Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-20526 | 7.5 high | 0.00% | mediatek, mt2716_firmware, mt2735_firmware, mt2737_firmware | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01898195; Issue ID: MSV-8906. | 8 Oct |
| CVE-2026-20519 | 7.5 high | 0.00% | mediatek, mt6833_firmware, mt6835_firmware, mt6853_firmware | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778993; Issue ID: MSV-8898. | 8 Oct |
| CVE-2026-20520 | 7.5 high | 0.00% | mediatek, mt2716_firmware, mt2735_firmware, mt2737_firmware | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778988; Issue ID: MSV-8897. | 8 Oct |
| CVE-2026-20449 | 6.5 medium | 0.00% | mediatek, mt6763_firmware, mt6765_firmware, mt6767_firmware | In Modem, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01760138; Issue ID: MSV-6148. | Mon 26 Oct |
| CVE-2026-20450 | 6.5 medium | 0.00% | mediatek, mt2735_firmware, mt2737_firmware, mt6833_firmware | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01753620; Issue ID: MSV-6100. | Mon 26 Oct |
| CVE-2026-20543 | 5.5 medium | 0.00% | mediatek, mt2716_firmware, mt2735_firmware, mt2737_firmware | In Modem, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01645293; Issue ID: MSV-6761. | 8 Oct |
| CVE-2026-20541 | 5.3 medium | 0.00% | mediatek, mt6985_firmware, mt6986_firmware, mt6988_firmware | In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8911. | 9 Oct |
| CVE-2026-20540 | 5.3 medium | 0.00% | mediatek, mt2716_firmware, mt2735_firmware, mt2737_firmware | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8912. | 9 Oct |
| CVE-2026-20539 | 5.3 medium | 0.00% | mediatek, mt2716_firmware, mt2735_firmware, mt2737_firmware | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8913. | 9 Oct |
| CVE-2026-20538 | 5.3 medium | 0.00% | mediatek, mt2716_firmware, mt2735_firmware, mt2737_firmware | In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8914. | 9 Oct |
| CVE-2026-20534 | 5.3 medium | 0.00% | mediatek, mt2716_firmware, mt2735_firmware, mt2737_firmware | In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01797547; Issue ID: MSV-9155. | 9 Oct |
| CVE-2026-20527 | 5.3 medium | 0.00% | mediatek, mt2716_firmware, mt2735_firmware, mt2737_firmware | In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01864925 / MOLY01210562; Issue ID: MSV-8303. | 8 Oct |
12 of 12
Download these 12 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.