SN is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 20 CVE records since 2023.

How many CVEs has SN published?

SN has published 20 CVE records, including 12 in the last two years.

What is SN's CVE data quality grade?

RadicalNotion.AI grades SN's CVE data quality as A, with an overall completeness score of 100%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (100%), and CWE (100%) information.

What products does SN publish CVEs for?

SN most frequently publishes CVEs for ServiceNow AI Platform, Now Platform, ServiceNow, io.jenkins.plugins:servicenow-devops, Jenkins plug-in for ServiceNow DevOps.

Which vendors does SN cover?

SN publishes CVEs across 3 distinct vendors, most often ServiceNow, Jenkins.

Is SN actively publishing CVEs?

SN is currently active, based on 12 CVEs in the last two years.

What is the average severity of SN's CVEs?

The average CVSS base score across SN's scored CVEs is 7.0.

How many critical CVEs has SN published?

SN has published 13 critical-severity CVEs and 7 high-severity CVEs.

Are any of SN's CVEs in CISA's Known Exploited Vulnerabilities catalog?

Yes. 2 of SN's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.

What are the most common weakness types in SN's CVEs?

SN's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-284 (Improper Access Control).

How does SN rank among CNAs?

By total CVE volume, SN ranks #242 of 370 CNAs, and it reports more complete CVE records than 60% of all CNAs.

RadicalNotion.AI

Log in Create an account

Grade A

Active

SN

Name: SN CNA CVE data quality report card
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE Numbering Authority

Latest CVE published January 12, 2026

20

CVEs published

Total assigned

2.8

Years active

2023–2026

7.0

Avg CVSS

Across scored CVEs

12

Recent CVEs

Last 2 years

Overview

SN is a CVE Numbering Authority that has published 20 CVE records since 2023. It is currently classified as active, with 12 CVEs published in the last two years. Its CVE data quality is graded A (100% overall completeness).

Among the 370 CNAs tracked here, SN ranks #242 by CVE volume and reports more complete records than 60% of all CNAs.

Data quality report card

Completeness of SN's CVE records across vendor, product, CVSS, and CWE fields.

A CVE record needs only a description to be published. Completeness is how often SN also fills in the affected vendor and product, a CVSS severity score, and a CWE weakness type. A higher score means fewer of this CNA’s CVEs need enriching by hand before you can triage them.

Report card grade

A

100%

Overall score

Overall completeness100%

Vendor completeness100%

Product completeness100%

CVSS completeness100%

CWE completeness100%

100%

Update rate

Records revised after publishing

3

Vendor diversity

Distinct vendors covered

473 chars

Avg description length

Per CVE record

2023-04-10

First CVE date

Earliest assignment

2026-01-12

Latest CVE date

Most recent assignment

7.0

Average CVSS

Across scored CVEs

What these scores mean

Vendor completeness: The share of this CNA's CVEs that name an affected vendor.
Product completeness: The share that name a specific affected product.
CVSS completeness: The share that include a CVSS severity score.
CWE completeness: The share mapped to a CWE weakness type.
Update rate: How often this CNA revises CVE records after first publishing them.
Vendor diversity: How many distinct vendors this CNA publishes CVEs for.

Severity and exploitation

How the CVSS severity of SN's published CVEs breaks down, and how many are known to be exploited in the wild.

Critical13

High7

Medium11

Low0

In CISA’s Known Exploited Vulnerabilities catalog

2

2 of SN's CVEs are confirmed exploited in the wild and carry a CISA remediation deadline.

Common weakness types

The CWE weakness categories SN most often assigns to its CVEs. Follow any weakness to its full explanation.

Publishing activity by year

How many CVEs SN has published each year.

2023

8

2024

6

2025

5

2026

12

Top vendors

The vendors SN publishes the most CVEs for.

ServiceNow31 CVEs
Jenkins2 CVEs

Top products

The products SN publishes the most CVEs for.

ServiceNow AI Platform14 CVEs
Now Platform11 CVEs
ServiceNow10 CVEs
io.jenkins.plugins:servicenow-devops2 CVEs
Jenkins plug-in for ServiceNow DevOps2 CVEs
servicenow devops2 CVEs
servicenow-devops-plugin2 CVEs
ServiceNow Records1 CVEs

Latest CVEs

The most recent CVEs assigned by SN.

