Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,040All CVEsplus 18,873 rejected
- 732Last 24 hours3,248 in the last 7 days
- 17,396Last 30 days1,557 of them critical
- 1,766Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 52 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 52 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 52 |
| 2023 | 0 | 0 | 3 | 0 | 0 | 3 | 52 |
| 2022 | 0 | 2 | 2 | 0 | 0 | 4 | 49 |
| 2021 | 1 | 4 | 4 | 0 | 0 | 9 | 45 |
| 2020 | 0 | 2 | 2 | 0 | 0 | 4 | 36 |
| 2019 | 2 | 1 | 2 | 0 | 0 | 5 | 32 |
| 2018 | 2 | 8 | 8 | 0 | 0 | 18 | 27 |
| 2017 | 2 | 5 | 2 | 0 | 0 | 9 | 9 |
| Title | ||
|---|---|---|
| CVE-2023-5214 | CVE-2023-5214 - Privilege Escalation in Puppet BoltPuppet · Bolt | Medium6.5 |
| CVE-2023-5255 | Denial of Service for Revocation of Auto Renewed CertificatesPuppet · Puppet Enterprise | Medium4.4 |
| CVE-2023-1894 | A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted…Puppet · Puppet Enterprise | Medium5.3 |
| CVE-2022-3276 | Puppetlabs-mysql Command InjectionPuppet · puppetlabs-mysql | High8.4 |
| CVE-2022-3275 | Puppetlabs-apt Command InjectionPuppet · puppetlabs-apt | High8.4 |
| CVE-2022-2394 | Sensitive Parameter Exposure in Puppet Bolt prior to 3.24Puppet · Bolt | Medium4.1 |
| CVE-2022-0675 | Puppet Firewall Module May Leave Unmanaged RulesPuppet · Firewall Module | Medium5.6 |
| CVE-2021-27023 | A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This…Puppet Enterprise, Puppet Server, Puppet Agent | Critical9.8 |
| CVE-2021-27025 | A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the…Puppet Enterprise, Puppet Agent | Medium6.5 |
| CVE-2021-27026 | A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be loggedPuppet Enterprise, Puppet Connect | Medium4.4 |
| CVE-2021-27024 | A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access a Puppet…Puppet Continuous Delivery for Puppet Enterprise (CD4PE) | High8.1 |
| CVE-2021-27022 | A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should…Puppet Enterprise | Medium4.9 |
| CVE-2021-27018 | The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to…Puppet Remediate | High7.5 |
| CVE-2021-27019 | PuppetDB logging included potentially sensitive system information.PuppetDB, Puppet Enterprise | Medium4.3 |
| CVE-2021-27020 | Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.Puppet Enterprise | High8.8 |
| CVE-2021-27021 | A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.Puppet DB | High8.8 |
| CVE-2020-7945 | Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who should not have access…Continuous Delivery for Puppet Enterprise (CD4PE) | Medium5.5 |
| CVE-2020-7944 | In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can result in the Sensitive…Continuous Delivery for Puppet Enterprise (CD4PE) | High7.7 |
| CVE-2020-7943 | Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like…Puppet Enterprise 2018.1.x stream | High7.5 |
| CVE-2020-7942 | Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate…Puppet · Puppet | Medium6.5 |
| CVE-2018-11751 | Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.Puppet Agent, Puppet | Medium5.4 |
| CVE-2019-10695 | When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password were exposed in the…Continuous Delivery for Puppet Enterprise (CD4PE) | Medium6.5 |
| CVE-2019-10694 | The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they…Puppet Enterprise | Critical9.8 |
| CVE-2018-11747 | Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be…Puppet · Puppet Discovery | Critical9.8 |
| CVE-2018-6517 | Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file…Puppet · Chloride | High7.5 |
| CVE-2018-11752 | Previous releases of the Puppet cisco_ios module output SSH session debug information including login credentials to a world readable file on every run. These… | Medium5.5 |
| CVE-2018-11750 | Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection. As of the 0.4.0 release of cisco_ios,… | Medium6.5 |
| CVE-2018-11748 | Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable. This issue has been resolved… | High7.8 |
| CVE-2018-11749 | When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet…Puppet · Puppet Enterprise | Critical9.8 |
| CVE-2018-11746 | Puppet Discovery can leak authentication informationPuppet · Puppet Discovery | High8.6 |
| CVE-2018-6516 | On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6,…Puppet · pe-client-tools | High7.8 |
| CVE-2018-6515 | Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted…Puppet · Puppet Agent | High7.8 |
| CVE-2018-6514 | In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL…Puppet · Puppet Agent | High7.8 |
| CVE-2018-6513 | Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x…Puppet · Puppet Enterprise and Puppet Agent | High8.8 |
| CVE-2018-6512 | The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet…Puppet · Puppet Enterprise 2018.1.x prior to 2018.1.1, razor-server and pe-razor-server prior to 1.9.0.0 | Critical9.8 |
| CVE-2018-6511 | XSS Vulnerability in Puppet Enterprise ConsolePuppet · Puppet Enterprise | Medium5.4 |
| CVE-2018-6510 | XSS Vulnerability in Puppet Enterprise ConsolePuppet · Puppet Enterprise | Medium5.4 |
| CVE-2018-6508 | Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or…Puppet · Puppet Enterprise | High8.0 |
| CVE-2017-10690 | In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was…Puppet · Puppet Enterprise | Medium6.5 |
| CVE-2017-10689 | In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this…Puppet · Puppet Enterprise | Medium5.5 |
| CVE-2017-2297 | Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been…Puppet · Puppet Enterprise | High7.5 |
| CVE-2017-2296 | In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role…Puppet · Puppet Enterprise | Medium6.5 |
| CVE-2017-2293 | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove…Puppet · Puppet Enterprise | Medium4.9 |
| CVE-2016-5713 | Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet…Puppet · Puppet Agent | Critical9.8 |
| CVE-2017-2299 | Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca`…Puppet · puppetlabs-apache | High7.5 |
| CVE-2016-5716 | The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the…Puppet · Puppet Enterprise | High8.8 |
| CVE-2017-2295 | Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could…Puppet · Puppet server | High8.2 |
| CVE-2017-2294 | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key…Puppet · Puppet Enterprise | High7.5 |
| CVE-2017-2298 | The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised…Puppet · mcollective | Medium6.5 |
| CVE-2017-2292 | Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the…Puppet · mcollective, Puppet, Puppet Enterprise | Critical9.0 |