InfoSec Signals™
Sign InStart Free

CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,199 CVEs published, 331 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

Published in the last 7 days
5,199
Show in the list
Critical, last 7 days
331
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,748
Show in the list
Clear
101,547 CVEs, showing 1501 to 1550PreviousPage 31 of 2,031Next
CVESeverityTitlePublished
CVE-2020-14304Medium 4.4A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of the device.Sep 15, 2020
CVE-2020-10781Medium 5.5A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM devic…
Assigned by redhat
Sep 16, 2020
CVE-2020-24750High 8.1FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
Assigned by mitre
Sep 17, 2020
CVE-2020-14390Medium 5.6A flaw was found in the Linux kernel in versions before 5.9-rc6.
Assigned by redhat
Sep 18, 2020
CVE-2020-14506
Healthcare
Low 3.4Philips Clinical Collaboration Platform Cross-site Request Forgery
Assigned by icscert
Sep 18, 2020
CVE-2020-14525
Healthcare
Low 3.5Philips Clinical Collaboration Platform Improper Neutralization of Script in Attributes in a Web Page
Assigned by icscert
Sep 18, 2020
CVE-2020-16198
Healthcare
Medium 5.0Philips Clinical Collaboration Platform Protection Mechanism Failure
Assigned by icscert
Sep 18, 2020
CVE-2020-16200
Healthcare
Medium 6.5Philips Clinical Collaboration Platform Algorithm Downgrade
Assigned by icscert
Sep 18, 2020
CVE-2020-16247
Healthcare
Medium 6.8Philips Clinical Collaboration Platform Configuration
Assigned by icscert
Sep 18, 2020
CVE-2020-5421
Healthcare
High 8.7RFD Protection Bypass via jsessionid
Assigned by pivotal
Sep 19, 2020
CVE-2020-3569
Known exploited
High 8.6Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities
Assigned by cisco
Sep 23, 2020
CVE-2020-12811Medium 4.9A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
Assigned by fortinet
Sep 24, 2020
CVE-2020-25223
Known exploited
Critical 9.8A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
Assigned by mitre
Sep 25, 2020
CVE-2020-24621
Healthcare
High 8.8A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS.
Assigned by mitre
Sep 25, 2020
CVE-2020-26116High 7.2http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by ins…
Assigned by mitre
Sep 27, 2020
CVE-2020-8243
Known exploited
High 7.2A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
Assigned by hackerone
Sep 29, 2020
CVE-2019-20920High 8.1Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution.
Assigned by mitre
Sep 30, 2020
CVE-2020-11979High 7.5As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them.
Assigned by apache
Oct 1, 2020
CVE-2020-24301
Healthcare
Medium 6.1Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's brow…
Assigned by mitre
Oct 8, 2020
CVE-2020-26919
Known exploited
Critical 9.8NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
Assigned by mitre
Oct 9, 2020
CVE-2020-5135
Known exploited
Critical 9.8A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.
Assigned by sonicwall
Oct 12, 2020
CVE-2020-13943Medium 4.3If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation o…
Assigned by apache
Oct 12, 2020
CVE-2020-15250Medium 5.5In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability.Oct 12, 2020
CVE-2020-9907
Known exploited
High 7.8A memory corruption issue was addressed by removing the vulnerable code.
Assigned by apple
Oct 16, 2020
CVE-2020-9934
Known exploited
Medium 5.5An issue existed in the handling of environment variables.
Assigned by apple
Oct 16, 2020
CVE-2020-3992
Known exploited
Critical 9.8OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue.
Assigned by vmware
Oct 20, 2020
CVE-2020-14871
Known exploited
Critical 10.0Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module).
Assigned by oracle
Oct 21, 2020
CVE-2020-14864
Known exploited
High 7.5Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation).
Assigned by oracle
Oct 21, 2020
CVE-2020-14883
Known exploited
High 7.2Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).
Assigned by oracle
Oct 21, 2020
CVE-2020-14882
Known exploited
Critical 9.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).
Assigned by oracle
Oct 21, 2020
CVE-2020-3580
Known exploited
Medium 6.1Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
Assigned by cisco
Oct 21, 2020
CVE-2020-27619Critical 9.8In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
Assigned by mitre
Oct 22, 2020
CVE-2020-8260
Known exploited
High 7.2A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
Assigned by hackerone
Oct 28, 2020
CVE-2018-19953
Known exploited
Medium 6.1If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.
Assigned by qnap
Oct 28, 2020
CVE-2018-19949
Known exploited
Critical 9.8If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands.
Assigned by qnap
Oct 28, 2020
CVE-2018-19943
Known exploited
High 8.0If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.
Assigned by qnap
Oct 28, 2020
CVE-2020-14750
Known exploited
Critical 9.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).
Assigned by oracle
Nov 1, 2020
CVE-2020-15999
Known exploited
Critical 9.6Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Assigned by Chrome
Nov 3, 2020
CVE-2020-16009
Known exploited
High 8.8Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Assigned by Chrome
Nov 3, 2020
CVE-2020-16010
Known exploited
Critical 9.6Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted…
Assigned by Chrome
Nov 3, 2020
CVE-2020-28196High 7.5MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite l…
Assigned by mitre
Nov 6, 2020
CVE-2020-16846
Known exploited
Critical 9.8An issue was discovered in SaltStack Salt through 3002.
Assigned by mitre
Nov 6, 2020
CVE-2020-25170
Healthcare
High 7.8B. Braun OnlineSuite
Assigned by icscert
Nov 6, 2020
CVE-2020-25174
Healthcare
High 7.8B. Braun OnlineSuite
Assigned by icscert
Nov 6, 2020
CVE-2020-25172
Healthcare
Critical 9.8B. Braun OnlineSuite
Assigned by icscert
Nov 6, 2020
CVE-2020-13927
Known exploited
Critical 9.8The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact.
Assigned by apache
Nov 10, 2020
CVE-2020-17087
Known exploited
High 7.8Windows Kernel Local Elevation of Privilege Vulnerability
Assigned by microsoft
Nov 11, 2020
CVE-2020-12321High 8.8Improper buffer restriction in some Intel(R) Wireless Bluetooth(R) products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Assigned by intel
Nov 12, 2020
CVE-2020-12322Medium 6.5Improper input validation in some Intel(R) Wireless Bluetooth(R) products before version 21.110 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Assigned by intel
Nov 12, 2020
CVE-2020-25165
Healthcare
High 7.5BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The affected products are vulnerable to a network session authentication vulnerabil…
Assigned by icscert
Nov 13, 2020
PreviousPage 31 of 2,031Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.