W
Vendor security profile
withastro
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs6
Critical0
CISA KEV0
Public exploit2
Patch rate%67
Avg. CVSS5.9
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
4
2
0
CVE KEV
CVE severity distribution
6toplam CVE
High1 (17%)
Medium4 (67%)
Low1 (17%)
Patch and exploitation view
%67
Verified patch
%0
CISA KEV
%33
Public exploit
4Patch available
0Partial
0Workaround
0Vendor: no patch
2Unknown
Latest vulnerabilities
8.2
CVE-2026-102984
Astro: Malformed port in the Host header can crash the Node adapter
W
Patch status unknownEPSS %0
6.3
CVE-2026-102983
Astro: Netlify Image CDN allowlist bypass enables SSRF
W
Patch status unknownEPSS %0
6.5
CVE-2026-73424
Astro: Unauthenticated path override in the @astrojs/vercel ISR function
W
Patch verifiedEPSS %0
3.7
CVE-2026-73425
@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
W
Patch verifiedEPSS %0
5.1
CVE-2026-73423
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
W
Patch verifiedEPSS %0
5.3
CVE-2026-73422
Astro: Reflected XSS via unescaped View Transition animation properties
W
Patch verifiedEPSS %1