How many CVEs does Broadcom have?

Broadcom has 702 published CVE records since 1999, including 116 in the last two years.

How many Broadcom CVEs are in CISA KEV?

Yes — 6 of Broadcom's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Broadcom products have the most CVEs?

The Broadcom products with the most published CVEs are fabric operating system, Brocade SANnav, tcpreplay, brightstor arcserve backup, brocade fabric operating system firmware.

What are the most common weakness types in Broadcom CVEs?

Broadcom's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-532 (Insertion of Sensitive Information into Log File), CWE-312 (Cleartext Storage of Sensitive Information), CWE-476 (NULL Pointer Dereference).

Are there public exploits for Broadcom vulnerabilities?

Yes — 139 of Broadcom's CVEs have a known public exploit.

How many critical Broadcom vulnerabilities are there?

Broadcom has 145 critical and 287 high-severity CVEs.

What is the average severity of Broadcom CVEs?

The average CVSS base score across Broadcom's scored CVEs is 7.3.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

702 CVEs

6 in CISA KEV

Broadcom Vulnerabilities

Name: Broadcom vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Broadcom.

702

Total CVEs

Published

6

In CISA KEV

Exploited in the wild

139

Public exploits

PoC or exploit code

7.3

Avg CVSS

1999–2026

Overview

Broadcom has 702 published CVE records since 1999, of which 6 are in CISA's Known Exploited Vulnerabilities catalog and 139 have a known public exploit. The average CVSS base score across scored CVEs is 7.3.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Broadcom products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Broadcom's vulnerability posture, as a share of its 702 published CVEs.

Average CVSS: 7.3
Critical / high: 62%
Actively exploited (KEV): 1%
Public exploit available: 20%
Patch available: 59%

Severity and exploitation

How the CVSS severity of Broadcom's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical145

High287

Medium254

Low16

In CISA’s Known Exploited Vulnerabilities catalog

6

6 of Broadcom's CVEs are confirmed exploited in the wild.

Public exploits

139

139 of Broadcom's CVEs have a known public exploit available.

Most affected products

The Broadcom products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Broadcom CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Broadcom CVE records.

Disclosure activity by year

How many Broadcom CVEs were published each year.

2019

36

2020

57

2021

49

2022

64

2023

63

2024

62

2025

62

2026

54

Latest Broadcom CVEs

The most recently disclosed vulnerabilities affecting Broadcom.

Local privilege escalation in Symantec ITMS
Medium · CVSS 5.1
EPSS 0.1%2026-07-17
Arbitrary File Read as SYSTEM in Symantec ITMS
Medium · CVSS 5.1
EPSS 0.1%2026-07-17
RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass
CWE-863
High · CVSS 7.0
EPSS 0.3%2026-07-10
RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users
CWE-862
Medium · CVSS 5.3
EPSS 0.3%2026-07-10
RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom
CWE-863
High · CVSS 7.0
EPSS 0.3%2026-07-10
RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations
CWE-200
High · CVSS 8.7
EPSS 0.4%2026-07-10
RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure
CWE-863
Medium · CVSS 4.9
EPSS 0.3%2026-07-10
RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks
CWE-287
Critical · CVSS 10.0
EPSS 0.5%2026-07-10
RabbitMQ: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoS
CWE-770
High · CVSS 7.5
EPSS 0.5%2026-07-10
RabbitMQ: Stored XSS in RabbitMQ management UI
CWE-79
High · CVSS 7.1
EPSS 0.2%2026-07-10
RabbitMQ: UNC SSRF affecting the management UI on Windows
CWE-36
Critical · CVSS 10.0
EPSS 0.4%2026-07-10
RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size
CWE-770
High · CVSS 7.1
EPSS 0.4%2026-07-10

Track new Broadcom CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Broadcom CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

oretnom23766 CVEs Wireshark748 CVEs WordPress739 CVEs Trend Micro684 CVEs Novell675 CVEs UNISOC650 CVEs QNAP643 CVEs Moodle633 CVEs

Browse all vendors

Frequently asked questions

Common questions about Broadcom vulnerabilities.

How many CVEs does Broadcom have?: Broadcom has 702 published CVE records since 1999, including 116 in the last two years.
How many Broadcom CVEs are in CISA KEV?: Yes — 6 of Broadcom's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Broadcom products have the most CVEs?: The Broadcom products with the most published CVEs are fabric operating system, Brocade SANnav, tcpreplay, brightstor arcserve backup, brocade fabric operating system firmware.
What are the most common weakness types in Broadcom CVEs?: Broadcom's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-532 (Insertion of Sensitive Information into Log File), CWE-312 (Cleartext Storage of Sensitive Information), CWE-476 (NULL Pointer Dereference).
Are there public exploits for Broadcom vulnerabilities?: Yes — 139 of Broadcom's CVEs have a known public exploit.
How many critical Broadcom vulnerabilities are there?: Broadcom has 145 critical and 287 high-severity CVEs.
What is the average severity of Broadcom CVEs?: The average CVSS base score across Broadcom's scored CVEs is 7.3.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Broadcom vulnerabilities

Monitor new Broadcom vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing