How many CVEs does Netflix have?

Netflix has 35 published CVE records since 2017, including 16 in the last two years.

How many Netflix CVEs are in CISA KEV?

None of Netflix's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which Netflix products have the most CVEs?

The Netflix products with the most published CVEs are lemur, dispatch, ConsoleMe, chaos monkey, Dial Reference Source Code Repo (https://github.com/Netflix/dial-reference).

What are the most common weakness types in Netflix CVEs?

Netflix's CVEs most often map to these CWE weakness types: CWE-862 (Missing Authorization), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-863 (Incorrect Authorization), CWE-639 (Authorization Bypass Through User-Controlled Key).

Are there public exploits for Netflix vulnerabilities?

Yes — 14 of Netflix's CVEs have a known public exploit.

How many critical Netflix vulnerabilities are there?

Netflix has 8 critical and 12 high-severity CVEs.

What is the average severity of Netflix CVEs?

The average CVSS base score across Netflix's scored CVEs is 7.4.

RadicalNotion.AI

Log in Start free

35 CVEs

Netflix Vulnerabilities

Name: Netflix vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Netflix.

35

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

14

Public exploits

PoC or exploit code

7.4

Avg CVSS

2017–2026

Overview

Netflix has 35 published CVE records since 2017, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 14 have a known public exploit. The average CVSS base score across scored CVEs is 7.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Netflix products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Netflix's vulnerability posture, as a share of its 35 published CVEs.

Average CVSS: 7.4
Critical / high: 57%
Actively exploited (KEV): 0%
Public exploit available: 40%
Patch available: 91%

Severity and exploitation

How the CVSS severity of Netflix's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical8

High12

Medium15

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Netflix's CVEs are currently listed in CISA's KEV catalog.

Public exploits

14

14 of Netflix's CVEs have a known public exploit available.

Most affected products

The Netflix products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Netflix CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Netflix CVE records.

Disclosure activity by year

How many Netflix CVEs were published each year.

2017

2

2019

1

2020

6

2021

3

2022

1

2023

2

2024

4

2026

16

Latest Netflix CVEs

The most recently disclosed vulnerabilities affecting Netflix.

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
CWE-639
High · CVSS 7.3
EPSS 0.1%2026-08-18
Lemur: Missing authorization check on POST /certificates/ /export for plugins with requires_key = False
CWE-862
Medium · CVSS 4.3
EPSS 0.2%2026-08-18
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
CWE-862
Medium · CVSS 6.5
EPSS 0.1%2026-08-18
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
CWE-918
High · CVSS 7.4
EPSS 0.2%2026-08-18
Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist
CWE-918
High · CVSS 7.7
EPSS 0.2%2026-08-18
Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API
CWE-862
High · CVSS 7.7
EPSS 0.2%2026-08-18
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
CWE-639
High · CVSS 8.1
EPSS 0.2%2026-08-18
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)
CWE-367
Medium · CVSS 6.3
EPSS 0.1%2026-08-18
Lemur: Plaintext password storage in Lemur user-update path
CWE-256
Medium · CVSS 4.9
EPSS 0.2%2026-08-18
Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates
CWE-918
Medium · CVSS 6.3
EPSS 0.2%2026-08-18
Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR
CWE-285
Critical · CVSS 9.9
EPSS 0.2%2026-08-18
Lemur: Privilege escalation via PUT /api/1/roles/ — non-admin role members can rewrite role membership
CWE-863
Medium · CVSS 6.3
EPSS 0.2%2026-08-18

Track new Netflix CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Netflix CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

microsoft36,673 CVEs linux22,774 CVEs Google16,481 CVEs Apple15,095 CVEs Oracle12,708 CVEs Debian10,226 CVEs IBM8,839 CVEs Red Hat8,111 CVEs

Browse all vendors

Frequently asked questions

Common questions about Netflix vulnerabilities.

How many CVEs does Netflix have?: Netflix has 35 published CVE records since 2017, including 16 in the last two years.
How many Netflix CVEs are in CISA KEV?: None of Netflix's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which Netflix products have the most CVEs?: The Netflix products with the most published CVEs are lemur, dispatch, ConsoleMe, chaos monkey, Dial Reference Source Code Repo (https://github.com/Netflix/dial-reference).
What are the most common weakness types in Netflix CVEs?: Netflix's CVEs most often map to these CWE weakness types: CWE-862 (Missing Authorization), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-863 (Incorrect Authorization), CWE-639 (Authorization Bypass Through User-Controlled Key).
Are there public exploits for Netflix vulnerabilities?: Yes — 14 of Netflix's CVEs have a known public exploit.
How many critical Netflix vulnerabilities are there?: Netflix has 8 critical and 12 high-severity CVEs.
What is the average severity of Netflix CVEs?: The average CVSS base score across Netflix's scored CVEs is 7.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Netflix vulnerabilities

Monitor new Netflix vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing