CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-20 00:20 UTC)

What this means for you

This week: 5,201 CVEs published, 334 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,201; Show in the list
Critical, last 7 days: 334; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

101,449 CVEs, showing 1001 to 1050PreviousPage 21 of 2,029Next

CVE	Severity	Title	Published
CVE-2018-4063 Known exploited	High 8.8	An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. Assigned by talos	May 6, 2019
CVE-2019-11510 Known exploited	Critical 9.9	In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary… Assigned by mitre	May 8, 2019
CVE-2017-12795 Healthcare	Critical 9.8	OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation). Assigned by mitre	May 10, 2019
CVE-2019-5018	High 8.1	An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. Assigned by talos	May 10, 2019
CVE-2019-3568 Known exploited	Critical 9.8	A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. Assigned by facebook	May 14, 2019
CVE-2018-14839 Known exploited	Critical 9.8	LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. Assigned by mitre	May 14, 2019
CVE-2013-7285	Critical 9.8	Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed inpu… Assigned by mitre	May 15, 2019
CVE-2019-0863 Known exploited	High 7.8	An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. Assigned by microsoft	May 16, 2019
CVE-2019-0708 Known exploited Healthcare	Critical 9.8	A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends speciall… Assigned by microsoft	May 16, 2019
CVE-2019-0903 Known exploited	High 8.8	A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. Assigned by microsoft	May 16, 2019
CVE-2018-17179 Healthcare	Critical 9.8	An issue was discovered in OpenEMR before 5.0.1 Patch 7. Assigned by mitre	May 17, 2019
CVE-2018-17180 Healthcare	Medium 5.3	An issue was discovered in OpenEMR before 5.0.1 Patch 7. Assigned by mitre	May 17, 2019
CVE-2018-17181 Healthcare	Critical 9.8	An issue was discovered in OpenEMR before 5.0.1 Patch 7. Assigned by mitre	May 17, 2019
CVE-2019-12086	High 7.5	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. Assigned by mitre	May 17, 2019
CVE-2018-16156	High 7.8	In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over the FjtwMkic_Fjicube_32 named pipe. Assigned by mitre	May 17, 2019
CVE-2019-11634 Known exploited	Critical 9.8	Citrix Workspace App before 1904 for Windows has Incorrect Access Control. Assigned by mitre	May 22, 2019
CVE-2018-12886	High 8.1	stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeti… Assigned by mitre	May 22, 2019
CVE-2018-7841 Known exploited	Critical 9.8	A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered. Assigned by schneider	May 22, 2019
CVE-2019-5435	Low 3.7	An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. Assigned by hackerone	May 28, 2019
CVE-2019-5436	High 7.8	A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. Assigned by hackerone	May 28, 2019
CVE-2019-5589	High 8.6	A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable Assigned by fortinet	May 28, 2019
CVE-2018-13383 Known exploited	Medium 4.3	A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may ca… Assigned by fortinet	May 29, 2019
CVE-2019-9670 Known exploited	Critical 9.8	mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml. Assigned by mitre	May 29, 2019
CVE-2019-8457	Critical 9.8	SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. Assigned by checkpoint	May 30, 2019
CVE-2019-9874 Known exploited	Critical 9.8	Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrar… Assigned by mitre	May 31, 2019
CVE-2019-9875 Known exploited	High 8.8	Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parame… Assigned by mitre	May 31, 2019
CVE-2019-11580 Known exploited	Critical 9.8	Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Assigned by atlassian	Jun 3, 2019
CVE-2018-13379 Known exploited	Critical 9.1	An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to… Assigned by fortinet	Jun 4, 2019
CVE-2018-13382 Known exploited	Critical 9.1	An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web p… Assigned by fortinet	Jun 4, 2019
CVE-2019-10149 Known exploited	Critical 9.0	A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Assigned by redhat	Jun 5, 2019
CVE-2019-12741 Healthcare	Medium 6.1	XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. Assigned by mitre	Jun 5, 2019
CVE-2019-10160	Critical 9.8	A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which s… Assigned by redhat	Jun 7, 2019
CVE-2010-5330 Known exploited	Critical 9.8	On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. Assigned by mitre	Jun 11, 2019
CVE-2019-1069 Known exploited	High 7.8	Task Scheduler Elevation of Privilege Vulnerability Assigned by microsoft	Jun 12, 2019
CVE-2019-1064 Known exploited	High 7.8	Windows Elevation of Privilege Vulnerability Assigned by microsoft	Jun 12, 2019
CVE-2019-10962 Healthcare	Medium 5.3	BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway Workstation does not prevent an attacker with knowledge of t… Assigned by icscert	Jun 13, 2019
CVE-2019-10959 Healthcare	Critical 10.0	BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionall… Assigned by icscert	Jun 13, 2019
CVE-2019-12900	Critical 9.8	BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. Assigned by mitre	Jun 19, 2019
CVE-2019-12904	Medium 5.9	In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. Assigned by mitre	Jun 19, 2019
CVE-2019-12384	Medium 5.9	FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Assigned by mitre	Jun 24, 2019
CVE-2018-20843	High 7.5	In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enoug… Assigned by mitre	Jun 24, 2019
CVE-2019-12972	Medium 5.5	An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. Assigned by mitre	Jun 26, 2019
CVE-2019-5786 Known exploited	Medium 6.5	Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Assigned by Chrome	Jun 27, 2019
CVE-2019-10964 Healthcare	High 7.1	Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control Assigned by icscert	Jun 28, 2019
CVE-2019-7256 Known exploited	Critical 9.8	Linear eMerge E3-Series devices allow Command Injections. Assigned by mitre	Jul 2, 2019
CVE-2019-5443	High 7.8	A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine")… Assigned by hackerone	Jul 2, 2019
CVE-2018-15811 Known exploited	High 7.5	DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters. Assigned by mitre	Jul 3, 2019
CVE-2018-18325 Known exploited	High 7.5	DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. Assigned by mitre	Jul 3, 2019
CVE-2018-11307	Critical 9.8	An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Assigned by mitre	Jul 9, 2019
CVE-2018-17150 Healthcare	Medium 6.1	Intersystems Cache 2017.2.2.865.0 allows XSS. Assigned by mitre	Jul 11, 2019

PreviousPage 21 of 2,029Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.