CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 09:30 UTC)

What this means for you

This week: 5,436 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product fedoraproject:fedora. Show all products

407 CVEs, showing 101 to 150PreviousPage 3 of 9Next

CVE	Severity	Title	Published
CVE-2020-28949 Known exploited	High 7.8	Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. Assigned by mitre	Nov 19, 2020
CVE-2020-13671 Known exploited	High 8.8	Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP f… Assigned by drupal	Nov 20, 2020
CVE-2020-25649	High 7.5	A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Assigned by redhat	Dec 3, 2020
CVE-2020-29562	Medium 4.8	The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program,… Assigned by mitre	Dec 4, 2020
CVE-2020-8284	Low 3.7	A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about ser… Assigned by hackerone	Dec 14, 2020
CVE-2020-8285	High 7.5	curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. Assigned by hackerone	Dec 14, 2020
CVE-2020-8286	High 7.5	curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. Assigned by hackerone	Dec 14, 2020
CVE-2020-26258	High 7.7	XStream is a Java library to serialize objects to XML and back again.	Dec 16, 2020
CVE-2020-26259	Medium 6.8	XStream is a Java library to serialize objects to XML and back again.	Dec 16, 2020
CVE-2020-35730 Known exploited	Medium 6.1	An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. Assigned by mitre	Dec 28, 2020
CVE-2019-25013	Medium 5.9	The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. Assigned by mitre	Jan 4, 2021
CVE-2020-35493	Medium 5.5	A flaw exists in binutils in bfd/pef.c. Assigned by redhat	Jan 4, 2021
CVE-2020-35494	Medium 6.1	There's a flaw in binutils /opcodes/tic4x-dis.c. Assigned by redhat	Jan 4, 2021
CVE-2020-35495	Medium 5.5	There's a flaw in binutils /bfd/pef.c. Assigned by redhat	Jan 4, 2021
CVE-2020-35496	Medium 5.5	There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereferen… Assigned by redhat	Jan 4, 2021
CVE-2020-36193 Known exploited	High 7.5	Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948. Assigned by mitre	Jan 18, 2021
CVE-2021-3177	Critical 9.8	Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untru… Assigned by mitre	Jan 19, 2021
CVE-2021-3156 Known exploited	High 7.8	Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends wit… Assigned by mitre	Jan 26, 2021
CVE-2021-21148 Known exploited	High 8.8	Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Feb 9, 2021
CVE-2021-23336	Medium 5.9	Web Cache Poisoning Assigned by snyk	Feb 15, 2021
CVE-2021-27218	High 7.5	An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. Assigned by mitre	Feb 15, 2021
CVE-2021-27219	High 7.5	An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Assigned by mitre	Feb 15, 2021
CVE-2021-27645	Low 2.5	The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting… Assigned by mitre	Feb 24, 2021
CVE-2020-11987	High 8.2	Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. Assigned by apache	Feb 24, 2021
CVE-2020-25639	Medium 4.4	A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. Assigned by redhat	Mar 4, 2021
CVE-2021-28041	High 7.1	ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an… Assigned by mitre	Mar 5, 2021
CVE-2021-21166 Known exploited	High 8.8	Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Mar 9, 2021
CVE-2021-28153	Medium 5.3	An issue was discovered in GNOME GLib before 2.66.8. Assigned by mitre	Mar 11, 2021
CVE-2021-20231	Critical 9.8	A flaw was found in gnutls. Assigned by redhat	Mar 12, 2021
CVE-2021-20232	Critical 9.8	A flaw was found in gnutls. Assigned by redhat	Mar 12, 2021
CVE-2021-28363	Medium 6.5	The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. Assigned by mitre	Mar 15, 2021
CVE-2021-21193 Known exploited	High 8.8	Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Mar 16, 2021
CVE-2020-27170	Medium 4.7	An issue was discovered in the Linux kernel before 5.11.8. Assigned by mitre	Mar 20, 2021
CVE-2020-27171	Medium 6.0	An issue was discovered in the Linux kernel before 5.11.8. Assigned by mitre	Mar 20, 2021
CVE-2021-28972	Medium 6.7	In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace… Assigned by mitre	Mar 22, 2021
CVE-2021-21341	High 7.5	XStream is a Java library to serialize objects to XML and back again.	Mar 23, 2021
CVE-2021-21342	Critical 9.1	XStream is a Java library to serialize objects to XML and back again.	Mar 23, 2021
CVE-2021-21343	High 7.5	XStream is a Java library to serialize objects to XML and back again.	Mar 23, 2021
CVE-2021-21344	Critical 9.8	XStream is a Java library to serialize objects to XML and back again.	Mar 23, 2021
CVE-2021-21345	Critical 9.9	XStream is a Java library to serialize objects to XML and back again.	Mar 23, 2021
CVE-2021-21346	Critical 9.8	XStream is a Java library to serialize objects to XML and back again.	Mar 23, 2021
CVE-2021-21347	Critical 9.8	XStream is a Java library to serialize objects to XML and back again.	Mar 23, 2021
CVE-2021-21348	High 7.5	XStream is a Java library to serialize objects to XML and back again.	Mar 23, 2021
CVE-2021-21349	High 8.6	XStream is a Java library to serialize objects to XML and back again.	Mar 23, 2021
CVE-2021-21350	Critical 9.8	XStream is a Java library to serialize objects to XML and back again.	Mar 23, 2021
CVE-2021-21351	Critical 9.1	XStream is a Java library to serialize objects to XML and back again.	Mar 23, 2021
CVE-2021-3449	Medium 5.9	NULL pointer deref in signature_algorithms processing Assigned by openssl	Mar 25, 2021
CVE-2021-3450	High 7.4	CA certificate check bypass with X509_V_FLAG_X509_STRICT Assigned by openssl	Mar 25, 2021
CVE-2021-22876	Medium 5.3	curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. Assigned by hackerone	Apr 1, 2021
CVE-2021-22890	Medium 4.3	curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. Assigned by hackerone	Apr 1, 2021

PreviousPage 3 of 9Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.