Open Source Cacti <1.2.31

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

2critical1high5medium1low

updated 2026-10-28

vulnerabilities (34)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-39938US	—	0.69% (53rd)	Exploit	no fix	2026-06-24	—
CVE-2026-40083US	—	0.50% (43rd)	Exploit	no fix	2026-06-25	—
CVE-2026-39902US	—	0.40% (34th)	Exploit	no fix	2026-10-23	—
CVE-2026-39949US	—	—	Exploit	no fix	2026-06-29	—
CVE-2026-40079US	critical9.8	1.69% (77th)	—	no fix	2026-06-25	—
CVE-2026-39948US	critical9.8	0.85% (58th)	—	no fix	2026-06-24	—
CVE-2026-39893US	—	0.67% (52nd)	—	no fix	2026-06-24	—
CVE-2026-39955US	—	0.58% (48th)	—	no fix	2026-06-24	—
CVE-2026-40084US	—	0.49% (42nd)	—	no fix	2026-06-25	—
CVE-2026-39951US	high8.8	0.40% (34th)	—	no fix	2026-06-25	—
CVE-2026-32935US	medium5.9	0.39% (33rd)	—	no fix	2026-03-20	—
CVE-2026-39899US	medium5.3	0.39% (32nd)	—	no fix	2026-06-24	—
CVE-2026-40194US	—	0.36% (30th)	—	no fix	2026-04-10	—
CVE-2026-40082US	—	0.32% (25th)	—	no fix	2026-06-25	—
CVE-2026-40941US	medium6.5	0.27% (18th)	—	no fix	2026-06-25	—
CVE-2026-39900US	medium6.1	0.26% (18th)	—	no fix	2026-06-24	—
CVE-2026-39897US	medium6.1	0.26% (18th)	—	no fix	2026-06-24	—
CVE-2026-40080US	—	0.26% (17th)	—	no fix	2026-06-25	—
CVE-2026-49442US	—	0.24% (15th)	—	no fix	2026-10-23	—
CVE-2026-1513US	—	0.21% (10th)	—	no fix	2026-01-28	—
CVE-2026-46531US	—	0.20% (10th)	—	no fix	2026-10-23	—
CVE-2026-39894US	low2.5	0.14% (3rd)	—	no fix	2026-06-24	—
CVE-2026-22802US	—	—	—	no fix	—	—
CVE-2026-39895US	—	—	—	no fix	—	—
CVE-2026-39896US	—	—	—	no fix	—	—
CVE-2026-39898US	—	—	—	no fix	—	—
CVE-2026-39939US	—	—	—	no fix	—	—
CVE-2026-39947US	—	—	—	no fix	—	—
CVE-2026-39950US	—	—	—	no fix	—	—
CVE-2026-39952US	—	—	—	no fix	—	—
CVE-2026-40078US	—	—	—	no fix	—	—
CVE-2026-40081US	—	—	—	no fix	—	—
CVE-2026-41884US	—	—	—	no fix	—	—
CVE-2026-44481US	—	—	—	no fix	—	—

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')6 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')4 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-208Observable Timing Discrepancy2 CVEs
CWE-204Observable Response Discrepancy1 CVEs
CWE-347Improper Verification of Cryptographic Signature1 CVEs
CWE-384Session Fixation1 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)34 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan