CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-20 21:00 UTC)

What this means for you

This week: 3,438 CVEs published, 258 critical, and 14 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,438; Show in the list
Critical, last 7 days: 258; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

101,916 CVEs, showing 2301 to 2350PreviousPage 47 of 2,039Next

CVE	Severity	Title	Published
CVE-2022-1292	Critical 9.8	The c_rehash script allows command injection Assigned by openssl	May 3, 2022
CVE-2022-1343	Medium 5.3	OCSP_basic_verify may incorrectly verify the response signing certificate Assigned by openssl	May 3, 2022
CVE-2022-1434	Medium 5.9	Incorrect MAC key used in the RC4-MD5 ciphersuite Assigned by openssl	May 3, 2022
CVE-2022-1473	High 7.5	Resource leakage when decoding certificates and keys Assigned by openssl	May 3, 2022
CVE-2022-29155	Critical 9.8	In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. Assigned by mitre	May 4, 2022
CVE-2022-29940 Healthcare	Medium 5.4	In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scripting (XSS) vulnerabilities. Assigned by mitre	May 5, 2022
CVE-2022-29939 Healthcare	Medium 5.4	In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scripting (XSS) vulnerabilities. Assigned by mitre	May 5, 2022
CVE-2022-29938 Healthcare	High 8.8	In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.php leads to SQL injection. Assigned by mitre	May 5, 2022
CVE-2022-1388 Known exploited	Critical 9.8	On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed… Assigned by f5	May 5, 2022
CVE-2022-29263	High 7.8	On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as we… Assigned by f5	May 5, 2022
CVE-2022-1616	High 7.3	Use after free in append_command in vim/vim Assigned by @huntrdev	May 7, 2022
CVE-2022-1620	Medium 6.6	NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in vim/vim Assigned by @huntrdev	May 8, 2022
CVE-2022-1619	Medium 6.1	Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim Assigned by @huntrdev	May 8, 2022
CVE-2022-30333 Known exploited	Critical 9.8	RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. Assigned by mitre	May 9, 2022
CVE-2021-43094 Healthcare	Critical 9.8	An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters in patient.page. Assigned by mitre	May 10, 2022
CVE-2022-26923 Known exploited	High 8.8	Active Directory Domain Services Elevation of Privilege Vulnerability Assigned by microsoft	May 10, 2022
CVE-2022-26925 Known exploited	High 8.1	Windows LSA Spoofing Vulnerability Assigned by microsoft	May 10, 2022
CVE-2022-29885	High 7.5	EncryptInterceptor does not provide complete protection on insecure networks Assigned by apache	May 12, 2022
CVE-2022-1674	Medium 6.6	NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in vim/vim Assigned by @huntrdev	May 12, 2022
CVE-2022-30525 Known exploited	Critical 9.8	A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 fi… Assigned by Zyxel	May 12, 2022
CVE-2022-29303 Known exploited	Critical 9.8	SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php. Assigned by mitre	May 12, 2022
CVE-2022-22970	Medium 5.3	In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a Multipar… Assigned by vmware	May 12, 2022
CVE-2022-22971	Medium 6.5	In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated… Assigned by vmware	May 12, 2022
CVE-2022-25762	High 8.6	Response mix-up with WebSocket concurrent send and close Assigned by apache	May 13, 2022
CVE-2022-1679	High 7.8	A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. Assigned by redhat	May 16, 2022
CVE-2021-32966 Healthcare	Low 3.7	Philips Interoperability Solution XDS - Clear Text Transmission of Sensitive Information Assigned by icscert	May 25, 2022
CVE-2022-1882	High 7.8	A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. Assigned by redhat	May 26, 2022
CVE-2022-22576	High 8.1	An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was au… Assigned by hackerone	May 26, 2022
CVE-2022-20821 Known exploited	Medium 6.5	Cisco IOS XR Software Health Check Open Port Vulnerability Assigned by cisco	May 26, 2022
CVE-2022-22674 Known exploited	Medium 5.5	An out-of-bounds read issue existed that led to the disclosure of kernel memory. Assigned by apple	May 26, 2022
CVE-2022-22675 Known exploited	High 7.8	An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple	May 26, 2022
CVE-2022-1462	Medium 6.3	An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. Assigned by redhat	May 31, 2022
CVE-2022-27782	High 7.5	libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection p… Assigned by hackerone	Jun 1, 2022
CVE-2022-27779	Medium 5.3	libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. Assigned by hackerone	Jun 1, 2022
CVE-2022-27781	High 7.5	libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make li… Assigned by hackerone	Jun 1, 2022
CVE-2022-27780	Medium 5.3	The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a different URL usingthe wrong host name when it is later retrieved.F… Assigned by hackerone	Jun 1, 2022
CVE-2022-27776	Medium 6.5	A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number. Assigned by hackerone	Jun 1, 2022
CVE-2022-27775	High 7.5	An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a conn… Assigned by hackerone	Jun 1, 2022
CVE-2022-27774	Medium 5.7	An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is… Assigned by hackerone	Jun 1, 2022
CVE-2022-30115	Medium 4.3	Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. Assigned by hackerone	Jun 1, 2022
CVE-2022-29875 Healthcare	Critical 9.8	A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, VA12S, VA10B, VA20A, VA30A, VA31A), MAMMOMAT Revelation (Al… Assigned by siemens	Jun 1, 2022
CVE-2022-22767 Healthcare	High 8.8	BD Pyxis™ Products – Default Credentials Assigned by BD	Jun 1, 2022
CVE-2022-30277 Healthcare	Medium 5.7	BD Synapsys™ – Insufficient Session Expiration Assigned by BD	Jun 1, 2022
CVE-2022-27778	High 8.1	A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`. Assigned by hackerone	Jun 1, 2022
CVE-2022-30190 Known exploited	High 7.8	Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability Assigned by microsoft	Jun 1, 2022
CVE-2022-32250	High 7.8	net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check l… Assigned by mitre	Jun 2, 2022
CVE-2022-26134 Known exploited	Critical 9.8	In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data… Assigned by atlassian	Jun 3, 2022
CVE-2022-32296	Low 3.3	The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. Assigned by mitre	Jun 5, 2022
CVE-2022-31493 Healthcare	Medium 6.1	LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS. Assigned by mitre	Jun 6, 2022
CVE-2022-31492 Healthcare	Medium 6.1	Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_add.php Username. Assigned by mitre	Jun 6, 2022

PreviousPage 47 of 2,039Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.