M
Vendor security profile1 actively exploited CVEs
maven
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs423
Critical74
CISA KEV1
Public exploit59
Patch rate%57
Avg. CVSS7.2
12-month vulnerability rate
0
2
3
2
4
7
12
134
65
75
70
24
CVE KEV
CVE severity distribution
423toplam CVE
Critical74 (17%)
High178 (42%)
Medium161 (38%)
Low10 (2%)
Patch and exploitation view
%57
Verified patch
%0
CISA KEV
%14
Public exploit
241Patch available
1Partial
3Workaround
0Vendor: no patch
178Unknown
Latest vulnerabilities
7.7
CVE-2026-54641
OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl
O
Patch verified
7.6
CVE-2026-54640
OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
O
Patch verified
6.8
CVE-2026-107226
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
A
Patch status unknownEPSS %0
9.3
CVE-2026-107726
Hazelcast: Arbitrary member memory access by low-privileged client
H
Patch status unknownEPSS %0
8.7
CVE-2026-107725
Hazelcast: Authorization bypass in IMap Predicates API
H
Patch status unknownEPSS %0
5.9
CVE-2026-107285
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
A
Patch status unknownEPSS %0
3.7
CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
A
Patch status unknownEPSS %0
9.4
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
A
Patch status unknownEPSS %0
6.9
CVE-2026-107280
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
A
Patch status unknownEPSS %0
8.7
CVE-2026-107231
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
A
Patch status unknownEPSS %0