CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-20 22:50 UTC)

What this means for you

This week: 4,850 CVEs published, 323 critical, and 14 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 4,850; Show in the list
Critical, last 7 days: 323; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

103,378 CVEs, showing 2401 to 2450PreviousPage 49 of 2,068Next

CVE	Severity	Title	Published
CVE-2022-2287	High 8.0	Out-of-bounds Read in vim/vim Assigned by @huntrdev	Jul 2, 2022
CVE-2022-2286	High 7.8	Out-of-bounds Read in vim/vim Assigned by @huntrdev	Jul 2, 2022
CVE-2022-2284	High 7.8	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Jul 2, 2022
CVE-2022-2285	High 7.8	Integer Overflow or Wraparound in vim/vim Assigned by @huntrdev	Jul 2, 2022
CVE-2022-34918	High 7.8	An issue was discovered in the Linux kernel through 5.18.9. Assigned by mitre	Jul 4, 2022
CVE-2022-2304	High 7.8	Stack-based Buffer Overflow in vim/vim Assigned by @huntrdev	Jul 5, 2022
CVE-2022-2097	Medium 5.3	AES OCB fails to encrypt some bytes Assigned by openssl	Jul 5, 2022
CVE-2022-32208	Medium 5.9	When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. Assigned by hackerone	Jul 7, 2022
CVE-2022-32206	Medium 6.5	curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. Assigned by hackerone	Jul 7, 2022
CVE-2022-32207	Critical 9.8	When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In… Assigned by hackerone	Jul 7, 2022
CVE-2022-32205	Medium 4.3	A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. Assigned by hackerone	Jul 7, 2022
CVE-2022-2344	High 7.8	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Jul 8, 2022
CVE-2022-2343	High 7.8	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Jul 8, 2022
CVE-2022-2345	High 7.8	Use After Free in vim/vim Assigned by @huntrdev	Jul 8, 2022
CVE-2022-22047 Known exploited	High 7.8	Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability Assigned by microsoft	Jul 12, 2022
CVE-2021-4135	Medium 5.5	A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. Assigned by redhat	Jul 14, 2022
CVE-2022-26352 Known exploited	Critical 9.8	An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Assigned by mitre	Jul 17, 2022
CVE-2022-33891 Known exploited	High 8.8	Apache Spark shell command injection vulnerability via Spark UI Assigned by apache	Jul 18, 2022
CVE-2021-33656	Medium 6.8	When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds. Assigned by openEuler	Jul 18, 2022
CVE-2021-33655	Medium 6.7	When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds. Assigned by openEuler	Jul 18, 2022
CVE-2022-35405 Known exploited	Critical 9.8	Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. Assigned by mitre	Jul 19, 2022
CVE-2022-27544	Medium 5.0	HCL BigFix Web Reports authorized users may see sensitive information in clear text Assigned by HCL	Jul 19, 2022
CVE-2022-27545	Medium 4.6	HCL BigFix Web Reports authorized users may perform HTML injection. Assigned by HCL	Jul 19, 2022
CVE-2022-21518	Medium 6.5	Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: User Interface). Assigned by oracle	Jul 19, 2022
CVE-2021-46828	High 7.5	In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. Assigned by mitre	Jul 20, 2022
CVE-2022-26138 Known exploited	Critical 9.8	The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded p… Assigned by atlassian	Jul 20, 2022
CVE-2020-36558	Medium 5.1	A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault. Assigned by mitre	Jul 21, 2022
CVE-2022-36313	Medium 5.5	An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js.	Jul 21, 2022
CVE-2022-2327	High 7.5	Use-after-free in io_uring ad work_flags in Linux Kernel Assigned by Google	Jul 22, 2022
CVE-2022-2493 Healthcare	High 8.3	Data Access from Outside Expected Data Manager Component in openemr/openemr Assigned by @huntrdev	Jul 22, 2022
CVE-2022-2494 Healthcare	Medium 6.3	Cross-site Scripting (XSS) - Stored in openemr/openemr Assigned by @huntrdev	Jul 22, 2022
CVE-2022-1096 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jul 22, 2022
CVE-2022-2522	High 7.8	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Jul 25, 2022
CVE-2022-1364 Known exploited	High 8.8	Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jul 26, 2022
CVE-2022-36946	High 7.5	nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one… Assigned by mitre	Jul 27, 2022
CVE-2022-36879	Medium 5.5	An issue was discovered in the Linux kernel through 5.18.14. Assigned by mitre	Jul 27, 2022
CVE-2022-2294 Known exploited	High 8.8	Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jul 28, 2022
CVE-2016-3709	Medium 6.1	Possible cross-site scripting vulnerability in libxml after commit 960f0e2. Assigned by redhat	Jul 28, 2022
CVE-2022-36123	High 7.8	The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). Assigned by mitre	Jul 29, 2022
CVE-2022-2509	High 7.5	A vulnerability found in gnutls. Assigned by redhat	Aug 1, 2022
CVE-2022-2596	Medium 5.9	Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.	Aug 1, 2022
CVE-2022-35737	High 7.5	SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. Assigned by mitre	Aug 3, 2022
CVE-2022-28668 Healthcare	High 7.8	This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.9.2. Assigned by zdi	Aug 3, 2022
CVE-2022-2272 Healthcare	Critical 9.8	This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Assigned by zdi	Aug 3, 2022
CVE-2022-37434	Critical 9.8	zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. Assigned by mitre	Aug 5, 2022
CVE-2022-1012	High 8.2	A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. Assigned by redhat	Aug 5, 2022
CVE-2022-2730 Healthcare	Medium 6.5	Authorization Bypass Through User-Controlled Key in openemr/openemr Assigned by @huntrdev	Aug 9, 2022
CVE-2022-2729 Healthcare	Medium 5.4	Cross-site Scripting (XSS) - DOM in openemr/openemr Assigned by @huntrdev	Aug 9, 2022
CVE-2022-2731 Healthcare	Medium 5.4	Cross-site Scripting (XSS) - Reflected in openemr/openemr Assigned by @huntrdev	Aug 9, 2022
CVE-2022-2733 Healthcare	Critical 9.6	Cross-site Scripting (XSS) - Reflected in openemr/openemr Assigned by @huntrdev	Aug 9, 2022

PreviousPage 49 of 2,068Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.