A
Vendor security profile
Aman
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs2
Critical0
CISA KEV0
Public exploit0
Patch rate%0
Avg. CVSS6.8
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
1
1
CVE KEV
CVE severity distribution
2toplam CVE
High1 (50%)
Medium1 (50%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
2Unknown
Latest vulnerabilities
7.1
CVE-2026-40807
WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability
A
Patch status unknownEPSS %0
6.5
CVE-2026-100513
WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
A
Patch status unknownEPSS %0
5.3
CVE-2026-94047
samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management
S
Patch verifiedEPSS %0
7.6
CVE-2026-90474
MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass
S
Patch verifiedEPSS %1
6.9
CVE-2026-79743
MCPHub: Path Traversal via Malicious MCPB Manifest Name
S
Patch status unknownEPSS %1
8.8
CVE-2026-79744
MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
S
Patch status unknownEPSS %1
7.1
CVE-2026-79745
MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)
S
Patch status unknownEPSS %0
8.1
CVE-2026-79746
MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching
S
Patch status unknownEPSS %0
7.1
CVE-2026-79747
MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)
S
Patch status unknownEPSS %0
9.9
CVE-2026-79748
MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)
S
Patch status unknownEPSS %1