Skip to content
Servicenow vulnerabilities
Newest
-
servicenow ai platform
Sandbox Escape via Table Rotation in ServiceNow AI Platform
CVE-2026-103093
9.4 Critical
-
servicenow ai platform
Domain Separation Bypass in ServiceNow AI Platform
CVE-2026-6877
5.3 Medium
-
servicenow ai platform
Cleartext Storage of OAuth Credentials in ServiceNow AI Platform
CVE-2026-103094
7.1 High
-
servicenow ai platform
Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform
CVE-2026-86860
9.3 Critical
-
servicenow ai platform
Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform
CVE-2026-86859
8.7 High
-
servicenow ai platform
Unauthenticated SQL Injection in ServiceNow AI Platform
CVE-2026-13016
9.3 Critical
-
servicenow ai platform
Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform
CVE-2026-86858
8.7 High
-
servicenow ai platform
Authorization Bypass in ServiceNow AI Platform
CVE-2026-86857
8.4 High
-
servicenow ai platform
Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause
CVE-2026-74820
10.0 Critical
-
servicenow ai platform
Unauthenticated Privilege Escalation via System Configuration Image Upload Processor
CVE-2026-18886
10.0 Critical
-
servicenow ai platform
Unauthenticated Remote Code Execution in GraphQL Composite Data API
CVE-2026-18885
10.0 Critical
-
servicenow ai platform
Sandbox Escape in ServiceNow AI Platform
CVE-2026-6876
10.0 Critical
-
servicenow ai platform
Sandbox Escape in ServiceNow AI Platform
CVE-2026-6875
Public exploit
9.5 Critical
-
servicenow ai platform
Remote Code Execution in ServiceNow AI Platform
CVE-2026-0542
Public exploit
9.2 Critical
-
servicenow now assist ai agents, virtual agent api +1 more
Unauthenticated Privilege Escalation in ServiceNow AI Platform
CVE-2025-12420
Public exploit
EPSS 53.2%
9.3 Critical
-
servicenow ai platform
Reflected Cross Site Scripting in ServiceNow AI Platform
CVE-2025-11449
Public exploit
5.3 Medium
-
servicenow ai platform
Reflected Cross Site Scripting in ServiceNow AI Platform
CVE-2025-11450
5.3 Medium
-
servicenow ai platform
Broken Access Control in ServiceNow AI Platform
CVE-2025-3089
5.3 Medium
-
servicenow now platform
Data Inference in Now Platform via Conditional ACLs
CVE-2025-3648
8.2 High
-
servicenow now platform
Authorization bypass in Now Platform
CVE-2025-0337
7.1 High
-
servicenow now platform
HTML Injection in the Assessment plugin
CVE-2024-5890
5.1 Medium
-
servicenow now platform, servicenow +1 more
Unauthenticated Blind SQL Injection in Core Platform
CVE-2024-8924
8.7 High
-
servicenow now platform, servicenow +1 more
Sandbox Escape in Now Platform
CVE-2024-8923
9.3 Critical
-
servicenow now platform, servicenow, servicenow utah, vancouver, and washington dc now platform +2 more
Incomplete Input Validation in GlideExpression Script
CVE-2024-5217
In KEV
EPSS 99.6%
9.2 Critical
-
servicenow now platform
Incomplete Input Validation in SecurelyAccess API
CVE-2024-5178
EPSS 33.6%
6.9 Medium
-
servicenow now platform, servicenow, servicenow utah, vancouver, and washington dc now platform +2 more
Jelly Template Injection Vulnerability in ServiceNow UI Macros
CVE-2024-4879
In KEVPublic exploit
EPSS 100.0%
9.3 Critical
-
jenkins servicenow devops, servicenow jenkins plug-in for servicenow devops +1 more
Missing Authorization in Jenkins plug-in for ServiceNow DevOps
CVE-2023-3442
Fix available
7.7 High
-
jenkins servicenow devops, servicenow jenkins plug-in for servicenow devops +1 more
Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps
CVE-2023-3414
Fix available
6.1 Medium
-
servicenow, servicenow now user experience +1 more
ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS)...
CVE-2023-1298
4.3 Medium
-
servicenow, servicenow now platform +1 more
ACL bypass in Reporting functionality
CVE-2022-43684
9.9 Critical
-
servicenow, servicenow records +1 more
Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated...
CVE-2023-1209
4.3 Medium
-
servicenow, servicenow now platform +1 more
Cross-Site Scripting (XSS) vulnerability found on logout functionality
CVE-2022-46389
6.1 Medium
-
servicenow
There exists an open redirect within the response list update functionality of ServiceNow. This...
CVE-2022-46886
5.5 Medium
-
servicenow, servicenow now platform +1 more
Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect
CVE-2022-39048
6.1 Medium
-
servicenow
A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal ...
CVE-2022-42704
5.4 Medium
-
servicenow
ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality.
CVE-2022-38463
6.1 Medium
-
servicenow
ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new...
CVE-2022-38172
6.1 Medium
-
servicenow
The password-reset form in ServiceNow Orlando provides different responses to invalid...
CVE-2021-45901
Public exploit
EPSS 14.3%
5.3 Medium
-
servicenow it service management
ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid...
CVE-2019-20768
5.4 Medium
-
servicenow
report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to...
CVE-2018-7748
8.8 High
-
servicenow it service management
ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile (aka...
CVE-2018-8720
5.4 Medium