Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,744All CVEsplus 19,170 rejected
- 378Last 24 hours4,864 in the last 7 days
- 16,922Last 30 days1,491 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 10 | 4 | 1 | 0 | 0 | 15 | 34 |
| 2025 | 0 | 2 | 3 | 0 | 0 | 5 | 19 |
| 2024 | 3 | 1 | 2 | 0 | 0 | 6 | 14 |
| 2023 | 1 | 1 | 6 | 0 | 0 | 8 | 8 |
| Title | ||
|---|---|---|
| CVE-2026-103093 | Sandbox Escape via Table Rotation in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | Critical9.4 |
| CVE-2026-6877 | Domain Separation Bypass in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | Medium5.3 |
| CVE-2026-103094 | Cleartext Storage of OAuth Credentials in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | High7.1 |
| CVE-2026-86860 | Unauthenticated Sensitive Data Disclosure in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | Critical9.3 |
| CVE-2026-86859 | Unauthenticated Arbitrary Record Disclosure in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | High8.7 |
| CVE-2026-13016 | Unauthenticated SQL Injection in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | Critical9.3 |
| CVE-2026-86858 | Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | High8.7 |
| CVE-2026-86857 | Authorization Bypass in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | High8.4 |
| CVE-2026-74820 | Unauthenticated SQL Injection via Dynamic Schema ORDER BY ClauseServiceNow · ServiceNow AI Platform | Critical10.0 |
| CVE-2026-18886 | Unauthenticated Privilege Escalation via System Configuration Image Upload ProcessorServiceNow · ServiceNow AI Platform | Critical10.0 |
| CVE-2026-18885 | Unauthenticated Remote Code Execution in GraphQL Composite Data APIServiceNow · ServiceNow AI Platform | Critical10.0 |
| CVE-2026-6876 | Sandbox Escape in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | Critical10.0 |
| CVE-2026-6875 | Sandbox Escape in ServiceNow AI PlatformPublic exploitServiceNow · ServiceNow AI Platform | Critical9.5 |
| CVE-2026-0542 | Remote Code Execution in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | Critical9.2 |
| CVE-2025-12420 | Unauthenticated Privilege Escalation in ServiceNow AI PlatformServiceNow · Now Assist AI Agents | Critical9.3 |
| CVE-2025-11449 | Reflected Cross Site Scripting in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | Medium5.3 |
| CVE-2025-11450 | Reflected Cross Site Scripting in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | Medium5.3 |
| CVE-2025-3089 | Broken Access Control in ServiceNow AI PlatformServiceNow · ServiceNow AI Platform | Medium5.3 |
| CVE-2025-3648 | Data Inference in Now Platform via Conditional ACLsServiceNow · Now Platform | High8.2 |
| CVE-2025-0337 | Authorization bypass in Now PlatformServiceNow · Now Platform | High7.1 |
| CVE-2024-5890 | HTML Injection in the Assessment pluginServiceNow · Now Platform | Medium5.1 |
| CVE-2024-8924 | Unauthenticated Blind SQL Injection in Core PlatformServiceNow · Now Platform | High8.7 |
| CVE-2024-8923 | Sandbox Escape in Now PlatformServiceNow · Now Platform | Critical9.3 |
| CVE-2024-5217 | Incomplete Input Validation in GlideExpression ScriptExploitedPublic exploitServiceNow · Now Platform | Critical9.2 |
| CVE-2024-5178 | Incomplete Input Validation in SecurelyAccess APIServiceNow · Now Platform | Medium6.9 |
| CVE-2024-4879 | Jelly Template Injection Vulnerability in ServiceNow UI MacrosExploitedPublic exploitServiceNow · Now Platform | Critical9.3 |
| CVE-2023-3442 | Missing Authorization in Jenkins plug-in for ServiceNow DevOpsServiceNow · Jenkins plug-in for ServiceNow DevOps | High7.7 |
| CVE-2023-3414 | Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOpsServiceNow · Jenkins plug-in for ServiceNow DevOps | Medium6.1 |
| CVE-2023-1298 | ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris…ServiceNow · Now User Experience | Medium4.3 |
| CVE-2022-43684 | ACL bypass in Reporting functionalityServiceNow · Now Platform | Critical9.9 |
| CVE-2023-1209 | Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts.ServiceNow · ServiceNow Records | Medium4.3 |
| CVE-2022-46389 | Cross-Site Scripting (XSS) vulnerability found on logout functionalityServiceNow · Now Platform | Medium6.1 |
| CVE-2022-46886 | There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when…ServiceNow · ServiceNow | Medium5.5 |
| CVE-2022-39048 | Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirectPublic exploitServicenow · Now Platform | Medium6.1 |