CVE-2026-86860CWE-862
Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform
Critical · CVSS 9.3
EPSS 0.3%2026-09-24
CVE-2026-86859CWE-284
Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform
High · CVSS 8.7
EPSS 0.3%2026-09-24
CVE-2026-13016CWE-89
Unauthenticated SQL Injection in ServiceNow AI Platform
Critical · CVSS 9.3
EPSS 0.3%2026-09-24
CVE-2026-86858CWE-284
Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform
High · CVSS 8.7
EPSS 0.3%2026-09-24
CVE-2026-86857CWE-862
Authorization Bypass in ServiceNow AI Platform
High · CVSS 8.4
EPSS 0.2%2026-09-24
CVE-2026-74820CWE-89
Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause
Critical · CVSS 10.0
EPSS 5.1%2026-08-27
CVE-2026-18886CWE-284
Unauthenticated Privilege Escalation via System Configuration Image Upload Processor
Critical · CVSS 10.0
EPSS 5.0%2026-08-27
CVE-2026-18885CWE-94
Unauthenticated Remote Code Execution in GraphQL Composite Data API
Critical · CVSS 10.0
EPSS 7.2%2026-08-27
CVE-2026-6876CWE-693
Sandbox Escape in ServiceNow AI Platform
Critical · CVSS 10.0
EPSS 0.6%2026-08-27
CVE-2026-6875CWE-94
Sandbox Escape in ServiceNow AI Platform
Critical · CVSS 9.5
EPSS 1.4%2026-07-13
CVE-2026-0542CWE-653
Remote Code Execution in ServiceNow AI Platform
Critical · CVSS 9.2
EPSS 0.6%2026-02-25
CVE-2025-12420CWE-250
Unauthenticated Privilege Escalation in ServiceNow AI Platform
Critical · CVSS 9.3
EPSS 53.2%2026-01-12

Get an alert for each new SN CVE, with AI-written analysis and remediation steps.

Monitor SN CVEs

Other CNAs

Data quality for other CVE Numbering Authorities.

mitreGrade F · 112,208 CVEs PatchstackGrade A · 14,729 CVEs VulDBGrade A · 12,140 CVEs microsoftGrade F · 11,701 CVEs redhatGrade F · 10,745 CVEs GitHub_MGrade A · 10,605 CVEs LinuxGrade F · 10,294 CVEs WordfenceGrade A · 8,652 CVEs

Browse all CNAs

Frequently asked questions

Common questions about the SN CNA.

What is the SN CNA?: SN is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 20 CVE records since 2023.
How many CVEs has SN published?: SN has published 20 CVE records, including 12 in the last two years.
What is SN's CVE data quality grade?: RadicalNotion.AI grades SN's CVE data quality as A, with an overall completeness score of 100%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (100%), and CWE (100%) information.
What products does SN publish CVEs for?: SN most frequently publishes CVEs for ServiceNow AI Platform, Now Platform, ServiceNow, io.jenkins.plugins:servicenow-devops, Jenkins plug-in for ServiceNow DevOps.
Which vendors does SN cover?: SN publishes CVEs across 3 distinct vendors, most often ServiceNow, Jenkins.
Is SN actively publishing CVEs?: SN is currently active, based on 12 CVEs in the last two years.
What is the average severity of SN's CVEs?: The average CVSS base score across SN's scored CVEs is 7.0.
How many critical CVEs has SN published?: SN has published 13 critical-severity CVEs and 7 high-severity CVEs.
Are any of SN's CVEs in CISA's Known Exploited Vulnerabilities catalog?: Yes. 2 of SN's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.
What are the most common weakness types in SN's CVEs?: SN's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-284 (Improper Access Control).
How does SN rank among CNAs?: By total CVE volume, SN ranks #242 of 370 CNAs, and it reports more complete CVE records than 60% of all CNAs.

References

CNA report-card grades are computed by RadicalNotion.AI from published CVE records. CVE data is sourced from the CVE Program.

Track SN CVEs

Get an alert when this CNA publishes a new CVE, with AI-written analysis and remediation steps.

Create an account See pricing