Two disclosure paths run at different speeds. A component maker can publish before its server partners have validated firmware for their own boards, and a team watching only its OEM will not hear about the underlying defect until a product-specific update ships [9]. Eclypsium's account has BlueField and ConnectX fixes arriving through Nvidia, Dell and Lenovo separately [8]. Either path leaves a window, and the window belongs to the tracking process rather than to the release schedule [18].
The volume argues the same way. 118 new advisories plus 74 revisions is 192 documents across the 38 days from July 18 to August 24 [1][3][19], a little over five a day [20]. Average payload is 1,051 divided by 118, about nine vulnerabilities per advisory [21]. The Dell Networking OS10 rollup at 435 CVEs is roughly 49 times that average [15][22], so most of the reading is thin and the parts that matter sit inside rollups too large to triage line by line.
Deduplication cuts both ways. CVE-2026-31431, a Linux kernel privilege-escalation flaw, appears in that OS10 rollup, in an earlier Dell advisory, and then again for Dell Metro Node [15][16]. Advisory counts therefore overstate the number of distinct defects while understating the number of places each defect has to be fixed. Other Dell rollups carried bugs that originated in Chromium's V8 engine, one of them landing on Dell ThinOS [17]. AMD's two TPM reference-code flaws show the same shape from upstream, with Lenovo issuing separate advisories for firmware-based and discrete TPM parts [13], because each vendor builds, validates and ships its own update [14]. On August 11 that redistribution produced 38 firmware advisories in one day, 32 percent of the window's new total [11][23].
The count is Eclypsium's own, drawn from its monthly InfraTrust Pulse, and no second party has published a comparable tally [1]. The analysis names no exploitation [24]. The 9.8 ratings on Triton Inference Server and Dynamo describe what a working exploit would get [4][5].
What the data supports is narrower and more useful than a severity score. The highest-rated items sit above the hardware, in the model-serving and telemetry tier positioned directly in front of the accelerators [7], and the firmware items sit in components that one estate may buy through two or three different OEMs [10]. An inventory keyed to server brand cannot answer which machines hold a given BlueField card or a given TPM implementation. That is the question these advisories ask.
