What’s Vulnerable › Products

Puppet Enterprise vulnerabilities

91 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your Puppet Enterprise version is affected

Latest Puppet Enterprise vulnerabilities

• CVE-2026-8804 — Cleartext Storage of Sensitive Information for Puppet Resource API (CVSS 6.7)
• CVE-2025-10360 — Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5 (CVSS 6.9)
• CVE-2025-5459 — OS Command Injection (CVSS 8.8)
• CVE-2023-5309 — Broken Session Management in Puppet Enterprise (CVSS 9.8)
• CVE-2023-5255 — Denial of Service for Revocation of Auto Renewed Certificates (CVSS 7.5)
• CVE-2023-2530 — (CVSS 9.8)
• CVE-2023-1894 — (CVSS 5.3)
• CVE-2021-27026 — (CVSS 4.4)
• CVE-2021-27025 — (CVSS 6.5)
• CVE-2021-27023 — (CVSS 9.8)
• CVE-2021-27022 — (CVSS 4.9)
• CVE-2021-27020 — (CVSS 8.8)
• CVE-2021-27019 — (CVSS 4.3)
• CVE-2021-27021 — (CVSS 8.8)
• CVE-2020-7943 — (CVSS 7.5)
• CVE-2015-5686 — (CVSS 8.8)
• CVE-2019-10694 — (CVSS 9.8)
• CVE-2013-4968 — (CVSS 6.1)
• CVE-2015-1855 — (CVSS 5.9)
• CVE-2018-11749 — (CVSS 9.8)
• CVE-2018-6513 — (CVSS 8.8)
• CVE-2018-6512 — (CVSS 9.8)
• CVE-2018-6511 — XSS Vulnerability in Puppet Enterprise Console (CVSS 5.4)
• CVE-2018-6510 — XSS Vulnerability in Puppet Enterprise Console (CVSS 5.4)
• CVE-2018-6508 — (CVSS 8.0)