M
Vendor security profile1 actively exploited CVEs
maven
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs423
Critical74
CISA KEV1
Public exploit57
Patch rate%55
Avg. CVSS7.2
12-month vulnerability rate
0
2
3
2
4
7
12
134
67
75
70
22
CVE KEV
CVE severity distribution
423toplam CVE
Critical74 (17%)
High176 (42%)
Medium161 (38%)
Low10 (2%)
Uncertain2 (0%)
Patch and exploitation view
%55
Verified patch
%0
CISA KEV
%13
Public exploit
230Patch available
1Partial
3Workaround
0Vendor: no patch
189Unknown
Latest vulnerabilities
9.3
CVE-2026-107726
Hazelcast: Arbitrary member memory access by low-privileged client
H
Patch status unknownEPSS %0
8.7
CVE-2026-107725
Hazelcast: Authorization bypass in IMap Predicates API
H
Patch status unknownEPSS %0
6.8
CVE-2026-107226
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
M
Patch status unknown
5.9
CVE-2026-107285
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
A
Patch status unknownEPSS %0
3.7
CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
A
Patch status unknownEPSS %0
9.4
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
A
Patch status unknownEPSS %0
6.9
CVE-2026-107280
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
A
Patch status unknownEPSS %0
8.7
CVE-2026-107231
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
A
Patch status unknownEPSS %0
7.4
CVE-2026-107230
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
A
Patch status unknownEPSS %0
6.8
CVE-2026-107228
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
A
Patch status unknownEPSS %0