CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-20 04:30 UTC)

What this means for you

This week: 5,206 CVEs published, 334 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,206; Show in the list
Critical, last 7 days: 334; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

101,519 CVEs, showing 1301 to 1350PreviousPage 27 of 2,031Next

CVE	Severity	Title	Published
CVE-2020-0041 Known exploited	High 7.8	In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. Assigned by google_android	Mar 10, 2020
CVE-2020-0069 Known exploited	High 7.8	In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. Assigned by google_android	Mar 10, 2020
CVE-2020-6207 Known exploited	Critical 10.0	SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgent… Assigned by sap	Mar 10, 2020
CVE-2020-10181 Known exploited Healthcare	Critical 9.8	goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_us… Assigned by mitre	Mar 11, 2020
CVE-2020-7598	Medium 5.6	minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload. Assigned by snyk	Mar 11, 2020
CVE-2020-0787 Known exploited	High 7.8	An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service… Assigned by microsoft	Mar 12, 2020
CVE-2020-0796 Known exploited	Critical 10.0	A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution… Assigned by microsoft	Mar 12, 2020
CVE-2020-10531	High 8.8	An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. Assigned by mitre	Mar 12, 2020
CVE-2020-1953 Healthcare	Critical 10.0	Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Assigned by apache	Mar 13, 2020
CVE-2020-9290	High 7.1	A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable Assigned by fortinet	Mar 15, 2020
CVE-2020-9287	High 7.5	A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable Assigned by fortinet	Mar 15, 2020
CVE-2020-5847 Known exploited	Critical 9.8	Unraid through 6.8.0 allows Remote Code Execution. Assigned by mitre	Mar 16, 2020
CVE-2020-5849 Known exploited	High 7.5	Unraid 6.8.0 allows authentication bypass. Assigned by mitre	Mar 16, 2020
CVE-2020-3950 Known exploited	High 7.8	VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability d… Assigned by vmware	Mar 17, 2020
CVE-2020-8468 Known exploited	High 8.8	Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipula… Assigned by trendmicro	Mar 18, 2020
CVE-2020-8467 Known exploited	High 8.8	A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). Assigned by trendmicro	Mar 18, 2020
CVE-2020-8599 Known exploited	Critical 9.8	Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass… Assigned by trendmicro	Mar 18, 2020
CVE-2020-7961 Known exploited	Critical 9.8	Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS). Assigned by mitre	Mar 20, 2020
CVE-2020-5722 Known exploited	Critical 9.8	The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Assigned by tenable	Mar 23, 2020
CVE-2020-6077	High 7.5	An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. Assigned by talos	Mar 24, 2020
CVE-2020-6078	High 7.5	An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. Assigned by talos	Mar 24, 2020
CVE-2020-6073	High 7.5	An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0.1.0. Assigned by talos	Mar 24, 2020
CVE-2020-6071	High 7.5	An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. Assigned by talos	Mar 24, 2020
CVE-2020-6072	Critical 9.8	An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. Assigned by talos	Mar 24, 2020
CVE-2020-6079	High 7.5	An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. Assigned by talos	Mar 24, 2020
CVE-2020-1712	High 7.8	A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. Assigned by redhat	Mar 31, 2020
CVE-2020-6096	High 8.1	An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Assigned by talos	Apr 1, 2020
CVE-2020-10199 Known exploited	High 8.8	Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). Assigned by mitre	Apr 1, 2020
CVE-2020-10598 Healthcare	Medium 6.1	In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk mode functionality of affected devices. Assigned by icscert	Apr 1, 2020
CVE-2020-11494	Medium 4.4	An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. Assigned by mitre	Apr 2, 2020
CVE-2020-11501	High 7.4	GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. Assigned by mitre	Apr 3, 2020
CVE-2020-7639	Medium 5.3	eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload. Assigned by snyk	Apr 6, 2020
CVE-2020-11609	Medium 4.3	An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. Assigned by mitre	Apr 7, 2020
CVE-2020-11619	High 8.1	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop… Assigned by mitre	Apr 7, 2020
CVE-2020-11620	High 8.1	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly). Assigned by mitre	Apr 7, 2020
CVE-2020-5735 Known exploited	High 8.8	Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. Assigned by tenable	Apr 8, 2020
CVE-2020-11656	Critical 9.8	In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement. Assigned by mitre	Apr 9, 2020
CVE-2020-11655	High 7.5	SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled. Assigned by mitre	Apr 9, 2020
CVE-2020-3952 Known exploited	Critical 9.8	Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls. Assigned by vmware	Apr 10, 2020
CVE-2020-11738 Known exploited	High 7.5	The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init. Assigned by mitre	Apr 13, 2020
CVE-2020-2883 Known exploited	Critical 9.8	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Assigned by oracle	Apr 15, 2020
CVE-2020-0938 Known exploited	High 7.8	A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format… Assigned by microsoft	Apr 15, 2020
CVE-2020-0968 Known exploited	High 7.5	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft	Apr 15, 2020
CVE-2020-1020 Known exploited	High 8.8	A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format… Assigned by microsoft	Apr 15, 2020
CVE-2020-1027 Known exploited	High 7.8	An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Assigned by microsoft	Apr 15, 2020
CVE-2020-3161 Known exploited	Critical 9.8	Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability Assigned by cisco	Apr 15, 2020
CVE-2020-5732 Healthcare	Medium 6.1	In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. Assigned by tenable	Apr 17, 2020
CVE-2020-5733 Healthcare	Medium 6.1	In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. Assigned by tenable	Apr 17, 2020
CVE-2020-5728 Healthcare	Medium 6.1	OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). Assigned by tenable	Apr 17, 2020
CVE-2020-5729 Healthcare	Medium 6.1	In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS. Assigned by tenable	Apr 17, 2020

PreviousPage 27 of 2,031Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.