CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-20 11:20 UTC)

What this means for you

This week: 5,202 CVEs published, 330 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,202; Show in the list
Critical, last 7 days: 330; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

101,622 CVEs, showing 1751 to 1800PreviousPage 36 of 2,033Next

CVE	Severity	Title	Published
CVE-2021-3493 Known exploited	High 8.8	The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Assigned by canonical	Apr 17, 2021
CVE-2021-20023 Known exploited	Medium 4.9	SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host. Assigned by sonicwall	Apr 20, 2021
CVE-2021-22893 Known exploited	Critical 10.0	Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect… Assigned by hackerone	Apr 23, 2021
CVE-2021-22204 Known exploited	Medium 6.8	Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image Assigned by GitLab	Apr 23, 2021
CVE-2021-22205 Known exploited	Critical 10.0	An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Assigned by GitLab	Apr 23, 2021
CVE-2021-21220 Known exploited	High 8.8	Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Apr 26, 2021
CVE-2021-21206 Known exploited	High 8.8	Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Apr 26, 2021
CVE-2021-21224 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Assigned by Chrome	Apr 26, 2021
CVE-2021-20090 Known exploited	Critical 9.8	A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass… Assigned by tenable	Apr 29, 2021
CVE-2020-36327	High 8.8	Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chos… Assigned by mitre	Apr 29, 2021
CVE-2021-31879	Medium 6.1	GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007. Assigned by mitre	Apr 29, 2021
CVE-2021-23383	Medium 5.6	Prototype Pollution Assigned by snyk	May 4, 2021
CVE-2021-21551 Known exploited	High 8.8	Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Assigned by dell	May 4, 2021
CVE-2021-25317	Low 3.3	cups: ownership of /var/log/cups allows the lp user to create files as root Assigned by suse	May 5, 2021
CVE-2021-29921	Critical 9.8	In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. Assigned by mitre	May 6, 2021
CVE-2021-1497 Known exploited	Critical 9.8	Cisco HyperFlex HX Command Injection Vulnerabilities Assigned by cisco	May 6, 2021
CVE-2021-1498 Known exploited	Critical 9.8	Cisco HyperFlex HX Command Injection Vulnerabilities Assigned by cisco	May 6, 2021
CVE-2021-32030 Known exploited	Critical 9.8	The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticat… Assigned by mitre	May 6, 2021
CVE-2021-32104 Healthcare	High 8.8	A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1. Assigned by mitre	May 7, 2021
CVE-2021-32103 Healthcare	Medium 4.8	A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter. Assigned by mitre	May 7, 2021
CVE-2021-32102 Healthcare	High 8.8	A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1. Assigned by mitre	May 7, 2021
CVE-2021-32101 Healthcare	High 8.2	The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. Assigned by mitre	May 7, 2021
CVE-2021-1906 Known exploited	Medium 6.2	Improper handling of address deregistration on failure can lead to new GPU address allocation failure. Assigned by qualcomm	May 7, 2021
CVE-2021-1905 Known exploited	High 8.4	Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. Assigned by qualcomm	May 7, 2021
CVE-2021-31755 Known exploited	Critical 9.8	An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. Assigned by mitre	May 7, 2021
CVE-2021-28664 Known exploited	High 8.8	The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. Assigned by mitre	May 10, 2021
CVE-2021-28663 Known exploited	High 8.8	The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. Assigned by mitre	May 10, 2021
CVE-2020-13529	Medium 6.1	An exploitable denial-of-service vulnerability exists in Systemd 245. Assigned by talos	May 10, 2021
CVE-2021-32053 Healthcare	Medium 5.3	JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. Assigned by mitre	May 10, 2021
CVE-2021-31166 Known exploited	Critical 9.8	HTTP Protocol Stack Remote Code Execution Vulnerability Assigned by microsoft	May 11, 2021
CVE-2021-31207 Known exploited	Medium 6.6	Microsoft Exchange Server Security Feature Bypass Vulnerability Assigned by microsoft	May 11, 2021
CVE-2021-31204	High 7.3	.NET and Visual Studio Elevation of Privilege Vulnerability	May 11, 2021
CVE-2020-26144	Medium 6.5	An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. Assigned by mitre	May 11, 2021
CVE-2020-26140	Medium 6.5	An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. Assigned by mitre	May 11, 2021
CVE-2021-28799 Known exploited	Critical 10.0	Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync) Assigned by qnap	May 13, 2021
CVE-2021-3537	Medium 5.9	A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. Assigned by redhat	May 14, 2021
CVE-2021-3518	High 8.8	There's a flaw in libxml2 in versions before 2.9.11. Assigned by redhat	May 18, 2021
CVE-2020-25709	High 7.5	A flaw was found in OpenLDAP. Assigned by redhat	May 18, 2021
CVE-2021-3517	High 8.6	There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. Assigned by redhat	May 19, 2021
CVE-2021-3426	Medium 5.7	There's a flaw in Python 3's pydoc. Assigned by redhat	May 20, 2021
CVE-2021-28111 Healthcare	High 8.8	Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote code execution by an authenticated attacker. Assigned by mitre	May 20, 2021
CVE-2021-28112 Healthcare	High 8.8	Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to remote code execution by an authenticated attacker. Assigned by mitre	May 20, 2021
CVE-2021-20722	High 7.8	Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prior to WinSSInst2JP.exe and WinSSInst2iX1500JP.exe allows an…	May 24, 2021
CVE-2021-29256 Known exploited	High 8.8	. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. Assigned by mitre	May 24, 2021
CVE-2021-33574	Critical 9.8	The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Assigned by mitre	May 25, 2021
CVE-2021-27562 Known exploited	Medium 5.5	In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mod… Assigned by mitre	May 25, 2021
CVE-2021-21985 Known exploited	Critical 9.8	The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. Assigned by vmware	May 26, 2021
CVE-2021-22894 Known exploited	High 8.8	A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room. Assigned by hackerone	May 27, 2021
CVE-2021-22899 Known exploited	High 8.8	A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature Assigned by hackerone	May 27, 2021
CVE-2021-22900 Known exploited	High 7.2	A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archi… Assigned by hackerone	May 27, 2021

PreviousPage 36 of 2,033Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.