How many CVEs does SteeltoeOSS have?

SteeltoeOSS has 8 published CVE records since 2024, including 7 in the last two years.

How many SteeltoeOSS CVEs are in CISA KEV?

None of SteeltoeOSS's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which SteeltoeOSS products have the most CVEs?

The SteeltoeOSS products with the most published CVEs are steeltoe, Steeltoe.Management.Endpoint, Steeltoe.Management.EndpointCore, Steeltoe.Discovery.Eureka, Steeltoe.Discovery.ClientAutofac.

What are the most common weakness types in SteeltoeOSS CVEs?

SteeltoeOSS's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-269 (Improper Privilege Management), CWE-312 (Cleartext Storage of Sensitive Information), CWE-327 (Use of a Broken or Risky Cryptographic Algorithm).

Are there public exploits for SteeltoeOSS vulnerabilities?

Yes — 1 of SteeltoeOSS's CVEs have a known public exploit.

What is the average severity of SteeltoeOSS CVEs?

The average CVSS base score across SteeltoeOSS's scored CVEs is 5.5.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

8 CVEs

SteeltoeOSS Vulnerabilities

Name: SteeltoeOSS vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for SteeltoeOSS.

8

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

1

Public exploits

PoC or exploit code

5.5

Avg CVSS

2024–2026

Overview

SteeltoeOSS has 8 published CVE records since 2024, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 5.5.

This page aggregates every publicly disclosed vulnerability (CVE) affecting SteeltoeOSS products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on SteeltoeOSS's vulnerability posture, as a share of its 8 published CVEs.

Average CVSS: 5.5
Critical / high: 38%
Actively exploited (KEV): 0%
Public exploit available: 13%
Patch available: 100%

Severity and exploitation

How the CVSS severity of SteeltoeOSS's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High3

Medium3

Low2

In CISA’s Known Exploited Vulnerabilities catalog

0

None of SteeltoeOSS's CVEs are currently listed in CISA's KEV catalog.

Public exploits

1

One of SteeltoeOSS's CVEs has a known public exploit available.

Most affected products

The SteeltoeOSS products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in SteeltoeOSS CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish SteeltoeOSS CVE records.

GitHub_M8 CVEs

Disclosure activity by year

How many SteeltoeOSS CVEs were published each year.

2024

1

2026

7

Latest SteeltoeOSS CVEs

The most recently disclosed vulnerabilities affecting SteeltoeOSS.

Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
CWE-327
Low · CVSS 1.9
EPSS 0.0%2026-06-17
Steeltoe: TLS private keys written to /tmp with default permissions, never deleted
CWE-312
Medium · CVSS 4.7
EPSS 0.1%2026-06-17
Steeltoe's static JWKS cache shared across schemes and never invalidated
CWE-668
Medium · CVSS 5.9
EPSS 0.3%2026-06-17
Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission
CWE-269
Medium · CVSS 6.5
EPSS 0.2%2026-06-17
Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
CWE-200
High · CVSS 7.5
EPSS 0.2%2026-06-17
Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch
CWE-400
High · CVSS 7.5
EPSS 0.3%2026-06-17
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
CWE-639
High · CVSS 8.2
EPSS 0.2%2026-06-17
Low vulnerability · 2024-07-17
CWE-532
Low · CVSS 2.0
EPSS 0.4%2024-07-17

Track new SteeltoeOSS CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor SteeltoeOSS CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

microsoft25,696 CVEs linux21,056 CVEs Google15,680 CVEs Apple14,957 CVEs Oracle11,815 CVEs Debian10,221 CVEs IBM8,381 CVEs Red Hat7,837 CVEs

Browse all vendors

Frequently asked questions

Common questions about SteeltoeOSS vulnerabilities.

How many CVEs does SteeltoeOSS have?: SteeltoeOSS has 8 published CVE records since 2024, including 7 in the last two years.
How many SteeltoeOSS CVEs are in CISA KEV?: None of SteeltoeOSS's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which SteeltoeOSS products have the most CVEs?: The SteeltoeOSS products with the most published CVEs are steeltoe, Steeltoe.Management.Endpoint, Steeltoe.Management.EndpointCore, Steeltoe.Discovery.Eureka, Steeltoe.Discovery.ClientAutofac.
What are the most common weakness types in SteeltoeOSS CVEs?: SteeltoeOSS's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-269 (Improper Privilege Management), CWE-312 (Cleartext Storage of Sensitive Information), CWE-327 (Use of a Broken or Risky Cryptographic Algorithm).
Are there public exploits for SteeltoeOSS vulnerabilities?: Yes — 1 of SteeltoeOSS's CVEs have a known public exploit.
What is the average severity of SteeltoeOSS CVEs?: The average CVSS base score across SteeltoeOSS's scored CVEs is 5.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track SteeltoeOSS vulnerabilities

Monitor new SteeltoeOSS vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing