Select Profile Benchmark
Top 5 Priorities for University Main Web Infrastructure
1
URGENT
CVE-2026-32475
Critical Arbitrary File Upload and Unauthenticated Remote Code Execution in E...
Why: The organisation uses elementor_pro, which is affected by CVE-2026-32475. CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 97.8% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Action: Review the vendor advisory for CVE-2026-32475 and assess whether patching or compensating controls are appropriate for your environment. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-32475
2
URGENT
CVE-2024-23897
Arbitrary file read vulnerability in Jenkins CLI command parser
Why: The organisation uses jenkins, which is affected by CVE-2024-23897. CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 96.4% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Action: Review the vendor advisory for CVE-2024-23897 and assess whether patching or compensating controls are appropriate for your environment. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-23897
3
URGENT
CVE-2023-38606
Unauthenticated Remote Code Execution in Apache OFBiz before 18
Why: The organisation uses ofbiz, which is affected by CVE-2023-38606. CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 88.4% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Action: Review the vendor advisory for CVE-2023-38606 and assess whether patching or compensating controls are appropriate for your environment. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-38606
4
URGENT
CVE-2023-44487
HTTP/2 Rapid Reset attack leading to Denial of Service across web servers
Why: The organisation uses nginx, which is affected by CVE-2023-44487. CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 89.1% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Action: Review the vendor advisory for CVE-2023-44487 and assess whether patching or compensating controls are appropriate for your environment. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-44487
5
EXCLUDED
CVE-2023-22515
Privilege escalation vulnerability in Atlassian Confluence Data Center and Se...
Why: CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 97.1% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Action: Review CVE-2023-22515 and confirm whether confluence_data_center is in use.
Excluded High-CVSS (Negative Test)
CVE-2023-22515
CVE-2023-22515 has a CVSS score of 10.0 but was excluded because the organisation does not use confluence_data_center. A high CVSS score alone does not make a vulnerability relevant.
CVE-2021-44228
CVE-2021-44228 has a CVSS score of 10.0 but was excluded because the organisation does not use log4j. A high CVSS score alone does not make a vulnerability relevant.
CVE-2020-1472
CVE-2020-1472 has a CVSS score of 10.0 but was excluded because the organisation does not use netlogon. A high CVSS score alone does not make a vulnerability relevant.
CVE-2023-20198
CVE-2023-20198 has a CVSS score of 10.0 but was excluded because the organisation does not use ios_xe. A high CVSS score alone does not make a vulnerability relevant.
CVE-2023-22527
CVE-2023-22527 has a CVSS score of 10.0 but was excluded because the organisation does not use confluence_data_center. A high CVSS score alone does not make a vulnerability relevant.