469
CVEs
38
Critical
95
High
7
KEV
33
PoC
26
Unpatched C/H
82.7%
Patch Rate
3.1%
Avg EPSS
Severity Breakdown
CRITICAL
38
HIGH
95
MEDIUM
298
LOW
38
Monthly CVE Trend
Affected Products (30)
Debian Linux
44
PHP
35
Fedora
20
Open Redirect
12
Drupal Core
12
Application Express
10
Peoplesoft Enterprise Peopletools
10
Open Social
8
Ckeditor
7
H500s Firmware
6
Miniorange 2fa
6
H700s Firmware
6
H410s Firmware
6
Jd Edwards Enterpriseone Tools
6
H300s Firmware
6
H410c Firmware
6
Weblogic Server
6
Policy Automation
5
Symfony
5
Agile Plm
5
Rest Data Services
5
Communications Interactive Session Recorder
5
Opigno
5
H700E Firmware
5
Communications Operations Monitor
5
Artificial Intelligence
5
H300E Firmware
5
Banking Platform
5
H500E Firmware
5
Financial Services Analytical Applications Infrastructure
4
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2018-7602 | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 99.2% | 218 |
KEV
PoC
|
| CVE-2014-3704 | The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.9%. | HIGH | 7.5 | 93.9% | 166 |
PoC
|
| CVE-2016-5385 | PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 81.3%. | HIGH | 8.1 | 81.3% | 142 |
PoC
|
| CVE-2014-9016 | The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.8%. | MEDIUM | 5.0 | 79.8% | 125 |
PoC
|
| CVE-2026-9082 | SQL injection in Drupal core (versions 8.9.0 through the fixed 10.4.10/10.5.10/10.6.9 and 11.x branches through 11.3.10) allows attackers to inject arbitrary SQL against the site database, per SA-CORE-2026-004. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code (Exploit-DB 52608 and multiple public PoCs), and the CVSS 9.8 vector indicates unauthenticated remote exploitation. Notably, EPSS remains extremely low (0.01%) and SSVC lists exploitation as 'none', signaling either targeted rather than widespread activity or conflicting source data that defenders should treat cautiously while still prioritizing the patch given KEV status. | CRITICAL | 9.8 | 0.0% | 124 |
KEV
PoC
|
| CVE-2014-5266 | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.3%. | MEDIUM | 5.0 | 76.3% | 121 |
PoC
No patch
|
| CVE-2012-4554 | The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 55.1%. | MEDIUM | 5.0 | 55.1% | 100 |
PoC
|
| CVE-2021-41182 | jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | MEDIUM | 6.1 | 42.2% | 93 |
PoC
|
| CVE-2018-7600 | Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 100.0% | 84 |
KEV
PoC
|
| CVE-2019-6340 | Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available. | HIGH | 8.1 | 91.9% | 76 |
KEV
PoC
|
| CVE-2021-41184 | jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users. | MEDIUM | 6.1 | 44.5% | 75 |
|
| CVE-2020-28949 | Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 84.6% | 74 |
KEV
PoC
|
| CVE-2026-10768 | Missing authorization in the Drupal LocalGov Workflows contrib module (all versions 0.0.0 through 1.6.0, fixed in 1.6.0) lets remote attackers reach protected workflow-related routes through forceful browsing without proper permission checks. The flaw carries a vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N), but EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis. Affected sites are Drupal deployments running this LocalGov Drupal editorial-workflow module. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
|
| CVE-2019-10910 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 5.9% | 69 |
PoC
|
| CVE-2020-28948 | Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 47.5% | 59 |
PoC
|