CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-20 03:00 UTC)

What this means for you

This week: 5,213 CVEs published, 335 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,213; Show in the list
Critical, last 7 days: 335; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

101,519 CVEs, showing 1201 to 1250PreviousPage 25 of 2,031Next

CVE	Severity	Title	Published
CVE-2019-19317	Critical 9.8	lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other… Assigned by mitre	Dec 5, 2019
CVE-2019-7192 Known exploited	Critical 9.8	This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. Assigned by qnap	Dec 5, 2019
CVE-2019-7193 Known exploited	Critical 9.8	This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Assigned by qnap	Dec 5, 2019
CVE-2019-7194 Known exploited	Critical 9.8	This external control of file name or path vulnerability allows remote attackers to access or modify system files. Assigned by qnap	Dec 5, 2019
CVE-2019-7195 Known exploited	Critical 9.8	This external control of file name or path vulnerability allows remote attackers to access or modify system files. Assigned by qnap	Dec 5, 2019
CVE-2019-5544 Known exploited	Critical 9.8	OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. Assigned by vmware	Dec 6, 2019
CVE-2019-1551	Medium 5.3	rsaz_512_sqr overflow bug on x86_64 Assigned by openssl	Dec 6, 2019
CVE-2019-19645	Medium 5.5	alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements. Assigned by mitre	Dec 9, 2019
CVE-2019-19646	Critical 9.8	pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. Assigned by mitre	Dec 9, 2019
CVE-2019-19603	High 7.5	SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. Assigned by mitre	Dec 9, 2019
CVE-2019-1458 Known exploited	High 7.8	An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Assigned by microsoft	Dec 10, 2019
CVE-2019-18935 Known exploited	Critical 9.8	Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. Assigned by mitre	Dec 11, 2019
CVE-2019-7481 Known exploited	High 7.5	Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. Assigned by sonicwall	Dec 17, 2019
CVE-2019-19880	High 7.5	exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled. Assigned by mitre	Dec 18, 2019
CVE-2019-4716 Known exploited	Critical 10.0	IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scriptin… Assigned by ibm	Dec 18, 2019
CVE-2019-7287 Known exploited	High 7.8	A memory corruption issue was addressed with improved input validation. Assigned by apple	Dec 18, 2019
CVE-2019-8526 Known exploited	High 7.8	A use after free issue was addressed with improved memory management. Assigned by apple	Dec 18, 2019
CVE-2019-8506 Known exploited	High 8.8	A type confusion issue was addressed with improved memory handling. Assigned by apple	Dec 18, 2019
CVE-2019-7286 Known exploited	High 7.8	A memory corruption issue was addressed with improved input validation. Assigned by apple	Dec 18, 2019
CVE-2019-8605 Known exploited	High 7.8	A use after free issue was addressed with improved memory management. Assigned by apple	Dec 18, 2019
CVE-2019-7483 Known exploited	High 7.5	In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server. Assigned by sonicwall	Dec 19, 2019
CVE-2019-19906	High 7.5	cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. Assigned by mitre	Dec 19, 2019
CVE-2019-18263 Healthcare	Medium 6.5	An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with wireless option (shipped between 2016-August 2018), Veradius Unity (718132) with ViewFo… Assigned by icscert	Dec 20, 2019
CVE-2019-19926	High 7.5	multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. Assigned by mitre	Dec 23, 2019
CVE-2019-17563	High 7.5	When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. Assigned by apache	Dec 23, 2019
CVE-2019-12418	High 7.0	When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration f… Assigned by apache	Dec 23, 2019
CVE-2019-19956	High 7.5	xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs. Assigned by mitre	Dec 24, 2019
CVE-2019-19923	High 7.5	flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. Assigned by mitre	Dec 24, 2019
CVE-2019-19924	Medium 5.3	SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. Assigned by mitre	Dec 24, 2019
CVE-2019-19925	High 7.5	zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. Assigned by mitre	Dec 24, 2019
CVE-2019-10758 Known exploited	Critical 9.9	mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. Assigned by snyk	Dec 24, 2019
CVE-2019-19965	Medium 4.7	In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race… Assigned by mitre	Dec 25, 2019
CVE-2019-19781 Known exploited	Critical 9.8	An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Assigned by mitre	Dec 27, 2019
CVE-2019-20085 Known exploited	High 7.5	TVT NVMS-1000 devices allow GET /.. Assigned by mitre	Dec 30, 2019
CVE-2019-20095	Medium 5.5	mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. Assigned by mitre	Dec 30, 2019
CVE-2019-17621 Known exploited	Critical 9.8	The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted… Assigned by mitre	Dec 30, 2019
CVE-2019-17558 Known exploited	High 7.5	Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. Assigned by apache	Dec 30, 2019
CVE-2019-20218	High 7.5	selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error. Assigned by mitre	Jan 2, 2020
CVE-2016-1000027	Critical 9.8	Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data.	Jan 2, 2020
CVE-2019-20330	Critical 9.8	FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. Assigned by mitre	Jan 3, 2020
CVE-2019-19959	High 7.5	ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by… Assigned by mitre	Jan 3, 2020
CVE-2019-5188	High 7.5	A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. Assigned by talos	Jan 8, 2020
CVE-2019-20367	Critical 9.1	nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). Assigned by mitre	Jan 8, 2020
CVE-2020-0601 Known exploited	High 8.1	A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code… Assigned by microsoft	Jan 14, 2020
CVE-2020-0638 Known exploited	High 7.8	An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim sys… Assigned by microsoft	Jan 14, 2020
CVE-2020-0646 Known exploited	Critical 9.8	A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'. Assigned by microsoft	Jan 14, 2020
CVE-2020-2555 Known exploited Healthcare	Critical 9.8	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Assigned by oracle	Jan 15, 2020
CVE-2020-2551 Known exploited	Critical 9.8	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Assigned by oracle	Jan 15, 2020
CVE-2020-5398 Healthcare	High 8.0	RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application Assigned by pivotal	Jan 16, 2020
CVE-2020-5397 Healthcare	Medium 5.3	CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux Assigned by pivotal	Jan 17, 2020

PreviousPage 25 of 2,031Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.