CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 23:30 UTC)

What this means for you

This week: 5,219 CVEs published, 343 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,219; Show in the list
Critical, last 7 days: 343; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

101,444 CVEs, showing 951 to 1000PreviousPage 20 of 2,029Next

CVE	Severity	Title	Published
CVE-2019-7238 Known exploited	Critical 9.8	Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. Assigned by mitre	Mar 21, 2019
CVE-2019-3855	High 7.5	An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. Assigned by redhat	Mar 21, 2019
CVE-2019-3858	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. Assigned by redhat	Mar 21, 2019
CVE-2019-9923	High 7.5	pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers. Assigned by mitre	Mar 22, 2019
CVE-2019-9936	High 7.5	In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. Assigned by mitre	Mar 22, 2019
CVE-2019-9937	High 7.5	In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. Assigned by mitre	Mar 22, 2019
CVE-2019-9947	Medium 5.4	An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. Assigned by mitre	Mar 23, 2019
CVE-2019-9948	Critical 9.1	urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggerin… Assigned by mitre	Mar 23, 2019
CVE-2019-9978 Known exploited	Medium 6.1	The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. Assigned by mitre	Mar 24, 2019
CVE-2019-7609 Known exploited	Critical 9.8	Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Assigned by elastic	Mar 25, 2019
CVE-2019-3863	High 7.5	A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. Assigned by redhat	Mar 25, 2019
CVE-2019-3861	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3860	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3857	High 7.5	An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3856	High 7.5	An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3396 Known exploited	Critical 9.8	The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 bef… Assigned by atlassian	Mar 25, 2019
CVE-2019-6538 Healthcare	Critical 9.3	Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control Assigned by icscert	Mar 25, 2019
CVE-2014-5434 Healthcare	Critical 9.8	Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account with hard-coded credentials used with the FTP protocol. Assigned by icscert	Mar 26, 2019
CVE-2014-5433 Healthcare	Critical 9.8	An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700… Assigned by icscert	Mar 26, 2019
CVE-2014-5432 Healthcare	Critical 9.8	Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is remotely accessible via Port 22/SSH without authentication. Assigned by icscert	Mar 26, 2019
CVE-2014-5431 Healthcare	Medium 6.8	Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded password, which provides access to basic biomedical information… Assigned by icscert	Mar 26, 2019
CVE-2019-10068 Known exploited	Critical 9.8	An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Assigned by mitre	Mar 26, 2019
CVE-2019-6540 Healthcare	Medium 6.5	Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information Assigned by icscert	Mar 26, 2019
CVE-2019-5418 Known exploited	High 7.5	There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the targ… Assigned by hackerone	Mar 27, 2019
CVE-2018-18035 Healthcare	Medium 6.1	A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. Assigned by mitre	Apr 2, 2019
CVE-2018-4344 Known exploited	High 7.8	A memory corruption issue was addressed with improved memory handling. Assigned by apple	Apr 3, 2019
CVE-2019-11001 Known exploited	High 7.2	On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrate… Assigned by mitre	Apr 8, 2019
CVE-2019-0211 Known exploited	High 7.8	In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scrip… Assigned by apache	Apr 8, 2019
CVE-2019-0703 Known exploited	Medium 6.5	An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. Assigned by microsoft	Apr 8, 2019
CVE-2019-0808 Known exploited	High 7.8	An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Assigned by microsoft	Apr 9, 2019
CVE-2019-0797 Known exploited	High 7.8	An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Assigned by microsoft	Apr 9, 2019
CVE-2019-0752 Known exploited	High 7.5	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft	Apr 9, 2019
CVE-2019-0803 Known exploited	High 7.8	An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Assigned by microsoft	Apr 9, 2019
CVE-2019-0841 Known exploited	High 7.8	An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. Assigned by microsoft	Apr 9, 2019
CVE-2019-0859 Known exploited	High 7.8	An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Assigned by microsoft	Apr 9, 2019
CVE-2019-5024 Healthcare	High 7.6	A restricted environment escape vulnerability exists in the “kiosk mode” function of Capsule Technologies SmartLinx Neuron 2 medical information collection devices running versions 9.0.3 or lower. Assigned by talos	Apr 11, 2019
CVE-2019-3398 Known exploited	High 8.8	Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. Assigned by atlassian	Apr 18, 2019
CVE-2019-11358 Healthcare	Medium 6.1	jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Assigned by mitre	Apr 19, 2019
CVE-2019-2629	Medium 5.4	Vulnerability in the Oracle Health Sciences Data Management Workbench component of Oracle Health Sciences Applications (subcomponent: User Interface). Assigned by oracle	Apr 23, 2019
CVE-2019-2616 Known exploited	High 7.2	Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Assigned by oracle	Apr 23, 2019
CVE-2018-20052 Healthcare	High 7.8	An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. Assigned by mitre	Apr 25, 2019
CVE-2018-20053 Healthcare	Critical 9.8	An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. Assigned by mitre	Apr 25, 2019
CVE-2019-11539 Known exploited	High 8.0	In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX b… Assigned by mitre	Apr 26, 2019
CVE-2019-2725 Known exploited	High 7.5	Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Assigned by oracle	Apr 26, 2019
CVE-2019-10948 Healthcare	High 7.5	Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X are susceptible to a denial-of-service condition as a result of an over… Assigned by icscert	Apr 30, 2019
CVE-2019-10950 Healthcare	Critical 9.8	Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X provide insecure telnet services that lack authentication requirements. Assigned by icscert	Apr 30, 2019
CVE-2019-9621 Known exploited	High 7.5	Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. Assigned by mitre	Apr 30, 2019
CVE-2019-3929 Known exploited	Critical 9.8	The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 fir… Assigned by tenable	Apr 30, 2019
CVE-2019-6562 Healthcare	Medium 5.4	In Philips Tasy EMR, Tasy EMR Versions 3.02.1744 and prior, the software incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to oth… Assigned by icscert	May 1, 2019
CVE-2017-18368 Known exploited	Critical 9.8	The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is access… Assigned by mitre	May 2, 2019

PreviousPage 20 of 2,029Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.