The six: virtio_rng.sys (SUSE), tmnciesc.sys and vsapint.sys (Trend Micro), btfilter.sys (Qualcomm Atheros), tosrfec.sys (Dynabook) and vdk.sys.
All were fixed by their vendors. A fixed build does not help when an attacker brings the old signed one.
XFEDI
ActivityPubConversation
Also added: a new iscflashx64.sys sample (Insyde) and two HWAuidoOs2Ec.sys samples (CVE-2023-52972) found by R1perXNX. PRs by mnznndr97.
Paper: https://doi.org/10.1016/j.cose.2026.105194
Prevent all of them from loading with free https://MagicSword.io: https://magicsword.io