Almost a third of this week's listed vulnerabilities have no severity score

The weekly vulnerability summary from CISA for the week beginning 10 August lists 3882 vulnerabilities. 1865 of them are rated high severity, 776 medium and 57 low. The remaining 1184 are listed as "not yet calculated", meaning no severity score has been worked out for them. 27 entries carry the maximum score of 10, among them Adobe ColdFusion 2025, SAP Commerce Cloud, Siemens SIMATIC IoT2050 Advanced and two flaws in Metabase.

What happens technically

The summary is a list, not an analysis. CISA states that the bulletin summarises vulnerabilities recorded over the past week, and that some of the content is compiled from external open source reports rather than from CISA's own analysis. The bands follow CVSS, where high is 7.0 to 10.0, medium is 4.0 to 6.9 and low is 0.0 to 3.9. Entries without a score sit in a separate section headed "Severity Not Yet Assigned". CISA publishes no totals in the bulletin, so the counts in this article are our own tally of the listing itself.

The volume says less about the threat picture than it appears to. 1217 of the 3882 entries concern the Linux kernel, and every one of them opens its description with the same sentence: "In the Linux kernel, the following vulnerability has been resolved". These are faults already fixed in the kernel, each recorded as its own CVE. Microsoft accounts for 409 entries, and 218 of the descriptions mention WordPress. The total of 3882 is therefore not 3882 new openings into any single environment. It is a register of everything recorded during the week, regardless of what any given organisation actually runs.

The top of the list is a different matter. Metabase appears twice at score 10, through CVE-2026-72898 against the password reset endpoint and CVE-2026-72899 through a publicly shared card or dashboard that exposes a field filter. Siemens SIMATIC IoT2050 Advanced is listed because the Node-RED interface enforces no authentication, letting a remote attacker build flows that run commands with maximum privileges. Haiwell IoT Cloud HMI Gateway carries a command injection in its network check feature, and it runs as root. The WordPress plugin Link Factory is entered with a description that leaves no room for doubt: the plugin is a backdoor, distributed as a tool for publishing sentences on the homepage, with an API the operator drives through a hardcoded key.

What this means for you if you prioritise the patching

In our assessment the list is unusable as a work queue, and that is no criticism of CISA. It is built to be complete, not to be your queue. With 3882 entries and no picture of what you actually run, there is no route from the list to a decision. With a current inventory of the software in production, those 3882 shrink to a manageable number that genuinely concerns you. The value sits in your inventory, not in the bulletin.

The 1184 entries without a severity score deserve a thought of their own. A missing number means nobody has calculated it yet, not that the vulnerability is harmless. If your tooling sorts on CVSS, these land at the bottom or drop out of the list entirely, and there they stay until someone puts a number on them weeks later. A process that looks only at the score has a blind spot covering almost a third of the week's entries. We recommend treating "not yet calculated" as unknown risk, and letting the vendor and the product set the urgency rather than the empty field.

Berigo recommends

• Keep a current inventory of the software you run, with version and a named owner. Without it no vulnerability list can be prioritised.
• Filter the week's listing against your own product list, rather than reading it from the top down.
• Treat entries marked "not yet calculated" as unknown risk, never as low risk.
• Check whether any of the 27 entries at score 10 cover products you run, and start there.
• Review the plugins in your publishing platform and remove the ones nobody has a named need for. Link Factory is listed as a plain backdoor.