CVE Tools
Track your stack

Developer Tools & CI/CD

9,073 CVEs tracked since 1999. In the last 12 months, 2,223, +173% on the 12 before.

Developer Tools & CI/CD by subsector, Oct 2026 so far

Oct 2026 so far: 403 CVEs across 6 subsectors. Area is each subsector's share; inside are the products it counted most. Point at one to read it.
  • Source control13934% · 5 vendors
  • Build & test tools8722% · 17 vendors
  • IDEs & editors7218% · 6 vendors
  • CI/CD7017% · 8 vendors
  • Not yet sub-classified27The tagger has not placed these yet
  • Artifact registries82% · 2 vendors

Month by month

Every monthly snapshot of Developer Tools & CI/CD. A column is the CVEs published that month.

Oct 2021 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Developer Tools & CI/CD CVEs per month
MonthCVEs
2021-1085
2021-1193
2021-1255
2022-0154
2022-02132
2022-03112
2022-04122
2022-05102
2022-06126
2022-07105
2022-0863
2022-09124
2022-10107
2022-1178
2022-1259
2023-01112
2023-0245
2023-030
2023-0479
2023-05108
2023-0661
2023-07102
2023-0890
2023-09104
2023-1056
2023-1137
2023-1288
2024-0151
2024-0263
2024-0375
2024-0436
2024-0573
2024-0650
2024-0777
2024-0849
2024-0961
2024-1066
2024-1158
2024-1251
2025-0166
2025-0253
2025-0380
2025-0464
2025-0565
2025-0664
2025-07103
2025-0868
2025-0976
2025-1088
2025-1155
2025-12106
2026-01100
2026-0296
2026-0397
2026-04171
2026-05223
2026-06240
2026-07285
2026-08353
2026-09409
2026-10403

Vendors

Who shipped the most Developer Tools & CI/CD CVEs in Oct 2026 so far, with their rank across all vendors.

  1. Gitea78#15
  2. Backstage42#31
  3. GitLab38#35
  4. Jetbrains19#80
  5. Eclipse15#99
  6. Vyperlang13#123
  7. Coder11#137

Weaknesses

The weakness classes behind Developer Tools & CI/CD CVEs in Oct 2026 so far.

  1. CWE-863 Incorrect Authorization55
  2. CWE-22 Path Traversal32
  3. CWE-200 Information Exposure16
  4. CWE-284 Improper Access Control15
  5. CWE-79 XSS15
  6. CWE-862 Missing Authorization12

Latest CVEs

The 15 most recently published vulnerabilities in Developer Tools & CI/CD.

  1. CVE-2026-91920Undertow: undertow: chunkreader message length permits chunk-size overflow6.5
  2. CVE-2026-71569Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name4.8
  3. CVE-2026-114488Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding7.4
  4. CVE-2026-118905nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed7.0
  5. CVE-2026-118426In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.—
  6. CVE-2026-118662Vite: `server.fs.deny` bypassed with queries—
  7. CVE-2026-118687Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication6.5
  8. CVE-2026-117626Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers w...—
  9. CVE-2026-117624Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level con...—
  10. CVE-2026-117625A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the c...—
  11. CVE-2026-117623Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerabi...—
  12. CVE-2026-117621Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vu...—
  13. CVE-2026-117622Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vuln...—
  14. CVE-2026-117619Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers w...—
  15. CVE-2026-117620Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to injec...—

The record

Busiest month
Sep 2026, 409 CVEs
Oct 2026 so far
403 CVEs from 43 vendors
Deployment
On-prem, 61%
Monthly snapshots
252 since 1999
All 15 sectors on one map

Is your business exposed to threats like these?

Discuss a security assessment of your internet-facing systems. Scope, price and timing agreed before testing.

Request an assessment