C
Vendor security profile1 actively exploited CVEs
cli
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs15
Critical2
CISA KEV1
Public exploit5
Patch rate%47
Avg. CVSS6.0
12-month vulnerability rate
1
0
0
0
1
0
1
1
1
5
2
2
CVE KEV
CVE severity distribution
15toplam CVE
Critical2 (13%)
High5 (33%)
Medium4 (27%)
Low4 (27%)
Patch and exploitation view
%47
Verified patch
%7
CISA KEV
%33
Public exploit
7Patch available
0Partial
1Workaround
0Vendor: no patch
7Unknown
Latest vulnerabilities
6.8
CVE-2026-107226
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
A
Patch status unknown
8.3
CVE-2026-92877
XML external entity injection in Eclipse Foundation Jaxb Ri (core)
EF
Patch status unknown
6.3
CVE-2026-108749
docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints
D
Patch status unknownEPSS %0
7.1
CVE-2026-107503
Insufficiently protected credentials in Eclipse Ditto Ditto Explorer UI
ED
Patch status unknownEPSS %0
5.9
CVE-2026-107285
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
A
Patch status unknownEPSS %0
3.7
CVE-2026-107284
AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check
A
Patch status unknownEPSS %0
3.7
CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
A
Patch status unknownEPSS %0
9.4
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
A
Patch status unknownEPSS %0
7.6
CVE-2026-107281
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
A
Patch status unknownEPSS %0
6.9
CVE-2026-107280
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
A
Patch status unknownEPSS %0