEndExcluding": "2.18.0",
     "platforms": [
      "cpe:dell:poweredge_t140"
     ]
    },
    {
     "product": "poweredge_xe7440_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_xe7440"
     ]
    },
    {
     "product": "poweredge_xe7420_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_xe7420"
     ]
    },
    {
     "product": "poweredge_xe2420_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_xe2420"
     ]
    },
    {
     "product": "poweredge_c4140_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_c4140"
     ]
    },
    {
     "product": "poweredge_mx840c_firmware",
     "versionEndExcluding": "2.23.0",
     "platforms": [
      "cpe:dell:poweredge_mx840c"
     ]
    }
   ],
   "products": [
    "dell:poweredge_r470",
    "dell:poweredge_r470_firmware",
    "dell:poweredge_r570",
    "dell:poweredge_r570_firmware",
    "dell:poweredge_r670",
    "dell:poweredge_r670_firmware",
    "dell:poweredge_r6715",
    "dell:poweredge_r6715_firmware",
    "dell:poweredge_r770",
    "dell:poweredge_r770_firmware",
    "dell:poweredge_r7715",
    "dell:poweredge_r7715_firmware",
    "poweredge_c4140_firmware",
    "poweredge_c6420_firmware",
    "poweredge_c6520_firmware",
    "poweredge_c6525_firmware",
    "poweredge_c6615_firmware",
    "poweredge_c6620_firmware",
    "poweredge_fc640_firmware",
    "poweredge_hs5610_firmware",
    "poweredge_hs5620_firmware",
    "poweredge_m640_firmware",
    "poweredge_mx740c_firmware",
    "poweredge_mx750c_firmware",
    "poweredge_mx760c_firmware",
    "poweredge_mx840c_firmware",
    "poweredge_r240_firmware",
    "poweredge_r250_firmware",
    "poweredge_r260_firmware",
    "poweredge_r340_firmware",
    "poweredge_r350_firmware",
    "poweredge_r360_firmware",
    "poweredge_r440_firmware",
    "poweredge_r450_firmware",
    "poweredge_r470_firmware",
    "poweredge_r540_firmware",
    "poweredge_r550_firmware",
    "poweredge_r570_firmware",
    "poweredge_r640_firmware",
    "poweredge_r6415_firmware",
    "poweredge_r650_firmware",
    "poweredge_r650xs_firmware",
    "poweredge_r6515_firmware",
    "poweredge_r6525_firmware",
    "poweredge_r660_firmware",
    "poweredge_r660xs_firmware",
    "poweredge_r6615_firmware",
    "poweredge_r6625_firmware",
    "poweredge_r670_firmware",
    "poweredge_r6715_firmware",
    "poweredge_r6725_firmware",
    "poweredge_r740_firmware",
    "poweredge_r740xd2_firmware",
    "poweredge_r740xd_firmware",
    "poweredge_r7415_firmware",
    "poweredge_r7425_firmware",
    "poweredge_r750_firmware",
    "poweredge_r750xa_firmware",
    "poweredge_r750xs_firmware",
    "poweredge_r7515_firmware",
    "poweredge_r7525_firmware",
    "poweredge_r760_firmware",
    "poweredge_r760xa_firmware",
    "poweredge_r760xd2_firmware",
    "poweredge_r760xs_firmware",
    "poweredge_r7615_firmware",
    "poweredge_r7625_firmware",
    "poweredge_r770_firmware",
    "poweredge_r7715_firmware",
    "poweredge_r7725_firmware",
    "poweredge_r840_firmware",
    "poweredge_r860_firmware",
    "poweredge_r940_firmware",
    "poweredge_r940xa_firmware",
    "poweredge_r960_firmware",
    "poweredge_t140_firmware",
    "poweredge_t150_firmware",
    "poweredge_t160_firmware",
    "poweredge_t340_firmware",
    "poweredge_t350_firmware",
    "poweredge_t360_firmware",
    "poweredge_t440_firmware",
    "poweredge_t550_firmware",
    "poweredge_t560_firmware",
    "poweredge_t640_firmware",
    "poweredge_xe2420_firmware",
    "poweredge_xe7420_firmware",
    "poweredge_xe7440_firmware",
    "poweredge_xe8545_firmware",
    "poweredge_xe8640_firmware",
    "poweredge_xe9640_firmware",
    "poweredge_xe9680_firmware",
    "poweredge_xe9680l_firmware",
    "poweredge_xr11_firmware",
    "poweredge_xr12_firmware",
    "poweredge_xr2_firmware",
    "poweredge_xr4510c_firmware",
    "poweredge_xr4520c_firmware",
    "poweredge_xr5610_firmware",
    "poweredge_xr7620_firmware",
    "poweredge_xr8610t_firmware",
    "poweredge_xr8620t_firmware"
   ]
  },
  "CVE-2025-27689": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00129,
   "epss_date": "2026-10-28",
   "fixed_in": "11.3.0.0",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2025-27689",
   "published": "2025-06-12T21:15:20.113",
   "modified": "2026-06-17T09:04:04.040",
