Checkmarx vulnerabilities (CVEs)

6 CVEs matched to Checkmarx by name in NVD, none on CISA's Known Exploited list.

Back to the Checkmarx profile · Alternatives to Checkmarx · CVE RSS feed

Exploitation riskProbably exploited

6 of 6 CVEs assessed

confirmed exploited

EPSS ≥ 10%

99%

highest single CVE

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2014-8778 ↗EPSS 3.3%LEV ≥99%Probably exploited
Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code…
CVE-2022-25201 ↗EPSS 0.7%LEV ≥35%Elevated risk
Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webs…
CVE-2023-35142 ↗EPSS 0.8%LEV ≥27%Elevated risk
Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default.
CVE-2022-25200 ↗EPSS 0.6%LEV ≥27%Elevated risk
A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attacker-specified webserve…
CVE-2022-46684 ↗EPSS 0.5%LEV ≥19%Elevated risk
Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting …

Recent changes

last 90 days

CVE-2014-8778 is now estimated at a 99% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
CVE-2022-25200 is now estimated at a 26% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
CVE-2022-25201 is now estimated at a 34% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
CVE-2022-46684 is now estimated at a 19% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
CVE-2023-35142 is now estimated at a 26% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	Critical	High	Medium	Total
2026	1	0	0	1
2023	0	1	0	1
2022	0	1	2	3
2015	0	1	0	1

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2014-8778	3.3%	88%
CVE-2023-35142	0.8%	55%
CVE-2022-25201	0.7%	54%
CVE-2022-25200	0.6%	45%
CVE-2026-42994	0.5%	44%
CVE-2022-46684	0.5%	41%

Known CVEs (6)

RSS ⇢

CVE-2026-42994 ↗CRITICAL 9.82026
Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident.
CVE-2023-35142 ↗HIGH 8.12023
Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default.
CVE-2022-46684 ↗

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to Checkmarx by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-07-11.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-20.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.