{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:27.885Z","products":["linux"],"actNowTotal":3,"results":[{"query":"linux","matched":5,"actNow":3,"events":[{"id":"kev-2026-10-28-linux-kernel","url":"https://securitythreatpulse.com/events/kev-2026-10-28-linux-kernel","title":"Linux Kernel: security flaw used in attacks","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 171 days old, so many systems are likely still unpatched. Ready-made attack tools are public.","tier":"today","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","Ready-made attack tools are public.","The confirmation is 14 days old."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-46300"],"vendor":"Linux","product":"Kernel","affectedProducts":[{"kind":"direct","slug":"linux/kernel","vendor":"Linux","product":"Kernel","evidence":["kev"],"vendorKey":"linux","productKey":"kernel"},{"kind":"direct","slug":"linux/linux","vendor":"Linux","product":"Linux","evidence":["cpe"],"vendorKey":"linux","productKey":"linux"}],"category":{"id":"endpoint","label":"Computers, phones and browsers","why":"It runs on staff computers, phones or browsers.","doThis":"Install the latest updates on every device, and turn on automatic updates."},"summary":"Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place.","cvss":7.8,"epss":0.1613,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-10-28","kevDueDate":"2026-10-31","firstSeenAt":"2026-10-28T00:00:00.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-05T07:02:33.622Z"},{"id":"kev-2026-09-18-linux-kernel","url":"https://securitythreatpulse.com/events/kev-2026-09-18-linux-kernel","title":"Linux Kernel: 3 memory flaws used in attacks","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 138 days old, so many systems are likely still unpatched. The severity score is critical (9.8).","tier":"now","rankScore":4,"rankWhy":["Exploitation is confirmed by an authoritative source.","5 products are affected."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2025-39682","CVE-2025-39964","CVE-2026-53266"],"vendor":"Linux","product":"Kernel","affectedProducts":[{"kind":"direct","slug":"linux/kernel","vendor":"Linux","product":"Kernel","evidence":["kev"],"vendorKey":"linux","productKey":"kernel"},{"kind":"direct","slug":"linux/linux","vendor":"Linux","product":"Linux","evidence":["cpe"],"vendorKey":"linux","productKey":"linux"},{"kind":"direct","slug":"linux/linuxkernel","vendor":"Linux","product":"Linux kernel","evidence":["cpe"],"vendorKey":"linux","productKey":"linuxkernel"},{"kind":"direct","slug":"siemens/simatics71500cpu15184pndpmfp","vendor":"Siemens","product":"Simatic S7-1500 CPU 1518-4 Pn/dp Mfp Firmware","evidence":["cpe"],"vendorKey":"siemens","productKey":"simatics71500cpu15184pndpmfp"},{"kind":"direct","slug":"siemens/simatics71500cpu1518f4pndpmfp","vendor":"Siemens","product":"Simatic S7-1500 CPU 1518f-4 Pn/dp Mfp Firmware","evidence":["cpe"],"vendorKey":"siemens","productKey":"simatics71500cpu1518f4pndpmfp"}],"category":{"id":"endpoint","label":"Computers, phones and browsers","why":"It runs on staff computers, phones or browsers.","doThis":"Install the latest updates on every device, and turn on automatic updates."},"summary":"Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions.","cvss":9.8,"epss":0.03312,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-09-18","kevDueDate":"2026-09-21","firstSeenAt":"2026-09-18T00:00:00.000Z","updatedAt":"2026-11-10T13:30:21.882Z","newestEvidenceAt":"2026-11-10T10:10:01.886Z"},{"id":"kev-2026-08-26-linux-kernel","url":"https://securitythreatpulse.com/events/kev-2026-08-26-linux-kernel","title":"Linux Kernel: 2 flaws used in attacks; attackers can knock it offline","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 114 days old, so current versions are being attacked. Ready-made attack tools are public.","tier":null,"rankScore":null,"rankWhy":null,"rulesVersion":"v2","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2022-0995","CVE-2026-53362"],"vendor":"Linux","product":"Kernel","affectedProducts":[{"vendorKey":"linux","productKey":"kernel","vendor":"Linux","product":"Kernel","slug":"linux/kernel","kind":"direct","evidence":["kev"]}],"category":{"id":"endpoint","label":"Computers, phones and browsers","why":"It runs on staff computers, phones or browsers.","doThis":"Install the latest updates on every device, and turn on automatic updates."},"summary":"Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.","cvss":7.8,"epss":0.08859,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-08-26","kevDueDate":"2026-08-29","firstSeenAt":"2026-08-26T00:00:00.000Z","updatedAt":"2026-10-26T12:07:40.282Z","newestEvidenceAt":"2026-08-27T00:00:00.000Z"},{"id":"early-cve-2022-2588","url":"https://securitythreatpulse.com/events/early-cve-2022-2588","title":"Linux: a memory flaw attackers can abuse","verdict":"watch","verdictReason":"Attacks are reported but not confirmed by an authoritative source, and the vulnerability is more than 90 days old.","tier":null,"rankScore":3,"rankWhy":["Exploitation is reported.","The first report is 7 days old."],"rulesVersion":"v3","ladder":{"talk":"none","damage":"none","attempts":"reported","exposure":"none","exploited":"reported"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2022-2588"],"vendor":"The Linux Kernel Organization","product":"linux","affectedProducts":[{"kind":"direct","slug":"linux/linux","vendor":"Linux","product":"Linux","evidence":["cna","cpe"],"vendorKey":"linux","productKey":"linux"}],"category":{"id":"endpoint","label":"Computers, phones and browsers","why":"It runs on staff computers, phones or browsers.","doThis":"Install the latest updates on every device, and turn on automatic updates."},"summary":"It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.","cvss":5.3,"epss":0.05871,"exploitMaturity":"poc","kevListed":false,"kevDateAdded":null,"kevDueDate":null,"firstSeenAt":"2026-11-04T19:57:18.462Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-04T19:57:18.462Z"},{"id":"early-cve-2026-98432","url":"https://securitythreatpulse.com/events/early-cve-2026-98432","title":"Linux: a memory flaw attackers can abuse","verdict":"watch","verdictReason":"One source reports attacks and the vulnerability is 26 days old. In our backtest a single early report was confirmed within 30 days about one time in twenty, so we wait for a second report or for attack attempts to be seen.","tier":null,"rankScore":2,"rankWhy":["Exploitation is reported.","The first report is 9 days old."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"reported","exposure":"none","exploited":"reported"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-98432"],"vendor":"Linux","product":"Linux","affectedProducts":[{"kind":"direct","slug":"linux/linux","vendor":"Linux","product":"Linux","evidence":["cna","cpe"],"vendorKey":"linux","productKey":"linux"}],"category":{"id":"other","label":"Other software","why":"Software we have not put in a category yet. Your IT team or provider will know whether you run it.","doThis":"Find out if you use it. If you do, apply the vendor's fix."},"summary":"In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req().","cvss":9.8,"epss":0.0076,"exploitMaturity":"poc","kevListed":false,"kevDateAdded":null,"kevDueDate":null,"firstSeenAt":"2026-11-02T04:04:19.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-11T01:31:05.067Z"}]}]}