   "severity": "high",
   "summary": "Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac_tools",
     "versionEndExcluding": "11.3.0.0"
    }
   ],
   "products": [
    "dell:idrac_tools"
   ]
  },
  "CVE-2025-31133": {
   "cvss": 7.3,
   "cvss_version": "4.0",
   "epss": 0.01245,
   "epss_date": "2026-10-28",
   "published": "2025-11-06T19:15:41.343",
   "modified": "2026-10-07T21:10:00.200",
   "severity": "high",
   "summary": "runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack:  an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndExcluding": "1.2.8"
    },
    {
     "product": "runc",
     "versionStartIncluding": "1.3.0",
     "versionEndExcluding": "1.3.3"
    },
    {
     "product": "runc",
     "eq": "1.4.0"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2025-33221": {
   "cvss": 6,
   "cvss_version": "3.1",
   "epss": 0.00175,
   "epss_date": "2026-10-28",
   "published": "2026-05-26T18:16:36.720",
   "modified": "2026-07-24T11:10:00.170",
   "severity": "medium",
   "summary": "NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel driver, where a user could cause an incorrect permission assignment for a critical resource. A successful exploit of this vulnerability might lead to data tampering and denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "539.72"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "582.53"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.36"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2025-36581": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00136,
   "epss_date": "2026-10-28",
   "fixed_in": "1.26.0",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2025-36581",
   "published": "2025-08-14T14:15:30.760",
   "modified": "2026-06-17T09:14:49.760",
   "severity": "medium",
   "summary": "Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.",
   "vendors": [
    "dell-poweredge-bios"
   ],
   "ranges": [
    {
     "product": "poweredge_r7425_firmware",
     "versionEndIncluding": "1.26.0",
     "platforms": [
      "cpe:dell:poweredge_r7425"
     ]
    },
    {
     "product": "poweredge_r7415_firmware",
     "versionEndExcluding": "1.26.0",
     "platforms": [
      "cpe:dell:poweredge_r7415"
     ]
    },
    {
     "product": "poweredge_r6415_firmware",
     "versionEndExcluding": "1.26.0",
     "platforms": [
      "cpe:dell:poweredge_r6415"
     ]
    }
   ],
   "products": [
    "poweredge_r6415_firmware",
    "poweredge_r7415_firmware",
    "poweredge_r7425_firmware"
   ]
  },
  "CVE-2025-47290": {
   "cvss": 7.6,
   "cvss_version": "4.0",
   "epss": 0.00506,
   "epss_date": "2026-10-28",
   "published": "2025-05-20T19:15:50.157",
   "modified": "2026-06-17T09:27:40.640",
   "severity": "high",
   "summary": "containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0.  Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "eq": "2.1.0"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2025-47291": {
   "cvss": 4.6,
   "cvss_version": "4.0",
   "epss": 0.0029,
   "epss_date": "2026-10-28",
   "fixed_in": "2.0.5",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2025-47291",
   "published": "2025-05-21T18:15:52.853",
   "modified": "2026-06-17T09:27:40.750",
   "severity": "medium",
   "summary": "containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node. This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should update to these versions to resolve the issue. As a workaround, disable usernamespaced pods in Kubernetes temporarily.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionStartIncluding": "2.0.1",
     "versionEndExcluding": "2.0.5"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2025-52565": {
   "cvss": 8.4,
   "cvss_version": "4.0",
   "epss": 0.00811,
   "epss_date": "2026-10-28",
   "published": "2025-11-06T20:15:49.240",
   "modified": "2026-06-17T09:36:41.353",
   "severity": "high",
   "summary": "runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionStartIncluding": "1.0.1",
     "versionEndExcluding": "1.2.8"
    },
    {
     "product": "runc",
     "versionStartIncluding": "1.3.0",
     "versionEndExcluding": "1.3.3"
    },
    {
     "product": "runc",
     "eq": "1.0.0"
    },
    {
     "product": "runc",
     "eq": "1.4.0"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2025-52881": {
