11
CVEs
2
Critical
2
High
0
KEV
10
PoC
4
Unpatched C/H
0.0%
Patch Rate
0.8%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
2
MEDIUM
4
LOW
3
Monthly CVE Trend
Affected Products (8)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-15501 | Sangfor O&M Management System (through 3.0.8) has a second command injection in /isomp-protocol/protocol/getCmd, also via sessionPath. Public exploit with higher EPSS (1.2%) than the first vulnerability. | CRITICAL | 9.8 | 1.2% | 70 |
PoC
No patch
|
| CVE-2025-15500 | Sangfor Operation and Maintenance Management System (through 3.0.8) has OS command injection in /isomp-protocol/protocol/getHis via the sessionPath parameter. Public exploit available, vendor unresponsive. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2025-15499 | Operation And Maintenance Management System versions up to 3.0.8. is affected by command injection (CVSS 8.8). | HIGH | 8.8 | 0.4% | 64 |
PoC
No patch
|
| CVE-2026-1324 | Operation And Maintenance Security Management System versions up to 3.0.12. is affected by command injection (CVSS 8.8). | HIGH | 8.8 | 0.3% | 64 |
PoC
No patch
|
| CVE-2025-15503 | Operation And Maintenance Security Management System versions up to 3.0.8. is affected by improper access control (CVSS 7.3). | MEDIUM | 5.5 | 5.5% | 53 |
PoC
No patch
|
| CVE-2025-15502 | Operation And Maintenance Security Management System versions up to 3.0.8. is affected by command injection (CVSS 7.3). | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-1412 | Operation And Maintenance Security Management System versions up to 3.0.12. contains a security vulnerability (CVSS 7.3). | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2026-1325 | Operation And Maintenance Security Management System versions up to 3.0.12. is affected by weak password recovery mechanism for forgotten password (CVSS 5.3). | MEDIUM | 5.3 | 0.1% | 47 |
PoC
No patch
|
| CVE-2025-12916 | A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | LOW | 2.1 | 0.5% | 31 |
PoC
No patch
|
| CVE-2026-1414 | Operation And Maintenance Security Management System versions up to 3.0.12. contains a vulnerability that allows attackers to command injection (CVSS 6.3). | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2026-1413 | Operation And Maintenance Security Management System versions up to 3.0.12. contains a security vulnerability (CVSS 6.3). | LOW | 2.1 | 0.1% | 11 |
No patch
|