CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 09:00 UTC)

What this means for you

This week: 5,438 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,438; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

100,493 CVEs, showing 101 to 150PreviousPage 3 of 2,010Next

CVE	Severity	Title	Published
CVE-2012-0151 Known exploited	High 7.8	The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and… Assigned by microsoft	Apr 10, 2012
CVE-2012-1710 Known exploited	Critical 9.8	Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via u… Assigned by oracle	May 3, 2012
CVE-2012-1823 Known exploited	Critical 9.8	sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which al… Assigned by certcc	May 11, 2012
CVE-2012-0507 Known exploited	Critical 9.8	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to a… Assigned by oracle	Jun 7, 2012
CVE-2012-2034 Known exploited	High 7.5	Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and be… Assigned by adobe	Jun 9, 2012
CVE-2012-1889 Known exploited	High 8.8	Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi… Assigned by microsoft	Jun 13, 2012
CVE-2012-1723 Known exploited	Critical 9.8	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows r… Assigned by oracle	Jun 16, 2012
CVE-2012-1854 Known exploited	High 7.8	Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic… Assigned by microsoft	Jul 10, 2012
CVE-2012-2524	High 9.3	Microsoft Office 2007 SP2 and SP3 and 2010 SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Computer Graphics Metafile (CGM) file,… Assigned by microsoft	Aug 15, 2012
CVE-2012-1856 Known exploited	High 8.8	The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Se… Assigned by microsoft	Aug 15, 2012
CVE-2012-1535 Known exploited	High 7.8	Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of ser… Assigned by mitre	Aug 15, 2012
CVE-2012-4681 Known exploited	Critical 9.8	Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses S… Assigned by mitre	Aug 28, 2012
CVE-2012-2115 Healthcare	High 7.5	SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter. Assigned by redhat	Sep 9, 2012
CVE-2011-5161 Healthcare	Medium 6.8	Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension foll… Assigned by mitre	Sep 9, 2012
CVE-2011-5160 Healthcare	Medium 4.3	Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter. Assigned by mitre	Sep 9, 2012
CVE-2012-4969 Known exploited	High 8.1	Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as expl… Assigned by mitre	Sep 18, 2012
CVE-2012-5054 Known exploited	High 8.8	Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments. Assigned by adobe	Sep 24, 2012
CVE-2012-5076 Known exploited	Critical 9.8	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, rela… Assigned by oracle	Oct 16, 2012
CVE-2012-3152 Known exploited	Critical 9.1	Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via un… Assigned by oracle	Oct 16, 2012
CVE-2012-0518 Known exploited	Medium 4.7	Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to R… Assigned by oracle	Oct 16, 2012
CVE-2012-5885	Medium 5.0	The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka clien… Assigned by mitre	Nov 17, 2012
CVE-2012-5887	Medium 5.0	The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with… Assigned by mitre	Nov 17, 2012
CVE-2012-5886	Medium 5.0	The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session… Assigned by mitre	Nov 17, 2012
CVE-2012-5568	Medium 5.0	Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris. Assigned by redhat	Nov 30, 2012
CVE-2012-2539 Known exploited	High 7.8	Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a d… Assigned by microsoft	Dec 12, 2012
CVE-2012-4431	Medium 4.3	org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mecha… Assigned by redhat	Dec 19, 2012
CVE-2012-4534	Low 2.6	org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to… Assigned by redhat	Dec 19, 2012
CVE-2012-4792 Known exploited	High 8.8	Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not pro… Assigned by microsoft	Dec 30, 2012
CVE-2013-0631 Known exploited	High 7.5	Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013. Assigned by adobe	Jan 9, 2013
CVE-2013-0629 Known exploited	High 7.5	Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013. Assigned by adobe	Jan 9, 2013
CVE-2013-0625 Known exploited	Critical 9.8	Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited i… Assigned by adobe	Jan 9, 2013
CVE-2013-0422 Known exploited	Critical 9.8	Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a… Assigned by oracle	Jan 10, 2013
CVE-2013-0632 Known exploited	Critical 9.8	administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the defau… Assigned by adobe	Jan 17, 2013
CVE-2013-0431 Known exploited	Low 3.7	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandb… Assigned by oracle	Jan 31, 2013
CVE-2013-0641 Known exploited	High 7.8	Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in… Assigned by adobe	Feb 14, 2013
CVE-2013-0640 Known exploited	High 7.8	Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… Assigned by adobe	Feb 14, 2013
CVE-2013-0648 Known exploited	High 8.8	Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and… Assigned by adobe	Feb 27, 2013
CVE-2013-0643 Known exploited	High 8.8	The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly rest… Assigned by adobe	Feb 27, 2013
CVE-2013-2551 Known exploited	High 8.8	Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstr… Assigned by mitre	Mar 11, 2013
CVE-2013-0074 Known exploited	High 7.8	Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a cr… Assigned by microsoft	Mar 13, 2013
CVE-2013-0248	Medium 6.8	The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary f…	Mar 15, 2013
CVE-2013-2596 Known exploited	High 7.8	Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to crea… Assigned by mitre	Apr 13, 2013
CVE-2013-2423 Known exploited	Low 3.7	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors rel… Assigned by oracle	Apr 17, 2013
CVE-2013-1347 Known exploited	High 8.8	Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is… Assigned by microsoft	May 5, 2013
CVE-2013-2094 Known exploited	High 8.4	The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open… Assigned by redhat	May 14, 2013
CVE-2013-2729 Known exploited	High 8.8	Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerabilit… Assigned by adobe	May 16, 2013
CVE-2013-1675 Known exploited	Medium 6.5	Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mP… Assigned by mozilla	May 16, 2013
CVE-2013-3660 Known exploited	High 7.8	The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Wind… Assigned by mitre	May 24, 2013
CVE-2012-3544	Medium 5.0	Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming dat… Assigned by redhat	Jun 1, 2013
CVE-2013-2067	Medium 6.8	java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationship… Assigned by redhat	Jun 1, 2013

PreviousPage 3 of 2,010Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.