   "cvss": 7.3,
   "cvss_version": "4.0",
   "epss": 0.00801,
   "epss_date": "2026-10-28",
   "published": "2025-11-06T21:15:42.817",
   "modified": "2026-10-07T21:10:00.200",
   "severity": "high",
   "summary": "runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndExcluding": "1.2.8"
    },
    {
     "product": "runc",
     "versionStartIncluding": "1.3.0",
     "versionEndExcluding": "1.3.3"
    },
    {
     "product": "runc",
     "eq": "1.4.0"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2025-6198": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.00312,
   "epss_date": "2026-10-28",
   "published": "2025-09-19T02:15:44.133",
   "modified": "2026-06-17T10:01:22.143",
   "severity": "high",
   "summary": "There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image.",
   "vendors": [
    "supermicro"
   ]
  },
  "CVE-2025-64329": {
   "cvss": 6.9,
   "cvss_version": "4.0",
   "epss": 0.00171,
   "epss_date": "2026-10-28",
   "published": "2025-11-07T05:16:08.017",
   "modified": "2026-06-17T09:54:13.263",
   "severity": "medium",
   "summary": "containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionEndExcluding": "1.7.29"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.0.0",
     "versionEndExcluding": "2.0.7"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.1.0",
     "versionEndExcluding": "2.1.5"
    },
    {
     "product": "containerd",
     "eq": "2.2.0"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2025-7704": {
   "cvss": 5.4,
   "cvss_version": "3.1",
   "epss": 0.00249,
   "epss_date": "2026-10-28",
   "published": "2025-11-13T10:15:54.823",
   "modified": "2026-10-07T21:10:00.200",
   "severity": "medium",
   "summary": "Supermicro BMC  Insyde SMASH shell program has a stacked-based overflow vulnerability",
   "vendors": [
    "supermicro"
   ]
  },
  "CVE-2025-7937": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.00312,
   "epss_date": "2026-10-28",
   "published": "2025-09-19T03:15:50.033",
   "modified": "2026-06-17T10:06:00.380",
   "severity": "high",
   "summary": "There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW . An attacker can update the system firmware with a specially crafted image.",
   "vendors": [
    "supermicro"
   ]
  },
  "CVE-2025-8076": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.00359,
   "epss_date": "2026-10-28",
   "published": "2025-11-18T08:15:51.590",
   "modified": "2026-10-18T20:10:00.110",
   "severity": "high",
   "summary": "There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability.",
   "vendors": [
    "supermicro"
   ]
  },
  "CVE-2025-8404": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.0034,
   "epss_date": "2026-10-28",
   "published": "2025-11-18T08:15:51.783",
   "modified": "2026-10-18T20:10:00.110",
   "severity": "medium",
   "summary": "Stack buffer overflow vulnerability exists in the Supermicro BMC Shared library. An authenticated attacker with access to the BMC exploit stack buffer via a crafted  header and achieve arbitrary code execution of the BMC’s firmware operating system.",
   "vendors": [
    "supermicro"
   ]
  },
  "CVE-2025-8727": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.00359,
   "epss_date": "2026-10-28",
   "published": "2025-11-18T08:15:51.980",
   "modified": "2026-10-18T20:10:00.110",
   "severity": "high",
   "summary": "There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability.",
   "vendors": [
    "supermicro"
   ]
  },
  "CVE-2026-16140": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00392,
   "epss_date": "2026-10-28",
   "published": "2026-09-15T14:16:50.290",
   "modified": "2026-09-18T19:30:42.730",
   "severity": "high",
   "summary": "OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C. This issue effectively allows for privilege escalation without re-authentication.",
   "vendors": [
    "megarac"
   ]
  },
  "CVE-2026-16141": {
   "cvss": 8.1,
   "cvss_version": "3.1",
   "epss": 0.00537,
   "epss_date": "2026-10-28",
   "published": "2026-09-15T14:16:50.430",
   "modified": "2026-09-18T19:30:42.730",
   "severity": "high",
   "summary": "OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte 'userKey' initialized from the string '0penBmc' and an often-predictable 'bmcRandomNum'. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.",
