17
CVEs
1
Critical
6
High
0
KEV
3
PoC
7
Unpatched C/H
5.9%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
6
MEDIUM
10
LOW
0
Monthly CVE Trend
Affected Products (29)
Brava Desktop
35
Documentum Content Server
8
Vertica
6
Documentum Webtop
6
Document Sciences Xpression
6
Exceed Ondemand
4
Documentum Administrator
4
Web Site Management Server
3
Documentum D2
3
Arcsight Intelligence
3
Brava
2
Open Redirect
2
Xm Fax
2
Filr
2
Access Manager
2
Operations Agent
1
Directory Services
1
Content Server
1
Opentext Ixos Ecm For Sap Netweaver
1
Tomcat
1
PostgreSQL
1
Zenworks Service Desk
1
Tempo Box
1
Alm Octane
1
Identity Manager
1
Idm Driver And Extensions
1
Secure Mft 2014
1
Java
1
Secure Mft 2013
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-13671 | Web Site Management Server versions up to 16.7.0 is affected by cross-site request forgery (csrf) (CVSS 6.5). | MEDIUM | 6.5 | 0.0% | 53 |
PoC
No patch
|
| CVE-2026-3266 | Missing authorization in OpenText Filr allows auth bypass via XSRF tokens. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2025-13672 | Web Site Management Server versions up to 16.7.0 is affected by cross-site scripting (xss) (CVSS 5.4). | MEDIUM | 5.4 | 0.0% | 47 |
PoC
No patch
|
| CVE-2025-9208 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Stored XSS. [CVSS 5.4 MEDIUM] | MEDIUM | 5.4 | 0.0% | 47 |
PoC
No patch
|
| CVE-2026-2123 | Privilege escalation in OpenText Operations Agent versions 12.29 and earlier on Windows allows local attackers to execute arbitrary code by placing malicious executables in specific writeable directories, which the agent subsequently executes with elevated privileges. The vulnerability requires local access and specific conditions to be present but does not require prior authentication to the agent itself. No public exploit code has been identified, and there is no confirmation of active exploitation at time of analysis. | HIGH | 8.6 | 0.0% | 43 |
No patch
|
| CVE-2025-13478 | OpenText Identity Manager versions up to 25.2 (v4.10.1) suffer from insecure cache handling that permits remote authenticated users to retrieve another user's session data, resulting in unauthorized information disclosure. An attacker with valid credentials can exploit this cache misconfiguration on both Windows and Linux deployments to access sensitive session information belonging to other authenticated users, compromising confidentiality of user sessions and potentially enabling lateral movement or privilege escalation attacks. | HIGH | 8.4 | 0.2% | 42 |
No patch
|
| CVE-2026-11878 | Cross-site scripting in OpenText Access Manager 5.1 through 5.1.2 lets a remote unauthenticated attacker inject script that executes in the browser of a targeted user of this enterprise SSO/access-management platform (CWE-79). Per the vendor-supplied CVSS 4.0 vector the flaw carries high vulnerable-system confidentiality impact (VC:H) but high attack complexity and a specific attack requirement (AC:H/AT:P), yielding a base score of 8.2. No public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 8.2 | 0.2% | 41 |
No patch
|
| CVE-2025-8054 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText™ XM Fax allows Path Traversal. The vulnerability could allow an attacker to arbitrarily disclose content of files on the local filesystem. [CVSS 7.5 HIGH] | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-3278 | OpenText ZENworks Service Desk contains an improper input neutralization vulnerability (CWE-79 Cross-Site Scripting) that allows attackers to inject and execute arbitrary JavaScript in the context of a user's browser session. Affected versions are 25.2 and 25.3. Successful exploitation enables unauthorized actions on behalf of the user, including session hijacking, credential theft, or lateral movement within the service desk application. | HIGH | 7.4 | 0.0% | 37 |
No patch
|
| CVE-2024-11604 | Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows authenticated local users to obtain. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available. | HIGH | 7.3 | 0.0% | 37 |
No patch
|
| CVE-2026-11877 | Unauthorized configuration modification in OpenText Access Manager before 5.1.3 allows a remote unauthenticated attacker to alter system configuration via API calls that lack proper authorization enforcement, classified under CWE-648 (Incorrect Use of Privileged APIs). Affected deployments expose privileged API endpoints without adequate access control, enabling integrity impact across both the vulnerable system and subsequent systems relying on it for identity and access decisions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | MEDIUM | 6.3 | 0.2% | 32 |
No patch
|
| CVE-2026-1658 | Directory Services versions up to 25.2. is affected by user interface (ui) misrepresentation of critical information (CVSS 5.3). | MEDIUM | 5.3 | 0.0% | 27 |
No patch
|
| CVE-2025-8055 | Server-Side Request Forgery (SSRF) vulnerability in OpenText™ XM Fax allows Server Side Request Forgery. The vulnerability could allow an attacker to perform blind SSRF to other systems accessible from the XM Fax server. [CVSS 5.3 MEDIUM] | MEDIUM | 5.3 | 0.0% | 27 |
No patch
|
| CVE-2025-12453 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in OpenText Vertica's management console application due to improper input neutralization during web page generation (CWE-79). The vulnerability affects Vertica versions 10.0 through 25.3.X, allowing attackers to inject malicious scripts that execute in users' browsers when they click attacker-controlled links. With a CVSS v4.0 score of 5.1 and network-based attack vector requiring user interaction, this represents a moderate risk with limited direct technical impact but potential for credential theft or session hijacking. | MEDIUM | 5.1 | 0.0% | 26 |
No patch
|
| CVE-2025-12454 | This vulnerability is a Reflected Cross-Site Scripting (XSS) flaw in OpenText Vertica's management console that fails to properly neutralize user input during web page generation. The issue affects Vertica versions 10.0 through 25.1.x across multiple major version branches, allowing attackers to inject malicious scripts that execute in users' browsers. With a CVSS score of 5.1 (medium severity) and a network attack vector requiring only user interaction, this vulnerability poses a moderate but exploitable risk to Vertica deployments, particularly those exposing the management console to untrusted networks. | MEDIUM | 5.1 | 0.0% | 26 |
No patch
|