CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-20 15:40 UTC)

What this means for you

This week: 5,069 CVEs published, 321 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,069; Show in the list
Critical, last 7 days: 321; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

101,722 CVEs, showing 2001 to 2050PreviousPage 41 of 2,035Next

CVE	Severity	Title	Published
CVE-2021-38398 Healthcare	Medium 6.5	Reliance on Component that is not Updateable for Boston Scientific Zoom Latitude Assigned by icscert	Oct 4, 2021
CVE-2021-38392 Healthcare	Medium 6.5	Improper Access Control for Boston Scientific Zoom Latitude Assigned by icscert	Oct 4, 2021
CVE-2021-38396 Healthcare	Medium 6.5	Missing Support Integrity Check for Boston Scientific Zoom Latitude Assigned by icscert	Oct 4, 2021
CVE-2021-38400 Healthcare	Medium 6.9	Use of Password Hash with Insufficient Computational Effort for Boston Scientific Zoom Latitude Assigned by icscert	Oct 4, 2021
CVE-2021-41773 Known exploited	High 7.5	Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 Assigned by apache	Oct 5, 2021
CVE-2021-39226 Known exploited	Critical 9.8	Snapshot authentication bypass in grafana Assigned by GitHub_M	Oct 5, 2021
CVE-2021-25487 Known exploited	High 7.3	Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid… Assigned by Samsung Mobile	Oct 6, 2021
CVE-2021-25489 Known exploited	Low 3.3	Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic. Assigned by Samsung Mobile	Oct 6, 2021
CVE-2021-42013 Known exploited	Critical 9.8	Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) Assigned by apache	Oct 7, 2021
CVE-2021-37975 Known exploited	High 8.8	Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Oct 8, 2021
CVE-2021-30632 Known exploited	High 8.8	Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Oct 8, 2021
CVE-2021-30633 Known exploited	Critical 9.6	Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML p… Assigned by Chrome	Oct 8, 2021
CVE-2021-37973 Known exploited	Critical 9.6	Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Assigned by Chrome	Oct 8, 2021
CVE-2021-37976 Known exploited	Medium 6.5	Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Assigned by Chrome	Oct 8, 2021
CVE-2021-40449 Known exploited	High 7.8	Win32k Elevation of Privilege Vulnerability Assigned by microsoft	Oct 13, 2021
CVE-2021-40450 Known exploited	High 7.8	Win32k Elevation of Privilege Vulnerability Assigned by microsoft	Oct 13, 2021
CVE-2021-41357 Known exploited	High 7.8	Win32k Elevation of Privilege Vulnerability Assigned by microsoft	Oct 13, 2021
CVE-2021-20123 Known exploited	High 7.5	A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. Assigned by tenable	Oct 13, 2021
CVE-2021-20124 Known exploited	High 7.5	A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. Assigned by tenable	Oct 13, 2021
CVE-2021-27561 Known exploited	Critical 9.8	Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. Assigned by mitre	Oct 15, 2021
CVE-2021-37137	High 7.5	The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Assigned by JFROG	Oct 19, 2021
CVE-2021-37136	High 7.5	The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). Assigned by JFROG	Oct 19, 2021
CVE-2021-30807 Known exploited	High 7.8	A memory corruption issue was addressed with improved memory handling. Assigned by apple	Oct 19, 2021
CVE-2021-42258 Known exploited	Critical 9.8	BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. Assigned by mitre	Oct 22, 2021
CVE-2021-43396	High 7.5	In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an inter… Assigned by mitre	Nov 4, 2021
CVE-2021-3928	High 7.3	Use of Uninitialized Variable in vim/vim Assigned by @huntrdev	Nov 5, 2021
CVE-2021-3927	High 7.3	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Nov 5, 2021
CVE-2021-42237 Known exploited	Critical 9.8	Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. Assigned by mitre	Nov 5, 2021
CVE-2021-41379 Known exploited	Medium 5.5	Windows Installer Elevation of Privilege Vulnerability Assigned by microsoft	Nov 10, 2021
CVE-2021-42278 Known exploited	High 7.5	Active Directory Domain Services Elevation of Privilege Vulnerability Assigned by microsoft	Nov 10, 2021
CVE-2021-42287 Known exploited	High 7.5	Active Directory Domain Services Elevation of Privilege Vulnerability Assigned by microsoft	Nov 10, 2021
CVE-2021-42292 Known exploited	High 7.8	Microsoft Excel Security Feature Bypass Vulnerability Assigned by microsoft	Nov 10, 2021
CVE-2021-42321 Known exploited	High 8.8	Microsoft Exchange Server Remote Code Execution Vulnerability Assigned by microsoft	Nov 10, 2021
CVE-2021-3572	Medium 5.7	A flaw was found in python-pip in the way it handled Unicode separators in git references. Assigned by redhat	Nov 10, 2021
CVE-2021-36323	High 7.5	Dell BIOS contains an improper input validation vulnerability. Assigned by dell	Nov 12, 2021
CVE-2021-36324	High 7.5	Dell BIOS contains an improper input validation vulnerability. Assigned by dell	Nov 12, 2021
CVE-2021-36325	High 7.5	Dell BIOS contains an improper input validation vulnerability. Assigned by dell	Nov 12, 2021
CVE-2021-43618	High 7.5	GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platform… Assigned by mitre	Nov 15, 2021
CVE-2021-43975	Medium 6.7	In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-… Assigned by mitre	Nov 17, 2021
CVE-2021-0146	Medium 6.8	Hardware allows activation of test or debug logic at runtime for some Intel(R) processors which may allow an unauthenticated user to potentially enable escalation of privilege via physical access. Assigned by intel	Nov 17, 2021
CVE-2021-41277 Known exploited	Critical 10.0	GeoJSON URL validation can expose server files and environment variables to unauthorized users Assigned by GitHub_M	Nov 17, 2021
CVE-2021-0157	Medium 6.7	Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.	Nov 17, 2021
CVE-2021-0158	Medium 6.7	Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.	Nov 17, 2021
CVE-2021-3974	High 7.3	Use After Free in vim/vim Assigned by @huntrdev	Nov 19, 2021
CVE-2021-44026 Known exploited	Critical 9.8	Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. Assigned by mitre	Nov 19, 2021
CVE-2021-3973	High 7.3	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Nov 19, 2021
CVE-2021-3968	High 8.0	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Nov 19, 2021
CVE-2021-26262 Healthcare	Medium 5.9	Philips MRI 1.5T and 3T Improper Access Control Assigned by icscert	Nov 19, 2021
CVE-2021-42744 Healthcare	Medium 5.9	Philips MRI 1.5T and 3T Information Exposure Assigned by icscert	Nov 19, 2021
CVE-2021-26248 Healthcare	Medium 5.9	Philips MRI 1.5T and 3T Incorrect Ownership Assignment Assigned by icscert	Nov 19, 2021

PreviousPage 41 of 2,035Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.