   "vendors": [
    "megarac"
   ]
  },
  "CVE-2026-18849": {
   "cvss": 6.8,
   "cvss_version": "3.1",
   "epss": 0.00367,
   "epss_date": "2026-10-28",
   "published": "2026-08-19T21:16:54.663",
   "modified": "2026-09-02T18:58:30.013",
   "severity": "medium",
   "summary": "IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ibm:openbmc",
    "ibm:power_system_e1050_\\(9043-mrx\\)",
    "ibm:power_system_e1050_\\(9043-mrx\\)_firmware",
    "ibm:power_system_l1022_\\(9786-22h\\)",
    "ibm:power_system_l1022_\\(9786-22h\\)_firmware",
    "ibm:power_system_l1024_\\(9786-42h\\)",
    "ibm:power_system_l1024_\\(9786-42h\\)_firmware",
    "ibm:power_system_s1012_\\(9028-21b\\)",
    "ibm:power_system_s1012_\\(9028-21b\\)_firmware",
    "ibm:power_system_s1014_\\(9105-41b\\)",
    "ibm:power_system_s1014_\\(9105-41b\\)_firmware",
    "ibm:power_system_s1022_\\(9105-22a\\)_firmware"
   ]
  },
  "CVE-2026-18857": {
   "cvss": 3.4,
   "cvss_version": "3.1",
   "epss": 0.00107,
   "epss_date": "2026-10-28",
   "published": "2026-09-24T14:17:12.680",
   "modified": "2026-09-30T16:48:23.090",
   "severity": "low",
   "summary": "IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ibm:power_system_l1122_\\(9856-22h\\)",
    "ibm:power_system_l1122_\\(9856-22h\\)_firmware",
    "ibm:power_system_l1124_\\(9856-42h\\)",
    "ibm:power_system_l1124_\\(9856-42h\\)_firmware",
    "ibm:power_system_s1114_\\(9824-41b\\)",
    "ibm:power_system_s1114_\\(9824-41b\\)_firmware",
    "ibm:power_system_s1122_\\(9824-22a\\)",
    "ibm:power_system_s1122_\\(9824-22a\\)_firmware",
    "ibm:power_system_s1122s_\\(9824-22b\\)",
    "ibm:power_system_s1122s_\\(9824-22b\\)_firmware",
    "ibm:power_system_s1124_\\(9824-42a\\)",
    "ibm:power_system_s1124_\\(9824-42a\\)_firmware"
   ]
  },
  "CVE-2026-23855": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.01398,
   "epss_date": "2026-10-28",
   "published": "2026-09-09T17:17:19.837",
   "modified": "2026-09-11T04:17:40.123",
   "severity": "high",
   "summary": "Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command injection.",
   "vendors": [
    "idrac"
   ]
  },
  "CVE-2026-24182": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.00125,
   "epss_date": "2026-10-28",
   "published": "2026-05-26T18:16:37.557",
   "modified": "2026-07-24T11:10:00.170",
   "severity": "medium",
   "summary": "NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could leak held driver locks. A successful exploit of this vulnerability might lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "539.72"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "582.53"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.36"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2026-24187": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00188,
   "epss_date": "2026-10-28",
   "published": "2026-05-26T18:16:37.710",
   "modified": "2026-07-20T20:10:00.110",
   "severity": "high",
   "summary": "NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "539.72"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "582.53"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.36"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2026-24190": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00221,
   "epss_date": "2026-10-28",
   "published": "2026-05-26T18:16:37.847",
   "modified": "2026-07-24T11:10:00.170",
   "severity": "high",
   "summary": "NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause improper access to GPU resources. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "539.72"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "582.53"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.36"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2026-24191": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00138,
   "epss_date": "2026-10-28",
   "published": "2026-05-26T18:16:37.980",
   "modified": "2026-07-24T11:10:00.170",
   "severity": "high",
   "summary": "NVIDIA Display Driver for Windows contains a vulnerability where an attacker could cause a time-of-check time-of-use issue. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "539.72"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "582.53"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.36"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2026-24192": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00206,
