# CVSS v3.0: Scored by HackerOne CVEs with a CVSS v3.0 score from HackerOne. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/metrics-cvss-metric-v30-source/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs with a CVSS v3.0 score from HackerOne. Example 1 of 16 in **Filters › CVSS v3.0** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `metrics.cvss_metric_v30.source` · `operator` `wildcard` `metrics.cvss_metric_v30.source` is the organization that supplied it, as an e-mail address or a UUID, in the CVSS v3.0 metric (`metrics.cvss_metric_v30`, one entry per scoring source). `wildcard` matches the pattern `*@hackerone.com`: `*` stands for any characters. In the response, look at `results[].metrics.cvss_metric_v30[].source`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `metrics.cvss_metric_v30.source` | | `filters.must[0].type` | body | `wildcard` | | `filters.must[0].value` | body | `*@hackerone.com` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "metrics.cvss_metric_v30.source", "type": "wildcard", "value": "*@hackerone.com" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown; results[].enrichment.cwe[].capec_id: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 370, "results": [ { "id": "CVE-2026-21636", "source_identifier": "support@hackerone.com", "published": "2026-01-20T21:16:05Z", "last_modified": "2026-06-17T10:18:51Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.\n\n* The issue affects users of the Node.js permission model on version v25.\n\nIn the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase." }, { "lang": "es", "value": "Una falla en el modelo de permisos de Node.js permite que las conexiones de Unix Domain Socket (UDS) eludan las restricciones de red cuando '--permission' está habilitado. Incluso sin '--allow-net', las entradas controladas por el atacante (como URLs u opciones de socketPath) pueden conectarse a sockets locales arbitrarios a través de net, tls o undici/fetch. Esto rompe el límite de seguridad previsto del modelo de permisos y permite el acceso a servicios locales privilegiados, lo que podría llevar a escalada de privilegios, exposición de datos o ejecución de código local.\n\n* El problema afecta a los usuarios del modelo de permisos de Node.js en la versión v25.\n\nEn el momento de esta vulnerabilidad, los permisos de red ('--allow-net') todavía están en fase experimental." } ], "references": [ { "url": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", "source": "support@hackerone.com", "tags": [ "Release Notes", "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": [ { "source": "support@hackerone.com", "type": "Secondary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "LOW", "integrity_impact": "NONE", "availability_impact": "NONE", "base_score": 5.8, "base_severity": "MEDIUM", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 1.4 } ], "cvss_metric_v2": null }, "weaknesses": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-284" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "match_criteria_id": "970EF154-D905-4FDA-85CB-C3AB08BEFAEC", "version_start_including": "25.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "25.3.0" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "vendor": "nodejs", "product": "node.js", "product_type": "a", "vulnerable": true, "version_start_including": "25.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "25.3.0", "affected_versions_first": null, "affected_versions_last": null } ], "cwe": [ { "id": 284, "owasptop10_2021": "A01 Broken Access Control", "name": "Improper Access Control", "description": "The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.", "capec_id": [ 19, 441, 478, 479, 502, 503, 536, 546, 550, 551 ], "scope": [ "Other" ], "impact": [ "Varies by Context" ], "detection_method": null } ], "epss_score": { "epss": 0.00883, "percentile": 0.57681, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "3.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2025-23123", "source_identifier": "support@hackerone.com", "published": "2025-05-19T02:15:17Z", "last_modified": "2026-06-17T08:52:11Z", "status": "Deferred", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vulnerability in the UniFi Protect Cameras (Version 4.75.43 and earlier) firmware." }, { "lang": "es", "value": "Un actor malicioso con acceso a la red de administración podría ejecutar una ejecución remota de código (RCE) explotando una vulnerabilidad de desbordamiento de búfer de montón en el firmware de las cámaras UniFi Protect (versión 4.75.43 y anteriores)." } ], "references": [ { "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-047-047/cef86c37-7421-44fd-b251-84e76475a5bc", "source": "support@hackerone.com", "tags": null } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": null, "cvss_metric_v30": [ { "source": "support@hackerone.com", "type": "Secondary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v2": null }, "weaknesses": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-122" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 122, "owasptop10_2021": null, "name": "Heap-based Buffer Overflow", "description": "A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().", "capec_id": [ 92 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Other" ], "impact": [ "Bypass Protection Mechanism", "DoS: Crash, Exit, or Restart", "DoS: Resource Consumption (CPU)", "DoS: Resource Consumption (Memory)", "Execute Unauthorized Code or Commands", "Modify Memory", "Other" ], "detection_method": [ "Automated Dynamic Analysis", "Fuzzing" ] } ], "epss_score": { "epss": 0.01124, "percentile": 0.64864, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.0" ], "source": "support@hackerone.com", "type": "Secondary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2024-42450", "source_identifier": "support@hackerone.com", "published": "2024-11-19T18:15:20Z", "last_modified": "2026-09-03T18:22:14Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default configuration has a common password across all instances of Versa Director. By default, Versa Director configures Postgres to listen on all network interfaces. This combination allows an unauthenticated attacker to access and administer the database or read local filesystem contents to escalate privileges on the system. \n\nExploitation Status:\nVersa Networks is not aware of this exploitation in any production systems. A proof of concept exists in the lab environment.