CVE Tools
Track your stack

Hardware & Firmware

15,498 CVEs tracked since 1999. In the last 12 months, 2,797, +34% on the 12 before.

Hardware & Firmware by subsector, Oct 2026 so far

Oct 2026 so far: 350 CVEs across 6 subsectors. Area is each subsector's share; inside are the products it counted most. Point at one to read it.
  • Not yet sub-classified205The tagger has not placed these yet
  • CPUs & GPUs6719% · 7 vendors
  • Network adapters3911% · 5 vendors
  • BIOS & UEFI247% · 5 vendors

Also: Storage & NAS 11, Printers & peripherals 4.

Month by month

Every monthly snapshot of Hardware & Firmware. A column is the CVEs published that month.

Oct 2021 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Hardware & Firmware CVEs per month
MonthCVEs
2021-1071
2021-11154
2021-1227
2022-01166
2022-02165
2022-0360
2022-04113
2022-05176
2022-06147
2022-0784
2022-08143
2022-09137
2022-10109
2022-11190
2022-12162
2023-01258
2023-02319
2023-030
2023-04180
2023-05327
2023-06170
2023-07195
2023-08264
2023-09192
2023-10152
2023-11312
2023-12219
2024-01208
2024-02248
2024-03148
2024-04150
2024-05174
2024-06119
2024-07113
2024-08182
2024-09144
2024-10118
2024-11243
2024-12143
2025-01127
2025-02211
2025-03160
2025-04123
2025-05167
2025-06212
2025-07166
2025-08240
2025-09173
2025-10187
2025-11205
2025-12194
2026-01235
2026-02255
2026-03174
2026-0496
2026-05215
2026-06186
2026-07155
2026-08371
2026-09524
2026-10350

Vendors

Who shipped the most Hardware & Firmware CVEs in Oct 2026 so far, with their rank across all vendors.

  1. HPE109#10
  2. Qnap35#44
  3. Mediatek, Inc.31#49
  4. Nvidia20#74
  5. Qualcomm15#102
  6. Asus13#113

Weaknesses

The weakness classes behind Hardware & Firmware CVEs in Oct 2026 so far.

  1. CWE-22 Path Traversal16
  2. CWE-416 Use After Free12
  3. CWE-306 Missing Auth for Critical Function10
  4. CWE-89 SQL Injection10
  5. CWE-79 XSS7
  6. CWE-862 Missing Authorization6

Latest CVEs

The 15 most recently published vulnerabilities in Hardware & Firmware.

  1. CVE-2026-74915GPU DDK - OOB write in UntwiddlePOTSquare64bpp—
  2. CVE-2026-74912GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB—
  3. CVE-2026-19199GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet—
  4. CVE-2026-18629GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation—
  5. CVE-2026-65587GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change—
  6. CVE-2026-65586GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM—
  7. CVE-2026-65584GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo—
  8. CVE-2026-15466GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()—
  9. CVE-2025-62841Hard-coded Cryptographic Key #2—
  10. CVE-2025-62839Hard-coded Cryptographic Key #1—
  11. CVE-2026-22063CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products—
  12. CVE-2026-47486NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, data tampering...7.8
  13. CVE-2026-65145NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampe...10.0
  14. CVE-2026-65151NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and ...8.4
  15. CVE-2026-65120NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.7.1

The record

Busiest month
Sep 2026, 524 CVEs
Oct 2026 so far
350 CVEs from 38 vendors
Deployment
Embedded, 70%
Monthly snapshots
251 since 1999
All 15 sectors on one map

Is your business exposed to threats like these?

Discuss a security assessment of your internet-facing systems. Scope, price and timing agreed before testing.

Request an assessment