   "epss_date": "2026-10-28",
   "published": "2026-05-26T18:16:38.107",
   "modified": "2026-07-24T11:10:00.170",
   "severity": "high",
   "summary": "NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause an incorrect conversion between numeric types, leading to a heap buffer overflow. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "539.72"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "582.53"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.36"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2026-24193": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00197,
   "epss_date": "2026-10-28",
   "published": "2026-05-26T18:16:38.237",
   "modified": "2026-07-24T11:10:00.170",
   "severity": "high",
   "summary": "NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "539.72"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "582.53"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.36"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2026-24194": {
   "cvss": 7.8,
   "cvss_version": "3.1",
   "epss": 0.00152,
   "epss_date": "2026-10-28",
   "published": "2026-05-26T18:16:38.367",
   "modified": "2026-07-24T11:10:00.170",
   "severity": "high",
   "summary": "NVIDIA Display Driver for Linux contains a vulnerability in a kernel mode layer handler, where a user could cause improper permission handling. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "539.72"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "582.53"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.36"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2026-24195": {
   "cvss": 5.5,
   "cvss_version": "3.1",
   "epss": 0.00162,
   "epss_date": "2026-10-28",
   "published": "2026-05-26T18:16:38.490",
   "modified": "2026-07-24T11:10:00.170",
   "severity": "medium",
   "summary": "NVIDIA Display Driver for Linux contains a vulnerability in UVM, where a user could cause improper input validation. A successful exploit of this vulnerability might lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "539.72"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "582.53"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.36"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2026-24196": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.00166,
   "epss_date": "2026-10-28",
   "published": "2026-05-26T18:16:38.607",
   "modified": "2026-07-24T11:10:00.170",
   "severity": "high",
   "summary": "NVIDIA Display Driver for Linux contains a vulnerability where a user could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to denial of service and information disclosure.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "539.72"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "582.53"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.36"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2026-24197": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.0016,
   "epss_date": "2026-10-28",
   "published": "2026-05-26T18:16:38.730",
   "modified": "2026-07-24T11:10:00.170",
   "severity": "medium",
   "summary": "NVIDIA Display Driver for Linux contains a vulnerability in the Multi-Instance GPU (MIG) partition management, where an insecure default initialization of memory subsystem routing resources could lead to data corruption or a hang during partition reconfiguration. A successful exploit of this vulnerability might lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "539.72"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "582.53"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.36"
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05"
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2026-24199": {
   "cvss": 4.7,
   "cvss_version": "3.1",
   "epss": 0.00092,
   "epss_date": "2026-10-28",
   "published": "2026-05-26T18:16:38.987",
   "modified": "2026-07-24T11:10:00.170",
   "severity": "medium",
   "summary": "NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where a user could cause a race condition by reordering compiler or processor memory instructions. A successful exploit of this vulnerability might lead to denial of service.",
