CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-20 12:00 UTC)

What this means for you

This week: 5,205 CVEs published, 331 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,205; Show in the list
Critical, last 7 days: 331; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

101,632 CVEs, showing 1801 to 1850PreviousPage 37 of 2,033Next

CVE	Severity	Title	Published
CVE-2021-22118 Healthcare	High 7.8	In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory,… Assigned by vmware	May 27, 2021
CVE-2021-27852 Known exploited	Critical 9.8	Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. Assigned by certcc	May 27, 2021
CVE-2020-25710	High 7.5	A flaw was found in OpenLDAP in versions before 2.4.56. Assigned by redhat	May 28, 2021
CVE-2021-29505	High 8.8	XStream is software for serializing Java objects to XML and back again.	May 28, 2021
CVE-2021-3516	High 7.8	There's a flaw in libxml2's xmllint in versions before 2.9.11. Assigned by redhat	Jun 1, 2021
CVE-2021-3520	Critical 9.8	There's a flaw in lz4. Assigned by redhat	Jun 2, 2021
CVE-2021-30533 Known exploited	Medium 6.5	Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe. Assigned by Chrome	Jun 7, 2021
CVE-2021-33560	High 7.5	Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen app… Assigned by mitre	Jun 8, 2021
CVE-2021-1675 Known exploited	High 7.8	Windows Print Spooler Remote Code Execution Vulnerability Assigned by microsoft	Jun 8, 2021
CVE-2021-31201 Known exploited	Medium 5.2	Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability Assigned by microsoft	Jun 8, 2021
CVE-2021-31199 Known exploited	Medium 5.2	Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability Assigned by microsoft	Jun 8, 2021
CVE-2021-31956 Known exploited	High 7.8	Windows NTFS Elevation of Privilege Vulnerability Assigned by microsoft	Jun 8, 2021
CVE-2021-31955 Known exploited	Medium 5.5	Windows Kernel Information Disclosure Vulnerability Assigned by microsoft	Jun 8, 2021
CVE-2021-33739 Known exploited	High 8.4	Microsoft DWM Core Library Elevation of Privilege Vulnerability Assigned by microsoft	Jun 8, 2021
CVE-2021-33742 Known exploited	High 7.5	Windows MSHTML Platform Remote Code Execution Vulnerability Assigned by microsoft	Jun 8, 2021
CVE-2021-31957	Medium 5.9	ASP.NET Core Denial of Service Vulnerability	Jun 8, 2021
CVE-2020-11261 Known exploited	High 7.8	Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Con… Assigned by qualcomm	Jun 9, 2021
CVE-2020-12357	Medium 6.7	Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Assigned by intel	Jun 9, 2021
CVE-2020-8670	Medium 6.4	Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Assigned by intel	Jun 9, 2021
CVE-2020-8700	Medium 6.7	Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Assigned by intel	Jun 9, 2021
CVE-2020-12358	Medium 4.4	Out of bounds write in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via local access. Assigned by intel	Jun 9, 2021
CVE-2021-0095	Medium 4.4	Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access. Assigned by intel	Jun 9, 2021
CVE-2020-24486	Medium 5.5	Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access. Assigned by intel	Jun 9, 2021
CVE-2020-24511	Medium 6.5	Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Assigned by intel	Jun 9, 2021
CVE-2020-24512	Low 3.3	Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Assigned by intel	Jun 9, 2021
CVE-2020-24513	Medium 6.5	Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Assigned by intel	Jun 9, 2021
CVE-2020-12359	Medium 6.8	Insufficient control flow management in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable escalation of privilege via physical access.	Jun 9, 2021
CVE-2020-12360	High 7.8	Out of bounds read in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.	Jun 9, 2021
CVE-2020-24489	High 8.8	Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access. Assigned by intel	Jun 9, 2021
CVE-2021-26829 Known exploited	Medium 5.4	OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm. Assigned by mitre	Jun 11, 2021
CVE-2021-26828 Known exploited	High 8.8	OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. Assigned by mitre	Jun 11, 2021
CVE-2021-25395 Known exploited	Medium 6.4	A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised. Assigned by Samsung Mobile	Jun 11, 2021
CVE-2021-25394 Known exploited	Medium 6.4	A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised. Assigned by Samsung Mobile	Jun 11, 2021
CVE-2021-22175 Known exploited	Medium 6.8	When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthen… Assigned by GitLab	Jun 11, 2021
CVE-2021-22898	Low 3.1	curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Assigned by hackerone	Jun 11, 2021
CVE-2021-22897	Medium 5.3	curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. Assigned by hackerone	Jun 11, 2021
CVE-2021-22901	High 8.1	curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. Assigned by hackerone	Jun 11, 2021
CVE-2021-27408 Healthcare	High 7.5	The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch A… Assigned by icscert	Jun 11, 2021
CVE-2021-27410 Healthcare	Critical 9.8	The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn medical device management tools (Welch Allyn Service Tool: ve… Assigned by icscert	Jun 11, 2021
CVE-2021-34693	Medium 5.5	net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. Assigned by mitre	Jun 14, 2021
CVE-2021-30551 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jun 15, 2021
CVE-2020-9493	Critical 9.8	A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.	Jun 16, 2021
CVE-2021-27489 Healthcare	High 8.8	ZOLL Defibrillator Dashboard, v prior to 2.2, The web application allows a non-administrative user to upload a malicious file. Assigned by icscert	Jun 16, 2021
CVE-2021-27481 Healthcare	Medium 5.5	ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcoded. Assigned by icscert	Jun 16, 2021
CVE-2021-27487 Healthcare	Medium 5.5	ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. Assigned by icscert	Jun 16, 2021
CVE-2021-27479 Healthcare	Medium 5.4	ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to inject parameters to contain malicious scripts to be executed by higher privile… Assigned by icscert	Jun 16, 2021
CVE-2021-27485 Healthcare	High 7.5	ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to retrieve the credentials from the web brow… Assigned by icscert	Jun 16, 2021
CVE-2021-27483 Healthcare	High 7.8	ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilege user to escalate privileges to an administrative level us… Assigned by icscert	Jun 16, 2021
CVE-2021-33624	Medium 4.7	In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory loca… Assigned by mitre	Jun 23, 2021
CVE-2021-25923 Healthcare	High 8.1	In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. Assigned by Mend	Jun 24, 2021

PreviousPage 37 of 2,033Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.