G
Vendor security profile1 actively exploited CVEs
go
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs573
Critical85
CISA KEV1
Public exploit185
Patch rate%43
Avg. CVSS7.1
12-month vulnerability rate
0
1
2
4
4
12
15
57
122
146
144
48
CVE KEV
CVE severity distribution
573toplam CVE
Critical85 (15%)
High237 (41%)
Medium219 (38%)
Low21 (4%)
Uncertain11 (2%)
Patch and exploitation view
%43
Verified patch
%0
CISA KEV
%32
Public exploit
242Patch available
5Partial
5Workaround
0Vendor: no patch
321Unknown
Latest vulnerabilities
8.7
CVE-2026-108708
Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil
W
Patch status unknownEPSS %0
9.3
CVE-2026-108707
Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect
W
Patch status unknownEPSS %1
5.3
CVE-2026-108689
Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send
W
Patch status unknownEPSS %0
7.5
CVE-2026-42706
WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability
T
Patch status unknownEPSS %0
7.5
CVE-2026-42705
WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability
T
Patch status unknownEPSS %0
5.3
CVE-2026-108585
argocd-mcp through 0.9.0 Path Traversal via delete_application Tool
A
Patch status unknownEPSS %0
8.1
CVE-2026-62376
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
G
Patch status unknownEPSS %0
7.5
CVE-2026-62367
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
G
Patch status unknownEPSS %0
8.1
CVE-2026-57458
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
G
Patch status unknownEPSS %0
7.5
CVE-2026-107840
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
J
Patch status unknownEPSS %0