   "vendors": [
    "nvidia-gpu-driver"
   ],
   "ranges": [
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05",
     "platforms": [
      "gpu:geforce"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05",
     "platforms": [
      "gpu:nvs",
      "gpu:quadro",
      "gpu:rtx"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "535",
     "versionEndExcluding": "535.309.01",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "580",
     "versionEndExcluding": "580.159.03",
     "platforms": [
      "gpu:tesla"
     ]
    },
    {
     "product": "gpu_display_driver",
     "versionStartIncluding": "595",
     "versionEndExcluding": "595.71.05",
     "platforms": [
      "gpu:tesla"
     ]
    }
   ],
   "products": [
    "gpu_display_driver"
   ]
  },
  "CVE-2026-28262": {
   "cvss": 6,
   "cvss_version": "3.1",
   "epss": 0.00095,
   "epss_date": "2026-10-28",
   "published": "2026-06-09T09:16:29.037",
   "modified": "2026-07-23T08:10:00.137",
   "severity": "medium",
   "summary": "Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.",
   "vendors": [
    "idrac"
   ]
  },
  "CVE-2026-35155": {
   "cvss": 7.1,
   "cvss_version": "3.1",
   "epss": 0.0022,
   "epss_date": "2026-10-28",
   "fixed_in": "1.30.10.50",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2026-35155",
   "published": "2026-04-29T05:16:04.523",
   "modified": "2026-10-26T20:10:00.160",
   "severity": "high",
   "summary": "Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerability exists that could allow an authenticated low‑privileged attacker to gain elevated access.",
   "vendors": [
    "idrac"
   ],
   "ranges": [
    {
     "product": "idrac10_firmware",
     "versionEndExcluding": "1.30.10.50"
    }
   ],
   "products": [
    "dell:idrac10",
    "dell:idrac10_firmware"
   ]
  },
  "CVE-2026-3820": {
   "cvss": 7.2,
   "cvss_version": "3.1",
   "epss": 0.0037,
   "epss_date": "2026-10-28",
   "published": "2026-06-04T09:16:28.980",
   "modified": "2026-07-22T20:10:00.127",
   "severity": "high",
   "summary": "There is a vulnerability in the Supermicro BMC  SMTP service at Supermicro AS-2115HS-TNR. \nAn attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation.\n\nPotential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.",
   "vendors": [
    "supermicro"
   ]
  },
  "CVE-2026-3821": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00638,
   "epss_date": "2026-10-28",
   "published": "2026-07-22T07:16:35.413",
   "modified": "2026-10-24T17:10:00.220",
   "severity": "high",
   "summary": "Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI.\nAn authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.",
   "vendors": [
    "supermicro"
   ]
  },
  "CVE-2026-41579": {
   "cvss": 3.3,
   "cvss_version": "3.1",
   "epss": 0.00186,
   "epss_date": "2026-10-28",
   "published": "2026-07-01T02:17:00.193",
   "modified": "2026-10-25T17:10:00.197",
   "severity": "low",
   "summary": "runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.",
   "vendors": [
    "linuxfoundation-runc"
   ],
   "ranges": [
    {
     "product": "runc",
     "versionEndExcluding": "1.3.6"
    },
    {
     "product": "runc",
     "versionStartIncluding": "1.4.0",
     "versionEndExcluding": "1.4.3"
    },
    {
     "product": "runc",
     "eq": "1.5.0"
    }
   ],
   "products": [
    "runc"
   ]
  },
  "CVE-2026-42997": {
   "cvss": 7.7,
   "cvss_version": "3.1",
   "epss": 0.00433,
   "epss_date": "2026-10-28",
   "published": "2026-05-05T19:16:22.817",
   "modified": "2026-07-24T20:10:00.147",
   "severity": "high",
   "summary": "An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.",
   "vendors": [
    "idrac"
   ],
   "products": [
    "openstack:ironic"
   ]
  },
  "CVE-2026-46680": {
   "cvss": 7.3,
   "cvss_version": "4.0",
   "epss": 0.00163,
   "epss_date": "2026-10-28",
   "published": "2026-07-01T18:16:32.853",
   "modified": "2026-07-03T04:17:53.813",
   "severity": "high",
   "summary": "containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionStartIncluding": "1.7.27",
     "versionEndExcluding": "1.7.32"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.0.4",
     "versionEndExcluding": "2.0.9"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.1.0",
