Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,242All CVEsplus 18,875 rejected
- 808Last 24 hours3,111 in the last 7 days
- 17,419Last 30 days1,568 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 37 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 37 |
| 2024 | 0 | 0 | 1 | 0 | 0 | 1 | 37 |
| 2023 | 1 | 0 | 4 | 0 | 0 | 5 | 36 |
| 2022 | 0 | 2 | 2 | 0 | 0 | 4 | 31 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 27 |
| 2020 | 0 | 0 | 1 | 0 | 0 | 1 | 27 |
| 2019 | 1 | 1 | 0 | 0 | 0 | 2 | 26 |
| 2018 | 2 | 7 | 6 | 0 | 0 | 15 | 24 |
| 2017 | 2 | 5 | 2 | 0 | 0 | 9 | 9 |
| Title | ||
|---|---|---|
| CVE-2024-9160 | Security Misconfiguration in Forge module PEADMPuppet · PEADM Forge Module | Medium5.4 |
| CVE-2023-5309 | Broken Session Management in Puppet EnterprisePuppet · Puppet Enterprise | Medium6.8 |
| CVE-2023-5214 | CVE-2023-5214 - Privilege Escalation in Puppet BoltPuppet · Bolt | Medium6.5 |
| CVE-2023-5255 | Denial of Service for Revocation of Auto Renewed CertificatesPuppet · Puppet Enterprise | Medium4.4 |
| CVE-2023-2530 | A privilege escalation allowing remote code execution was discovered in the orchestration service.Puppet · Puppet Enterprise | Critical9.8 |
| CVE-2023-1894 | A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted…Puppet · Puppet Enterprise | Medium5.3 |
| CVE-2022-3276 | Puppetlabs-mysql Command InjectionPuppet · puppetlabs-mysql | High8.4 |
| CVE-2022-3275 | Puppetlabs-apt Command InjectionPuppet · puppetlabs-apt | High8.4 |
| CVE-2022-2394 | Sensitive Parameter Exposure in Puppet Bolt prior to 3.24Puppet · Bolt | Medium4.1 |
| CVE-2022-0675 | Puppet Firewall Module May Leave Unmanaged RulesPuppet · Firewall Module | Medium5.6 |
| CVE-2020-7942 | Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate…Puppet · Puppet | Medium6.5 |
| CVE-2018-11747 | Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be…Puppet · Puppet Discovery | Critical9.8 |
| CVE-2018-6517 | Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file…Puppet · Chloride | High7.5 |
| CVE-2018-11749 | When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet…Puppet · Puppet Enterprise | Critical9.8 |
| CVE-2018-11746 | Puppet Discovery can leak authentication informationPuppet · Puppet Discovery | High8.6 |
| CVE-2018-6516 | On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6,…Puppet · pe-client-tools | High7.8 |
| CVE-2018-6515 | Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted…Puppet · Puppet Agent | High7.8 |
| CVE-2018-6514 | In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL…Puppet · Puppet Agent | High7.8 |
| CVE-2018-6513 | Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x…Puppet · Puppet Enterprise and Puppet Agent | High8.8 |
| CVE-2018-6512 | The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet…Puppet · Puppet Enterprise 2018.1.x prior to 2018.1.1, razor-server and pe-razor-server prior to 1.9.0.0 | Critical9.8 |
| CVE-2018-6511 | XSS Vulnerability in Puppet Enterprise ConsolePuppet · Puppet Enterprise | Medium5.4 |
| CVE-2018-6510 | XSS Vulnerability in Puppet Enterprise ConsolePuppet · Puppet Enterprise | Medium5.4 |
| CVE-2018-6508 | Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or…Puppet · Puppet Enterprise | High8.0 |
| CVE-2017-10690 | In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was…Puppet · Puppet Enterprise | Medium6.5 |
| CVE-2017-10689 | In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this…Puppet · Puppet Enterprise | Medium5.5 |
| CVE-2017-2297 | Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been…Puppet · Puppet Enterprise | High7.5 |
| CVE-2017-2296 | In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role…Puppet · Puppet Enterprise | Medium6.5 |
| CVE-2017-2293 | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove…Puppet · Puppet Enterprise | Medium4.9 |
| CVE-2016-5713 | Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet…Puppet · Puppet Agent | Critical9.8 |
| CVE-2017-2299 | Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca`…Puppet · puppetlabs-apache | High7.5 |
| CVE-2016-5716 | The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the…Puppet · Puppet Enterprise | High8.8 |
| CVE-2017-2295 | Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could…Puppet · Puppet server | High8.2 |
| CVE-2017-2294 | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key…Puppet · Puppet Enterprise | High7.5 |
| CVE-2017-2298 | The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised…Puppet · mcollective | Medium6.5 |
| CVE-2017-2292 | Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the…Puppet · mcollective, Puppet, Puppet Enterprise | Critical9.0 |
| CVE-2017-2290 | On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with…Puppet · mcollective-puppet-agent plugin | High8.8 |
| CVE-2016-9686 | The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing…Puppet · Puppet Enterprise | Medium5.3 |