p
pomerium
Security Risk Profile
41
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 9 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from April 2, 2021 to present
9
Total CVEs
6
Critical+High
0
Exploited
3
Unpatched
Threat Assessment
Avg CVSS
7.9
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
3
Critical/High
Risk Level
41/100
medium
Severity Distribution
Critical
2High
4Medium
3Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
0Age Distribution
Common Weaknesses (CWE)
1
Infoleak
2
2
XSS
1
Most Affected Products
1. Pomerium pomerium16
2. go/github.com/pomerium/pomerium10
3. Envoyproxy Envoy10
Recent Vulnerabilities
See more →CVE-2024-39315
CVSS 6.5medium
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response
Jul 2, 2024
CVE-2023-33189
CVSS 10.0critical
Incorrect Authorization with specially crafted requests
May 26, 2023
CVE-2022-24797
CVSS 9.1critical
Exposure of Sensitive Information in Pomerium
Mar 31, 2022
CVE-2021-41230
CVSS 8.8high
OIDC claims not updated from Identity Provider in Pomerium
Nov 5, 2021
CVE-2021-39206
CVSS 8.6high
Incorrect Authorization with specially crafted requests
Sep 9, 2021🔧 No Patch
CVE-2021-39204
CVSS 7.5high
Excessive CPU usage in Pomerium
Sep 9, 2021🔧 No Patch
CVE-2021-39162
CVSS 8.6high
Incorrect handling of H2 GOAWAY + SETTINGS frames
Sep 9, 2021🔧 No Patch
CVE-2021-29652
CVSS 6.1medium
Apr 2, 2021
CVE-2021-29651
CVSS 6.3medium
Apr 2, 2021
Monitor pomerium in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.