     "versionEndExcluding": "2.2.4"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.3.0",
     "versionEndExcluding": "2.3.1"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2026-47262": {
   "cvss": 5.3,
   "cvss_version": "4.0",
   "epss": 0.00265,
   "epss_date": "2026-10-28",
   "published": "2026-07-01T19:16:52.097",
   "modified": "2026-07-02T19:40:45.490",
   "severity": "medium",
   "summary": "containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionStartIncluding": "1.7.0",
     "versionEndExcluding": "1.7.33"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.0.0",
     "versionEndExcluding": "2.0.10"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.1.0",
     "versionEndExcluding": "2.1.9"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.2.0",
     "versionEndExcluding": "2.2.5"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.3.0",
     "versionEndExcluding": "2.3.2"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2026-50195": {
   "cvss": 5.6,
   "cvss_version": "4.0",
   "epss": 0.00303,
   "epss_date": "2026-10-28",
   "published": "2026-07-01T19:16:53.333",
   "modified": "2026-07-02T19:43:59.417",
   "severity": "medium",
   "summary": "containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionStartIncluding": "2.1.0",
     "versionEndExcluding": "2.1.9"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.2.0",
     "versionEndExcluding": "2.2.5"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.3.0",
     "versionEndExcluding": "2.3.2"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2026-53488": {
   "cvss": 9.4,
   "cvss_version": "4.0",
   "epss": 0.00176,
   "epss_date": "2026-10-28",
   "published": "2026-07-01T02:17:00.467",
   "modified": "2026-07-03T04:17:55.770",
   "severity": "critical",
   "summary": "containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionStartIncluding": "1.7.0",
     "versionEndExcluding": "1.7.33"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.0.0",
     "versionEndExcluding": "2.0.10"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.1.0",
     "versionEndExcluding": "2.1.9"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.2.0",
     "versionEndExcluding": "2.2.5"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.3.0",
     "versionEndExcluding": "2.3.2"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2026-53489": {
   "cvss": 8.2,
   "cvss_version": "4.0",
   "epss": 0.00174,
   "epss_date": "2026-10-28",
   "published": "2026-07-01T19:16:54.383",
   "modified": "2026-07-02T19:33:12.850",
   "severity": "high",
   "summary": "containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionStartIncluding": "2.1.0",
     "versionEndExcluding": "2.1.9"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.2.0",
     "versionEndExcluding": "2.2.5"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.3.0",
     "versionEndExcluding": "2.3.2"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2026-53492": {
   "cvss": 8.4,
   "cvss_version": "4.0",
   "epss": 0.00353,
   "epss_date": "2026-10-28",
   "published": "2026-07-01T19:16:54.510",
   "modified": "2026-07-02T19:33:00.930",
   "severity": "high",
   "summary": "containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.",
   "vendors": [
    "linuxfoundation-containerd"
   ],
   "ranges": [
    {
     "product": "containerd",
     "versionStartIncluding": "2.1.0",
     "versionEndExcluding": "2.1.9"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.2.0",
     "versionEndExcluding": "2.2.5"
    },
    {
     "product": "containerd",
     "versionStartIncluding": "2.3.0",
     "versionEndExcluding": "2.3.2"
    }
   ],
   "products": [
    "containerd"
   ]
  },
  "CVE-2026-63457": {
   "cvss": 6.5,
   "cvss_version": "3.1",
   "epss": 0.00269,
   "epss_date": "2026-10-28",
   "fixed_in": "1.78",
   "fix_source": "https://nvd.nist.gov/vuln/detail/CVE-2026-63457",
   "published": "2026-08-05T19:17:31.703",
   "modified": "2026-10-24T16:10:00.153",
   "severity": "medium",
   "summary": "A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78.",
   "vendors": [
    "ilo"
   ],
   "ranges": [
    {
     "product": "integrated_lights-out_6_firmware",
     "versionEndExcluding": "1.78"
    }
   ],
