igniterealtime openfire

Name: igniterealtime openfire
Brand: igniterealtime

productUS

cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

2critical5high28medium0low

updated 2026-10-25

vulnerabilities (37)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-32315US	high7.5OT critical	100.0% (100th)	KEV	4.6.8	2023-05-26	2 versions
CVE-2008-6508US	high7.5	83.7% (100th)	Exploit	no fix	2009-03-23	25 versions
CVE-2015-6973US	medium6.8	64.8% (99th)	Exploit	no fix	2015-09-16	= 3.10.2
CVE-2019-18394US	critical9.8	32.3% (98th)	Exploit	no fix	2019-10-24	≤ 4.4.2
CVE-2009-0497US	medium5.0	8.13% (95th)	Exploit	no fix	2009-02-10	= 3.6.2
CVE-2015-6972US	medium4.3	8.00% (95th)	Exploit	no fix	2015-09-16	= 3.10.2
CVE-2015-7707US	medium6.5	6.03% (93rd)	Exploit	no fix	2015-10-05	= 3.10.2
CVE-2009-1595US	medium4.0	2.23% (83rd)	Exploit	no fix	2009-05-11	29 versions
CVE-2008-6509US	high7.5	2.01% (81st)	Exploit	no fix	2009-03-23	25 versions
CVE-2008-6511US	medium5.8	1.83% (79th)	Exploit	no fix	2009-03-23	25 versions
CVE-2008-6510US	medium4.3	1.78% (78th)	Exploit	no fix	2009-03-23	25 versions
CVE-2021-45967US	critical9.8	20.8% (98th)	—	4.5.0	2022-03-18	2 versions
CVE-2019-18393US	medium5.3	13.9% (97th)	—	no fix	2019-10-24	≤ 4.4.2
CVE-2014-2741US	high7.8	3.77% (90th)	—	no fix	2014-04-11	≤ 3.9.1
CVE-2018-11688US	medium6.1	2.37% (84th)	—	no fix	2018-06-13	= 3.7.1
CVE-2014-3451US	high7.5	1.77% (78th)	—	no fix	2017-08-18	≤ 3.9.3
CVE-2024-25421US	—OT elevated	1.65% (76th)	—	no fix	2024-03-26	≤ 4.9.0
CVE-2024-25420US	—OT elevated	1.43% (73rd)	—	no fix	2024-03-26	≤ 4.9.0
CVE-2019-20363US	medium6.1	1.41% (72nd)	—	no fix	2020-01-08	= 4.4.4
CVE-2019-20366US	medium6.1	1.26% (70th)	—	no fix	2020-01-08	= 4.4.4
CVE-2009-1596US	medium6.5	1.20% (68th)	—	3.6.5	2009-05-11	< 3.6.5
CVE-2019-20365US	medium6.1	1.17% (67th)	—	no fix	2020-01-08	= 4.4.4
CVE-2019-20364US	medium6.1	1.17% (67th)	—	no fix	2020-01-08	= 4.4.4
CVE-2020-24604US	medium6.1	1.17% (67th)	—	no fix	2020-09-02	= 4.5.1
CVE-2020-24602US	medium6.1	1.01% (63rd)	—	no fix	2020-09-02	= 4.5.1
CVE-2020-35200US	medium6.1	0.91% (60th)	—	no fix	2020-12-12	= 4.6.0
CVE-2019-20526US	medium6.1	0.91% (60th)	—	no fix	2020-03-19	= 4.4.1
CVE-2019-20525US	medium6.1	0.91% (60th)	—	no fix	2020-03-19	= 4.4.1
CVE-2019-20527US	medium6.1	0.91% (60th)	—	no fix	2020-03-19	= 4.4.1
CVE-2019-20528US	medium6.1	0.91% (60th)	—	no fix	2020-03-18	= 4.4.1
CVE-2019-15488US	medium6.1	0.91% (59th)	—	4.4.1	2019-08-23	< 4.4.1
CVE-2020-35202US	medium5.4	0.74% (54th)	—	no fix	2020-12-12	= 4.6.0
CVE-2020-35201US	medium5.4	0.74% (54th)	—	no fix	2020-12-12	= 4.6.0
CVE-2017-15911US	medium4.8	0.73% (54th)	—	no fix	2017-10-26	≤ 4.1.6
CVE-2020-24601US	medium6.1	0.62% (49th)	—	no fix	2020-09-02	= 4.5.1
CVE-2020-35199US	medium5.4	0.62% (49th)	—	no fix	2020-12-12	= 4.6.0
CVE-2020-35127US	medium5.4	0.57% (47th)	—	no fix	2020-12-11	= 4.6.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')21 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')5 CVEs
CWE-264CWE-2642 CVEs
CWE-287Improper Authentication2 CVEs
CWE-863Incorrect Authorization2 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-250Execution with Unnecessary Privileges1 CVEs
CWE-273Improper Check for Dropped Privileges1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE37 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan