Topic
CVSS (Common Vulnerability Scoring System) is an industry-standard framework rating software vulnerabilities from 0 to 10 by severity and exploitability.
D-Link says crafted NTPServer input on the R95 reaches an OS command call in /bin/ssi, and the published vector requires administrative privileges. Proof-of-concept code is public. The investigation is open.
Reality
Delinea scored CVE-2026-15640 at 9.5 on CVSS v4 for on-prem Secret Server 10.5.0 through 12.1.3, and 12.2.7 is the only listed build that also clears the padding oracle and the FIDO2 registration bug.
Reality
Arista scores CVE-2026-7473 at 5.8 and says it is already being exploited. With every EOS train on the affected list, the thing that decides your exposure is whether a given device terminates a tunnel at all.
Reality
CVE-2026-16812 scores 10.0 on both CVSS scales because the scope metrics say a compromise of the orchestrator host does not stay inside the orchestrator, and on-prem operators are the ones who have to schedule the fix.
Reality
ServiceNow fixed its own hosted fleet on August 27 and handed the same update to partners and self-hosted customers, whose unauthenticated GraphQL and SQL exposure stays open until someone on staff installs it.
Reality