   "products": [
    "hpe:integrated_lights-out_6",
    "hpe:integrated_lights-out_6_firmware"
   ]
  },
  "CVE-2026-70412": {
   "cvss": 3.5,
   "cvss_version": "3.1",
   "epss": 0.00265,
   "epss_date": "2026-10-28",
   "published": "2026-08-17T13:16:52.737",
   "modified": "2026-08-18T14:57:42.287",
   "severity": "low",
   "summary": "Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.",
   "vendors": [
    "idrac"
   ]
  },
  "CVE-2026-7254": {
   "cvss": 5.3,
   "cvss_version": "3.1",
   "epss": 0.00238,
   "epss_date": "2026-10-28",
   "published": "2026-05-27T14:17:35.173",
   "modified": "2026-10-26T11:10:00.157",
   "severity": "medium",
   "summary": "IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network users.",
   "vendors": [
    "megarac"
   ],
   "ranges": [
    {
     "product": "openbmc",
     "versionStartIncluding": "1110.00",
     "versionEndIncluding": "1110.11"
    }
   ],
   "products": [
    "ibm:openbmc"
   ]
  },
  "CVE-2026-74694": {
   "epss": 0.00177,
   "epss_date": "2026-10-28",
   "published": "2026-08-22T16:16:43.920",
   "modified": "2026-10-14T13:10:00.187",
   "severity": "unknown",
   "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length\n\nncsi_send_cmd_nl() takes the number of bytes to copy from the\nattacker-controlled ncsi_pkt_hdr.length field of the in-band packet\nheader, while the source buffer is the NCSI_ATTR_DATA netlink\nattribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr).\nThe two length sources are never cross-checked: only\nnla_len() \u003e= sizeof(struct ncsi_pkt_hdr) is enforced.\n\nWith hdr-\u003elength set larger than the attribute payload (up to 65535\nagainst at most 2032 readabl...",
   "vendors": [
    "megarac"
   ]
  },
  "CVE-2026-7868": {
   "cvss": 8.8,
   "cvss_version": "3.1",
   "epss": 0.00367,
   "epss_date": "2026-10-28",
   "published": "2026-07-28T16:20:21.813",
   "modified": "2026-10-24T13:10:00.147",
   "severity": "high",
   "summary": "IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ibm:power_system_l1122_\\(9856-22h\\)",
    "ibm:power_system_l1122_\\(9856-22h\\)_firmware",
    "ibm:power_system_l1124_\\(9856-42h\\)",
    "ibm:power_system_l1124_\\(9856-42h\\)_firmware",
    "ibm:power_system_s1114_\\(9824-41b\\)",
    "ibm:power_system_s1114_\\(9824-41b\\)_firmware",
    "ibm:power_system_s1122_\\(9824-22a\\)",
    "ibm:power_system_s1122_\\(9824-22a\\)_firmware",
    "ibm:power_system_s1122s_\\(9824-22b\\)",
    "ibm:power_system_s1122s_\\(9824-22b\\)_firmware",
    "ibm:power_system_s1124_\\(9824-42a\\)",
    "ibm:power_system_s1124_\\(9824-42a\\)_firmware"
   ]
  },
  "CVE-2026-79820": {
   "cvss": 9,
   "cvss_version": "3.1",
   "epss": 0.00298,
   "epss_date": "2026-10-28",
   "published": "2026-10-05T15:17:22.290",
   "modified": "2026-10-06T15:15:48.310",
   "severity": "critical",
   "summary": "A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.",
   "vendors": [
    "ilo"
   ]
  },
  "CVE-2026-79940": {
   "cvss": 5.9,
   "cvss_version": "3.1",
   "epss": 0.00293,
   "epss_date": "2026-10-28",
   "published": "2026-08-26T19:17:19.213",
   "modified": "2026-08-28T15:29:44.967",
   "severity": "medium",
   "summary": "Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to gaining access to unauthorized data.",
   "vendors": [
    "idrac"
   ]
  },
  "CVE-2026-8058": {
   "cvss": 4.9,
   "cvss_version": "3.1",
   "epss": 0.00358,
   "epss_date": "2026-10-28",
   "published": "2026-07-28T16:20:21.987",
   "modified": "2026-10-24T13:10:00.147",
   "severity": "medium",
   "summary": "IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.",
   "vendors": [
    "megarac"
   ],
   "products": [
    "ibm:power_system_l1122_\\(9856-22h\\)",
    "ibm:power_system_l1122_\\(9856-22h\\)_firmware",
    "ibm:power_system_l1124_\\(9856-42h\\)",
    "ibm:power_system_l1124_\\(9856-42h\\)_firmware",
    "ibm:power_system_s1114_\\(9824-41b\\)",
    "ibm:power_system_s1114_\\(9824-41b\\)_firmware",
    "ibm:power_system_s1122_\\(9824-22a\\)",
    "ibm:power_system_s1122_\\(9824-22a\\)_firmware",
    "ibm:power_system_s1122s_\\(9824-22b\\)",
    "ibm:power_system_s1122s_\\(9824-22b\\)_firmware",
    "ibm:power_system_s1124_\\(9824-42a\\)",
    "ibm:power_system_s1124_\\(9824-42a\\)_firmware"
   ]
  }
 }
}