CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 11:10 AM ET)

What this means for you

This week: 3,174 CVEs published, 239 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,174; Show in the list
Critical, last 7 days: 239; Show in the list
Healthcare-tagged, last 7 days: 8; Show in the list
Known exploited (CISA KEV): 1,760; Show in the list

Showing CVEs that name the product systemd_project:systemd. Show all products

16 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-40228	Low 2.9	In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set. Assigned by mitre	Apr 10, 2026
CVE-2026-40227	Medium 6.2	In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element. Assigned by mitre	Apr 10, 2026
CVE-2026-40226	Medium 6.4	In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file. Assigned by mitre	Apr 10, 2026
CVE-2026-40225	Medium 6.4	In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output. Assigned by mitre	Apr 10, 2026
CVE-2026-40224	Medium 6.7	In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace. Assigned by mitre	Apr 10, 2026
CVE-2026-40223	Medium 4.7	In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running. Assigned by mitre	Apr 10, 2026
CVE-2026-29111	Medium 5.5	systemd: Local unprivileged user can trigger an assert Assigned by GitHub_M	Mar 23, 2026
CVE-2023-7008	Medium 5.9	Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes Assigned by redhat	Dec 23, 2023
CVE-2023-26604	High 7.8	systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Assigned by mitre	Mar 2, 2023
CVE-2022-45873	Medium 5.5	systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. Assigned by mitre	Nov 22, 2022

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.