CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 09:30 UTC)

What this means for you

This week: 5,436 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product debian:debian_linux. Show all products

947 CVEs, showing 201 to 250PreviousPage 5 of 19Next

CVE	Severity	Title	Published
CVE-2020-6078	High 7.5	An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. Assigned by talos	Mar 24, 2020
CVE-2020-6073	High 7.5	An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0.1.0. Assigned by talos	Mar 24, 2020
CVE-2020-6071	High 7.5	An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. Assigned by talos	Mar 24, 2020
CVE-2020-6072	Critical 9.8	An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. Assigned by talos	Mar 24, 2020
CVE-2020-6079	High 7.5	An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. Assigned by talos	Mar 24, 2020
CVE-2020-1712	High 7.8	A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. Assigned by redhat	Mar 31, 2020
CVE-2020-6096	High 8.1	An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Assigned by talos	Apr 1, 2020
CVE-2020-11494	Medium 4.4	An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. Assigned by mitre	Apr 2, 2020
CVE-2020-11501	High 7.4	GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. Assigned by mitre	Apr 3, 2020
CVE-2020-11619	High 8.1	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop… Assigned by mitre	Apr 7, 2020
CVE-2020-11620	High 8.1	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly). Assigned by mitre	Apr 7, 2020
CVE-2020-11655	High 7.5	SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled. Assigned by mitre	Apr 9, 2020
CVE-2020-1967	High 7.5	Segmentation fault in SSL_check_chain Assigned by openssl	Apr 21, 2020
CVE-2020-12243	High 7.5	In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash). Assigned by mitre	Apr 28, 2020
CVE-2020-11022 Healthcare	Medium 6.9	jQuery has a potential XSS vulnerability Assigned by GitHub_M	Apr 29, 2020
CVE-2020-11023 Known exploited Healthcare	Medium 6.9	Potential XSS vulnerability in jQuery Assigned by GitHub_M	Apr 29, 2020
CVE-2020-1752	High 7.0	A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Assigned by redhat	Apr 30, 2020
CVE-2020-11651 Known exploited	Critical 9.8	An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. Assigned by mitre	Apr 30, 2020
CVE-2020-11652 Known exploited	Medium 6.5	An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. Assigned by mitre	Apr 30, 2020
CVE-2020-12762	High 7.8	json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. Assigned by mitre	May 9, 2020
CVE-2020-12769	Medium 5.5	An issue was discovered in the Linux kernel before 5.4.17. Assigned by mitre	May 9, 2020
CVE-2020-9484	High 7.0	When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;… Assigned by apache	May 20, 2020
CVE-2020-13434	Medium 5.5	SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. Assigned by mitre	May 24, 2020
CVE-2020-13632	Medium 5.5	ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. Assigned by mitre	May 27, 2020
CVE-2020-13630	High 7.0	ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. Assigned by mitre	May 27, 2020
CVE-2020-13777	High 7.4	GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). Assigned by mitre	Jun 4, 2020
CVE-2020-13871	High 7.5	SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late. Assigned by mitre	Jun 6, 2020
CVE-2020-13965 Known exploited	Medium 6.3	An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. Assigned by mitre	Jun 9, 2020
CVE-2020-14062	High 8.1	FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2… Assigned by mitre	Jun 14, 2020
CVE-2020-14195	High 8.1	FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity). Assigned by mitre	Jun 16, 2020
CVE-2020-11996	High 7.5	A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. Assigned by apache	Jun 26, 2020
CVE-2019-20907	Medium 5.5	In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. Assigned by mitre	Jul 13, 2020
CVE-2020-13934	High 7.5	An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. Assigned by apache	Jul 14, 2020
CVE-2020-13935	High 7.5	The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Assigned by apache	Jul 14, 2020
CVE-2020-1472 Known exploited	Medium 5.5	Netlogon Elevation of Privilege Vulnerability Assigned by microsoft	Aug 17, 2020
CVE-2020-24616	High 8.1	FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). Assigned by mitre	Aug 25, 2020
CVE-2020-24977	Medium 6.5	GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. Assigned by mitre	Sep 3, 2020
CVE-2020-3702	Medium 6.5	u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the… Assigned by qualcomm	Sep 8, 2020
CVE-2020-10781	Medium 5.5	A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM devic… Assigned by redhat	Sep 16, 2020
CVE-2020-24750	High 8.1	FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. Assigned by mitre	Sep 17, 2020
CVE-2020-14390	Medium 5.6	A flaw was found in the Linux kernel in versions before 5.9-rc6. Assigned by redhat	Sep 18, 2020
CVE-2020-26116	High 7.2	http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by ins… Assigned by mitre	Sep 27, 2020
CVE-2020-13943	Medium 4.3	If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation o… Assigned by apache	Oct 12, 2020
CVE-2020-15250	Medium 5.5	In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability.	Oct 12, 2020
CVE-2020-15999 Known exploited	Critical 9.6	Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Nov 3, 2020
CVE-2020-16009 Known exploited	High 8.8	Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Nov 3, 2020
CVE-2020-16846 Known exploited	Critical 9.8	An issue was discovered in SaltStack Salt through 3002. Assigned by mitre	Nov 6, 2020
CVE-2020-26217	High 8.8	XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.	Nov 16, 2020
CVE-2020-28949 Known exploited	High 7.8	Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. Assigned by mitre	Nov 19, 2020
CVE-2020-29374	Low 3.6	An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. Assigned by mitre	Nov 28, 2020

PreviousPage 5 of 19Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.