3
CVEs
0
Critical
1
High
0
KEV
0
PoC
1
Unpatched C/H
33.3%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (29)
Brava Desktop
35
Documentum Content Server
8
Vertica
6
Documentum Webtop
6
Document Sciences Xpression
6
Exceed Ondemand
4
Documentum Administrator
4
Web Site Management Server
3
Documentum D2
3
Arcsight Intelligence
3
Brava
2
Open Redirect
2
Xm Fax
2
Filr
2
Access Manager
2
Operations Agent
1
Directory Services
1
Content Server
1
Opentext Ixos Ecm For Sap Netweaver
1
Tomcat
1
PostgreSQL
1
Zenworks Service Desk
1
Tempo Box
1
Alm Octane
1
Identity Manager
1
Idm Driver And Extensions
1
Secure Mft 2014
1
Java
1
Secure Mft 2013
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-11878 | Cross-site scripting in OpenText Access Manager 5.1 through 5.1.2 lets a remote unauthenticated attacker inject script that executes in the browser of a targeted user of this enterprise SSO/access-management platform (CWE-79). Per the vendor-supplied CVSS 4.0 vector the flaw carries high vulnerable-system confidentiality impact (VC:H) but high attack complexity and a specific attack requirement (AC:H/AT:P), yielding a base score of 8.2. No public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 8.2 | 0.2% | 41 |
No patch
|
| CVE-2026-11877 | Unauthorized configuration modification in OpenText Access Manager before 5.1.3 allows a remote unauthenticated attacker to alter system configuration via API calls that lack proper authorization enforcement, classified under CWE-648 (Incorrect Use of Privileged APIs). Affected deployments expose privileged API endpoints without adequate access control, enabling integrity impact across both the vulnerable system and subsequent systems relying on it for identity and access decisions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | MEDIUM | 6.3 | 0.2% | 32 |
No patch
|
| CVE-2025-3271 | Cross-site scripting in OpenText Documentum Webtop versions prior to 16.7.1 allows an authenticated attacker to inject malicious scripts into the application that execute in a victim user's browser upon interaction with attacker-controlled content. The CVSS 4.0 vector (PR:L/UI:A) confirms exploitation requires both a valid account and active victim engagement, constraining the realistic attack surface to insider threats or compromised accounts. No public exploit code or active exploitation has been identified at time of analysis. | MEDIUM | 4.8 | 0.3% | 24 |
|