P
Puppet
Security Risk Profile
54
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 143 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from May 27, 2009 to present
143
Total CVEs
51
Critical+High
0
Exploited
42
Unpatched
Threat Assessment
Avg CVSS
6.4
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
42
Critical/High
Risk Level
54/100
medium
🆕 1Fresh (<7d)📈 1 in Last 30 Days
Severity Distribution
Critical
19High
32Medium
68Low
16Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
4Age Distribution
Common Weaknesses (CWE)
1
Input Validation
15
2
Infoleak
11
3
OS Command Injection
5
4
XSS
5
5
Command Injection
4
Most Affected Products
1. Puppet Puppet534
2. puppet Puppet Enterprise180
3. Puppet Puppet Enterprise148
4. Puppetlabs Puppet111
5. Puppet Facter54
Recent Vulnerabilities
See more →CVE-2026-85979
CVSS 8.6high
Command Injection in Puppet Enterprise
Sep 11, 2026🔧 No Patch
CVE-2026-8804
CVSS 6.7EPSS 0%medium
Cleartext Storage of Sensitive Information for Puppet Resource API
Jul 3, 2026🔧 No Patch
CVE-2025-10360
CVSS 6.9medium
Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5
Sep 24, 2025🔧 No Patch
CVE-2025-5459
CVSS 8.8EPSS 0%high
OS Command Injection
Jun 26, 2025🔧 No Patch
CVE-2021-27017
CVSS 6.6medium
Deserialization of untrusted data
Feb 7, 2025🔧 No Patch
latest-version-puppet-8
unknown
Oct 18, 2024
EOL-puppet-8
unknown
Oct 18, 2024
REDHAT-BUG-2274755
CVSS 1.0low
Apr 12, 2024🔧 No Patch
CVE-2023-5309
CVSS 9.8EPSS 0%critical
Broken Session Management in Puppet Enterprise
Nov 7, 2023🔧 No Patch
CVE-2023-5214
CVSS 9.8critical
- Privilege Escalation in Puppet Bolt
Oct 6, 2023
Monitor Puppet in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.