CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 17:50 UTC)

What this means for you

This week: 5,379 CVEs published, 347 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,379; Show in the list
Critical, last 7 days: 347; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

101,068 CVEs, showing 551 to 600PreviousPage 12 of 2,022Next

CVE	Severity	Title	Published
CVE-2017-11614 Healthcare	Critical 9.8	MEDHOST Connex contains hard-coded credentials that are used for customer database access. Assigned by mitre	Jul 25, 2017
CVE-2017-9233	High 7.5	XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an… Assigned by mitre	Jul 25, 2017
CVE-2017-11694 Healthcare	Critical 9.1	MEDHOST Document Management System contains hard-coded credentials that are used for Apache Solr access. Assigned by mitre	Jul 28, 2017
CVE-2017-11693 Healthcare	Critical 9.1	MEDHOST Document Management System contains hard-coded credentials that are used for customer database access. Assigned by mitre	Jul 28, 2017
CVE-2017-11743 Healthcare	Critical 9.8	MEDHOST Connex contains a hard-coded Mirth Connect admin credential that is used for customer Mirth Connect management access. Assigned by mitre	Jul 31, 2017
CVE-2017-12064 Healthcare	High 7.5	The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name. Assigned by mitre	Aug 1, 2017
CVE-2017-6663 Known exploited	Medium 6.5	A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to… Assigned by cisco	Aug 7, 2017
CVE-2017-12637 Known exploited	High 7.5	Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. Assigned by mitre	Aug 7, 2017
CVE-2015-2291 Known exploited	High 7.8	(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code… Assigned by mitre	Aug 9, 2017
CVE-2016-6794	Medium 5.3	When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. Assigned by apache	Aug 10, 2017
CVE-2016-5018	Critical 9.1	In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomca… Assigned by apache	Aug 10, 2017
CVE-2016-0762	Medium 5.9	The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplie… Assigned by apache	Aug 10, 2017
CVE-2016-6797	High 7.5	The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global J… Assigned by apache	Aug 10, 2017
CVE-2017-7674	Medium 4.3	The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Orig… Assigned by apache	Aug 11, 2017
CVE-2016-6796	High 7.5	A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via… Assigned by apache	Aug 11, 2017
CVE-2017-6327 Known exploited	High 8.8	The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely… Assigned by symantec	Aug 11, 2017
CVE-2017-11357 Known exploited	Critical 9.8	Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary c… Assigned by mitre	Aug 23, 2017
CVE-2017-11317 Known exploited	Critical 9.8	Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or… Assigned by mitre	Aug 23, 2017
CVE-2017-6627 Known exploited	High 7.5	A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, remote attacker to cause the input queue of an affected syste… Assigned by cisco	Sep 7, 2017
CVE-2017-8759 Known exploited	High 7.8	Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code Executio… Assigned by microsoft	Sep 13, 2017
CVE-2017-9805 Known exploited	High 8.1	The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can… Assigned by apache	Sep 15, 2017
CVE-2017-12616	High 7.5	When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext usin… Assigned by apache	Sep 19, 2017
CVE-2017-12615 Known exploited	High 8.1	When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Assigned by apache	Sep 19, 2017
CVE-2015-1187 Known exploited	Critical 9.8	The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp. Assigned by mitre	Sep 21, 2017
CVE-2015-6748	Medium 6.1	Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3. Assigned by redhat	Sep 25, 2017
CVE-2017-12240 Known exploited	Critical 9.8	The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full… Assigned by cisco	Sep 28, 2017
CVE-2017-12238 Known exploited	Medium 6.5	A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a C680… Assigned by cisco	Sep 28, 2017
CVE-2017-12237 Known exploited	High 7.5	A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high CP… Assigned by cisco	Sep 28, 2017
CVE-2017-12235 Known exploited	High 7.5	A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could allow an unauthenticated, remote attacker to cause an affecte… Assigned by cisco	Sep 28, 2017
CVE-2017-12234 Known exploited	High 7.5	Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected devi… Assigned by cisco	Sep 28, 2017
CVE-2017-12233 Known exploited	High 7.5	Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected devi… Assigned by cisco	Sep 28, 2017
CVE-2017-12232 Known exploited	Medium 6.5	A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.0 through 15.6 could allow an unauthenticated, adjacent att… Assigned by cisco	Sep 28, 2017
CVE-2017-12231 Known exploited	High 7.5	A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause a denial of service (D… Assigned by cisco	Sep 28, 2017
CVE-2017-12617 Known exploited	High 8.1	When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. Assigned by apache	Oct 3, 2017
CVE-2017-1000253 Known exploited	High 7.8	Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). Assigned by mitre	Oct 4, 2017
CVE-2017-12149 Known exploited	Critical 9.8	In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classe… Assigned by redhat	Oct 4, 2017
CVE-2017-11826 Known exploited	High 7.8	Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation… Assigned by microsoft	Oct 13, 2017
CVE-2017-11774 Known exploited	High 7.8	Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outloo… Assigned by microsoft	Oct 13, 2017
CVE-2015-1239	Medium 6.5	Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a craf…	Oct 18, 2017
CVE-2017-10271 Known exploited	High 7.5	Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Assigned by oracle	Oct 19, 2017
CVE-2017-11292 Known exploited	High 8.8	Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. Assigned by adobe	Oct 21, 2017
CVE-2017-12796 Healthcare	Critical 9.8	The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema o… Assigned by mitre	Oct 23, 2017
CVE-2017-5070 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a craft… Assigned by Chrome	Oct 27, 2017
CVE-2017-16540 Healthcare	High 7.5	OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL serv… Assigned by mitre	Nov 4, 2017
CVE-2017-16651 Known exploited	High 7.8	Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the… Assigned by mitre	Nov 9, 2017
CVE-2017-11882 Known exploited	High 7.8	Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of t… Assigned by microsoft	Nov 15, 2017
CVE-2017-1000158	Critical 9.8	CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code ex… Assigned by mitre	Nov 17, 2017
CVE-2017-1000241 Healthcare	High 8.1	The application OpenEMR version 5.0.0, 5.0.1-dev and prior is affected by vertical privilege escalation vulnerability. Assigned by mitre	Nov 17, 2017
CVE-2017-1000240 Healthcare	Medium 5.4	The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting (XSS) vulnerabilities affecting version 5.0.0 and prior versions. Assigned by mitre	Nov 17, 2017
CVE-2017-14111 Healthcare	High 7.2	The workstation logging function in Philips IntelliSpace Cardiovascular (ISCV) 2.3.0 and earlier and Xcelera R4.1L1 and earlier records domain authentication credentials, which if accessed allows an… Assigned by mitre	Nov 17, 2017

PreviousPage 12 of 2,022Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.