alibaba
Security Risk Profile
63
/100
highSecurity Risk Score
Comprehensive risk assessment based on 26 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from February 7, 2007 to present
26
Total CVEs
7
Critical+High
1
Exploited
3
Unpatched
Threat Assessment
Avg CVSS
7.8
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
3
Critical/High
Risk Level
63/100
high
⚠️ 1 Active Exploits
Severity Distribution
Critical
3High
4Medium
4Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
0Age Distribution
Common Weaknesses (CWE)
1
Integer Overflow
1
2
XSS
1
3
Path Traversal
1
4
Input Validation
1
Most Affected Products
1. Alibaba Dragonwell9
2. Alibaba Nacos5
3. Alibaba Qwen3
4. Alibaba fastjson3
5. maven/com.alibaba.nacos:nacos-common3
Recent Vulnerabilities
See more →https://www.zdnet.com/article/microsoft-obliterated-ai-safety-guardrails-with-one-prompt/
unknown
How Microsoft obliterated safety guardrails on popular AI models - with just one prompt
2/9/2026🔧 No Patch
REDHAT-BUG-2428203
unknown
1/9/2026🔧 No Patch
https://www.theregister.com/2025/11/11/llm_sidechannel_attack_microsoft_researcher/
unknown
LLM side-channel attack could allow snoops to guess topic
11/11/2025⚠ Exploited🔧 No Patch
ZDI-25-984
unknown
Alibaba Cloud Workspace Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
10/30/2025🔧 No Patch
ZDI-CAN-26635
unknown
ZDI-25-984: Alibaba Cloud Workspace Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
10/30/2025🔧 No Patch
EOL-alibaba-dragonwell-25
unknown
9/24/2025
https://www.bleepingcomputer.com/news/security/google-says-hackers-abuse-gemini-ai-to-empower-their-attacks/
unknown
Google says hackers abuse Gemini AI to empower their attacks
2/1/2025🔧 No Patch
EOL-alibaba-dragonwell-21
unknown
8/29/2024
latest-version-alibaba-dragonwell-21
unknown
8/29/2024
EOL-alibaba-dragonwell-8
unknown
5/10/2024
Monitor alibaba in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.