\n\nWorkarounds or Mitigation:\nStarting with the latest 22.1.4 version of Versa Director, the software will automatically restrict access to the Postgres and HA ports to only the local and peer Versa Directors. For older releases, Versa recommends performing manual hardening of HA ports. Please refer to the following link for the steps https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Secure_HA_Ports \n\nThis vulnerability is not exploitable on Versa Directors if published Firewall guidelines are implemented. We have validated that no Versa-hosted head ends have been affected by this vulnerability. All Versa-hosted head ends are patched and hardened. \n\nPlease contact Versa Technical Support or Versa account team for any further assistance.\n\nSoftware Download Links:\n22.1.4: https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4" }, { "lang": "es", "value": "Versa Director utiliza PostgreSQL (Postgres) para almacenar datos operativos y de configuración. También es necesario para la función de alta disponibilidad de Versa Director. La configuración predeterminada tiene una contraseña común en todas las instancias de Versa Director. De forma predeterminada, Versa Director configura Postgres para escuchar en todas las interfaces de red. Esta combinación permite que un atacante no autenticado acceda y administre la base de datos o lea el contenido del sistema de archivos local para aumentar los privilegios en el sistema. Estado de explotación: Versa Networks no tiene conocimiento de esta explotación en ningún sistema de producción. Existe una prueba de concepto en el entorno de laboratorio. Soluciones alternativas o mitigación: a partir de la última versión 22.1.4 de Versa Director, el software restringirá automáticamente el acceso a los puertos Postgres y HA solo a los Versa Directors locales y de pares. Para versiones anteriores, Versa recomienda realizar un fortalecimiento manual de los puertos HA. Consulte el siguiente enlace para conocer los pasos https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Secure_HA_Ports Esta vulnerabilidad no se puede explotar en Versa Directors si se implementan las pautas de firewall publicadas. Hemos validado que ninguna de las cabeceras alojadas en Versa se haya visto afectada por esta vulnerabilidad. Todas las cabeceras alojadas en Versa están parcheadas y reforzadas. Comuníquese con el soporte técnico de Versa o con el equipo de cuentas de Versa para obtener más ayuda. Enlaces de descarga de software: 22.1.4: https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4" } ], "references": [ { "url": "https://security-portal.versa-networks.com/emailbulletins/6735a300415abb89e9a8a9d3", "source": "support@hackerone.com", "tags": [ "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": [ { "source": "support@hackerone.com", "type": "Secondary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v2": null }, "weaknesses": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-798" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:versa-networks:versa_director:21.2.2:*:*:*:*:*:*:*", "match_criteria_id": "59E2F7B6-200B-4008-A5C6-FD33B05DFF8F", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:versa-networks:versa_director:21.2.3:*:*:*:*:*:*:*", "match_criteria_id": "DD6E1984-CC7D-47FB-9469-506D5B9B7764", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:versa-networks:versa_director:22.1.1:*:*:*:*:*:*:*", "match_criteria_id": "BE334340-8D19-4A10-AB58-B9028D96851C", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:versa-networks:versa_director:22.1.2:*:*:*:*:*:*:*", "match_criteria_id": "B6870728-68E3-4B20-8846-184623B95B56", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:versa-networks:versa_director:22.1.3:*:*:*:*:*:*:*", "match_criteria_id": "F42DE9E0-BECA-413B-9CEA-DA8C2CAAAD11", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:versa-networks:versa_director:22.1.4:-:*:*:*:*:*:*", "match_criteria_id": "272A25D5-8B29-4919-9C8A-D36DE8B592BF", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:versa-networks:versa_director:21.2.2:*:*:*:*:*:*:*", "vendor": "versa-networks", "product": "versa_director", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "21.2.2", "affected_versions_last": "21.2.2" }, { "criteria": "cpe:2.3:a:versa-networks:versa_director:21.2.3:*:*:*:*:*:*:*", "vendor": "versa-networks", "product": "versa_director", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "21.2.3", "affected_versions_last": "21.2.3" }, { "criteria": "cpe:2.3:a:versa-networks:versa_director:22.1.1:*:*:*:*:*:*:*", "vendor": "versa-networks", "product": "versa_director", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "22.1.1", "affected_versions_last": "22.1.1" }, { "criteria": "cpe:2.3:a:versa-networks:versa_director:22.1.2:*:*:*:*:*:*:*", "vendor": "versa-networks", "product": "versa_director", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "22.1.2", "affected_versions_last": "22.1.2" }, { "criteria": "cpe:2.3:a:versa-networks:versa_director:22.1.3:*:*:*:*:*:*:*", "vendor": "versa-networks", "product": "versa_director", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "22.1.3", "affected_versions_last": "22.1.3" }, { "criteria": "cpe:2.3:a:versa-networks:versa_director:22.1.4:-:*:*:*:*:*:*", "vendor": "versa-networks", "product": "versa_director", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "22.1.4", "affected_versions_last": "22.1.4" } ], "cwe": [ { "id": 798, "owasptop10_2021": "A07 Identification and Authentication Failures", "name": "Use of Hard-coded Credentials", "description": "The product contains hard-coded credentials, such as a password or cryptographic key.", "capec_id": [ 70, 191 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Other" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Gain Privileges or Assume Identity", "Other", "Read Application Data" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Black Box", "Dynamic Analysis with Manual Results Interpretation", "Manual Dynamic Analysis", "Manual Static Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.00584, "percentile": 0.46649, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "3.0" ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [CVSS v3.1: Scored by Microsoft](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-source/) - [CVSS v2: Scored by the NVD](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-source/) - [References Added by Red Hat](/reference/vulnerability/search/examples/references-source/) - [KEV Names With Remote Code Execution](/reference/vulnerability/search/examples/cisa-vulnerability-name/) - [CVSS 4.0: Scored by VulnCheck](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-source/) - [CVEs Published by the Apache Software Foundation](/reference/vulnerability/search/examples/source-identifier/)