CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 3:23 PM ET)

What this means for you

This week: 3,210 CVEs published, 239 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,210; Show in the list
Critical, last 7 days: 239; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,760; Show in the list

Showing CVEs that name the product systemd_project:systemd. Show all products

16 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2020-1712	High 7.8	A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. Assigned by redhat	Mar 31, 2020
CVE-2020-13776	Medium 6.7	systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user acc… Assigned by mitre	Jun 2, 2020
CVE-2020-13529	Medium 6.1	An exploitable denial-of-service vulnerability exists in Systemd 245. Assigned by talos	May 10, 2021
CVE-2021-33910	Medium 5.5	basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker)… Assigned by mitre	Jul 20, 2021
CVE-2021-3997	Medium 5.5	A flaw was found in systemd. Assigned by redhat	Aug 22, 2022
CVE-2022-3821	Medium 5.5	An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. Assigned by redhat	Nov 7, 2022
CVE-2022-45873	Medium 5.5	systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. Assigned by mitre	Nov 22, 2022
CVE-2023-26604	High 7.8	systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Assigned by mitre	Mar 2, 2023
CVE-2023-7008	Medium 5.9	Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes Assigned by redhat	Dec 23, 2023
CVE-2026-29111	Medium 5.5	systemd: Local unprivileged user can trigger an assert Assigned by GitHub_M	Mar 23, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.