2
CVEs
1
Critical
1
High
0
KEV
0
PoC
2
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
1
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (9)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-16279 | Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-19851 | The XML import feature in Tuleap Enterprise Edition versions 17.0 through 17.5 assigns default passwords to user accounts created during XML import operations (CWE-1393), exposing those accounts to network-accessible credential guessing with no authentication or user interaction required. Successful exploitation grants an attacker full control of an affected user account, resulting in high confidentiality and integrity impact per the CVSS 7.7 score. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the unauthenticated network vector makes this a realistic threat for any organization that has used XML import for bulk user migration. | HIGH | 7.7 | 0.2% | 39 |
No patch
|