Puppet
Security Risk Profile
28
/100
lowSecurity Risk Score
Comprehensive risk assessment based on 142 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from May 27, 2009 to present
142
Total CVEs
50
Critical+High
0
Exploited
41
Unpatched
Threat Assessment
Avg CVSS
6.4
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
41
Critical/High
Risk Level
28/100
low
Severity Distribution
Critical
19High
31Medium
68Low
16Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
4Age Distribution
Common Weaknesses (CWE)
1
Input Validation
14
2
Infoleak
11
3
XSS
5
4
OS Command Injection
4
5
Command Injection
3
Most Affected Products
1. Puppet Puppet534
2. puppet Puppet Enterprise180
3. Puppet Puppet Enterprise147
4. Puppetlabs Puppet111
5. Puppet Facter54
Recent Vulnerabilities
See more →CVE-2026-8804
CVSS 6.7EPSS 0%medium
Cleartext Storage of Sensitive Information for Puppet Resource API
7/3/2026🔧 No Patch
CVE-2025-10360
CVSS 6.9medium
Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5
9/24/2025🔧 No Patch
CVE-2025-5459
CVSS 8.8EPSS 0%high
OS Command Injection
6/26/2025🔧 No Patch
CVE-2021-27017
CVSS 6.6medium
Deserialization of untrusted data
2/7/2025🔧 No Patch
latest-version-puppet-8
unknown
10/18/2024
EOL-puppet-8
unknown
10/18/2024
REDHAT-BUG-2274755
CVSS 1.0low
4/12/2024🔧 No Patch
CVE-2023-5309
CVSS 9.8EPSS 0%critical
Broken Session Management in Puppet Enterprise
11/7/2023🔧 No Patch
CVE-2023-5214
CVSS 9.8critical
- Privilege Escalation in Puppet Bolt
10/6/2023
CVE-2023-5255
CVSS 7.5EPSS 0%high
Denial of Service for Revocation of Auto Renewed Certificates
10/3/2023🔧 No Patch
Monitor Puppet in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.