puppetlabs puppet

Name: puppetlabs puppet
Brand: puppetlabs

productUS

cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

critical

by severity

0critical4high16medium9low

updated 2026-10-28

vulnerabilities (29)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2011-3872US	low2.6	2.52% (85th)	Exploit	no fix	2011-10-27	2 versions
CVE-2013-1653US	high7.1	5.38% (93rd)	—	no fix	2013-03-20	13 versions
CVE-2013-1655US	high7.5	4.56% (92nd)	—	no fix	2013-03-20	4 versions
CVE-2013-3567US	high7.5	3.41% (89th)	—	no fix	2013-08-19	11 versions
CVE-2013-1654US	medium5.0OT elevated	2.95% (87th)	—	no fix	2013-03-20	4 versions
CVE-2013-2274US	medium6.5	2.91% (87th)	—	no fix	2013-03-20	= 2.6.17
CVE-2013-2275US	medium4.0	2.91% (87th)	—	no fix	2013-03-20	6 versions
CVE-2012-3867US	medium4.3	2.45% (84th)	—	no fix	2012-08-06	3 versions
CVE-2012-3864US	medium4.0	1.91% (80th)	—	no fix	2012-08-06	3 versions
CVE-2012-3865US	low3.5	1.88% (79th)	—	no fix	2012-08-06	4 versions
CVE-2013-1652US	medium4.9	1.86% (79th)	—	no fix	2013-03-20	6 versions
CVE-2013-4761US	medium5.1	1.64% (76th)	—	no fix	2013-08-20	3 versions
CVE-2012-3408US	low2.6	1.64% (76th)	—	2.7.18	2012-08-06	< 2.7.18
CVE-2013-1398US	high8.5	1.54% (75th)	—	no fix	2014-03-14	2 versions
CVE-2012-1986US	low2.1	1.45% (73rd)	—	no fix	2012-05-29	2 versions
CVE-2013-2716US	medium5.0	1.32% (71st)	—	no fix	2013-04-10	5 versions
CVE-2011-3848US	medium5.0	1.11% (66th)	—	no fix	2011-10-27	2 versions
CVE-2012-5158US	medium4.0	0.81% (57th)	—	no fix	2014-03-14	= 2.5.0
CVE-2013-1399US	medium6.8	0.60% (49th)	—	no fix	2014-03-14	2 versions
CVE-2012-3866US	low2.1	0.48% (41st)	—	no fix	2012-08-06	3 versions
CVE-2013-4969US	low2.1	0.43% (37th)	—	3.4.1	2014-01-07	2 versions
CVE-2012-1989US	low3.6	0.40% (34th)	—	no fix	2012-06-27	2 versions
CVE-2012-1053US	medium6.9	0.38% (32nd)	—	no fix	2012-05-29	2 versions
CVE-2013-4956US	low3.6	0.38% (32nd)	—	no fix	2013-08-20	3 versions
CVE-2012-1054US	medium4.4	0.37% (30th)	—	no fix	2012-05-29	2 versions
CVE-2011-3870US	medium6.3	0.35% (29th)	—	no fix	2011-10-27	2 versions
CVE-2012-1906US	low3.3	0.35% (28th)	—	no fix	2012-05-29	2 versions
CVE-2011-3869US	medium6.3	0.34% (27th)	—	no fix	2011-10-27	2 versions
CVE-2011-3871US	medium6.2	0.34% (27th)	—	no fix	2011-10-27	2 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-264CWE-26410 CVEs
CWE-20Improper Input Validation3 CVEs
CWE-59Improper Link Resolution Before File Access ('Link Following')3 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')3 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-287Improper Authentication2 CVEs
CWE-310CWE-3102 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE29 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan