CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-20 01:40 UTC)

What this means for you

This week: 5,214 CVEs published, 334 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,214; Show in the list
Critical, last 7 days: 334; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

101,514 CVEs, showing 1101 to 1150PreviousPage 23 of 2,031Next

CVE	Severity	Title	Published
CVE-2019-15847	High 7.5	The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number… Assigned by mitre	Sep 2, 2019
CVE-2019-15903	Medium 6.5	In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumn… Assigned by mitre	Sep 4, 2019
CVE-2019-10988 Healthcare	Low 3.4	In Philips HDI 4000 Ultrasound Systems, all versions running on old, unsupported operating systems such as Windows 2000, the HDI 4000 Ultrasound System is built on an old operating system that is no… Assigned by icscert	Sep 4, 2019
CVE-2019-15949 Known exploited	High 8.8	Nagios XI before 5.6.6 allows remote command execution as root. Assigned by mitre	Sep 5, 2019
CVE-2019-13517 Healthcare	High 8.8	In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12, a vulnerability has been identified where existing access privileges are not re… Assigned by icscert	Sep 6, 2019
CVE-2018-18630 Healthcare	High 7.8	A vulnerability was found in McKesson Cardiology product 13.x and 14.x. Assigned by mitre	Sep 6, 2019
CVE-2019-16056	Medium 5.3	An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. Assigned by mitre	Sep 6, 2019
CVE-2019-16089	Medium 4.1	An issue was discovered in the Linux kernel through 5.2.13. Assigned by mitre	Sep 6, 2019
CVE-2019-16168	Medium 6.5	In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the… Assigned by mitre	Sep 9, 2019
CVE-2019-1563	Low 3.7	Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey Assigned by openssl	Sep 10, 2019
CVE-2019-1215 Known exploited	High 7.8	An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. Assigned by microsoft	Sep 11, 2019
CVE-2019-1214 Known exploited	High 7.8	An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Priv… Assigned by microsoft	Sep 11, 2019
CVE-2019-1253 Known exploited	High 7.8	An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on th… Assigned by microsoft	Sep 11, 2019
CVE-2019-1297 Known exploited	High 8.8	A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. Assigned by microsoft	Sep 11, 2019
CVE-2019-16256 Known exploited	Critical 9.8	Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or exe… Assigned by mitre	Sep 12, 2019
CVE-2019-13534 Healthcare	High 7.2	Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by… Assigned by icscert	Sep 12, 2019
CVE-2019-13530 Healthcare	High 7.2	Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by… Assigned by icscert	Sep 12, 2019
CVE-2019-14540	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. Assigned by mitre	Sep 15, 2019
CVE-2019-16335	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. Assigned by mitre	Sep 15, 2019
CVE-2019-16057 Known exploited	Critical 9.8	The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. Assigned by mitre	Sep 16, 2019
CVE-2019-8371 Healthcare	High 7.2	OpenEMR v5.0.1-6 allows code execution. Assigned by mitre	Sep 16, 2019
CVE-2019-8368 Healthcare	Medium 6.1	OpenEMR v5.0.1-6 allows XSS. Assigned by mitre	Sep 16, 2019
CVE-2019-5481	Critical 9.8	Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. Assigned by hackerone	Sep 16, 2019
CVE-2019-5482	Critical 9.8	Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Assigned by hackerone	Sep 16, 2019
CVE-2019-3739	Medium 6.5	RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. Assigned by dell	Sep 18, 2019
CVE-2019-3740	Medium 6.5	RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. Assigned by dell	Sep 18, 2019
CVE-2019-1367 Known exploited	High 7.5	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft	Sep 23, 2019
CVE-2019-16759 Known exploited	Critical 9.8	vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. Assigned by mitre	Sep 24, 2019
CVE-2019-5094	High 7.5	An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. Assigned by talos	Sep 24, 2019
CVE-2019-13627	Medium 6.3	It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Assigned by mitre	Sep 25, 2019
CVE-2019-16869	High 7.5	Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. Assigned by mitre	Sep 26, 2019
CVE-2019-16920 Known exploited	Critical 9.8	Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. Assigned by mitre	Sep 27, 2019
CVE-2019-16928 Known exploited	Critical 9.8	Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Assigned by mitre	Sep 27, 2019
CVE-2019-16935	Medium 6.1	The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field.	Sep 28, 2019
CVE-2019-16942	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Assigned by mitre	Oct 1, 2019
CVE-2019-16943	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.	Oct 1, 2019
CVE-2019-17091 Healthcare	Medium 6.1	faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client windo… Assigned by mitre	Oct 2, 2019
CVE-2018-16301	High 7.8	The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). Assigned by Tcpdump	Oct 3, 2019
CVE-2019-16866	High 7.5	Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. Assigned by mitre	Oct 3, 2019
CVE-2019-17179 Healthcare	Medium 6.1	4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0.1.7, 5.0.2, fixed in version 5.0.2.1 Assigned by mitre	Oct 4, 2019
CVE-2019-17197 Healthcare	Critical 9.8	OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc. Assigned by mitre	Oct 5, 2019
CVE-2019-17267	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.	Oct 7, 2019
CVE-2019-16905	High 7.8	OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. Assigned by mitre	Oct 9, 2019
CVE-2019-1315 Known exploited	High 7.8	An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. Assigned by microsoft	Oct 10, 2019
CVE-2019-1322 Known exploited	High 7.8	An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. Assigned by microsoft	Oct 10, 2019
CVE-2019-2215 Known exploited	High 7.8	A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. Assigned by google_android	Oct 11, 2019
CVE-2019-17531	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Assigned by mitre	Oct 12, 2019
CVE-2019-17543	High 8.1	LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. Assigned by mitre	Oct 14, 2019
CVE-2019-16278 Known exploited	Critical 9.8	Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request. Assigned by mitre	Oct 14, 2019
CVE-2019-17595	Medium 5.4	There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012. Assigned by mitre	Oct 14, 2019

PreviousPage 23 of 2,031Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.