InfoSec Signals™
Sign InStart Free

CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,477 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

Published in the last 7 days
5,477
Show in the list
Critical, last 7 days
360
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list
Clear

Showing CVEs that name the product fedoraproject:fedora. Show all products

407 CVEs, showing 201 to 250PreviousPage 5 of 9Next
CVESeverityTitlePublished
CVE-2021-39154High 8.5XStream is a simple library to serialize objects to XML and back again.Aug 23, 2021
CVE-2021-39140Medium 6.3XStream is a simple library to serialize objects to XML and back again.Aug 23, 2021
CVE-2021-39150High 8.5XStream is a simple library to serialize objects to XML and back again.Aug 23, 2021
CVE-2021-39152High 8.5XStream is a simple library to serialize objects to XML and back again.Aug 23, 2021
CVE-2021-30858
Known exploited
High 8.8A use after free issue was addressed with improved memory management.
Assigned by apple
Aug 24, 2021
CVE-2021-30952
Known exploited
High 8.8An integer overflow was addressed with improved input validation.
Assigned by apple
Aug 24, 2021
CVE-2021-40438
Known exploited
Critical 9.0mod_proxy SSRF
Assigned by apache
Sep 16, 2021
CVE-2021-22945Critical 9.1When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call t…
Assigned by hackerone
Sep 23, 2021
CVE-2021-41617High 7.0sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected.
Assigned by mitre
Sep 26, 2021
CVE-2021-22947Medium 5.9When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that c…
Assigned by hackerone
Sep 29, 2021
CVE-2021-22946High 7.5A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSES…
Assigned by hackerone
Sep 29, 2021
CVE-2021-41773
Known exploited
High 7.5Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
Assigned by apache
Oct 5, 2021
CVE-2021-39226
Known exploited
Critical 9.8Snapshot authentication bypass in grafana
Assigned by GitHub_M
Oct 5, 2021
CVE-2021-42013
Known exploited
Critical 9.8Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
Assigned by apache
Oct 7, 2021
CVE-2021-37975
Known exploited
High 8.8Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Assigned by Chrome
Oct 8, 2021
CVE-2021-30632
Known exploited
High 8.8Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Assigned by Chrome
Oct 8, 2021
CVE-2021-30633
Known exploited
Critical 9.6Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML p…
Assigned by Chrome
Oct 8, 2021
CVE-2021-37973
Known exploited
Critical 9.6Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Assigned by Chrome
Oct 8, 2021
CVE-2021-37976
Known exploited
Medium 6.5Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Assigned by Chrome
Oct 8, 2021
CVE-2021-3928High 7.3Use of Uninitialized Variable in vim/vim
Assigned by @huntrdev
Nov 5, 2021
CVE-2021-3927High 7.3Heap-based Buffer Overflow in vim/vim
Assigned by @huntrdev
Nov 5, 2021
CVE-2021-43975Medium 6.7In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-…
Assigned by mitre
Nov 17, 2021
CVE-2021-3974High 7.3Use After Free in vim/vim
Assigned by @huntrdev
Nov 19, 2021
CVE-2021-44026
Known exploited
Critical 9.8Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
Assigned by mitre
Nov 19, 2021
CVE-2021-3973High 7.3Heap-based Buffer Overflow in vim/vim
Assigned by @huntrdev
Nov 19, 2021
CVE-2021-3968High 8.0Heap-based Buffer Overflow in vim/vim
Assigned by @huntrdev
Nov 19, 2021
CVE-2021-38000
Known exploited
Medium 6.1Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
Assigned by Chrome
Nov 23, 2021
CVE-2021-38003
Known exploited
High 8.8Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Assigned by Chrome
Nov 23, 2021
CVE-2021-44228
Known exploited
Critical 10.0Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Assigned by apache
Dec 10, 2021
CVE-2021-4104
Healthcare
High 7.5Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
Assigned by apache
Dec 14, 2021
CVE-2021-45046
Known exploited
Critical 9.0Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
Assigned by apache
Dec 14, 2021
CVE-2021-4136High 7.3Heap-based Buffer Overflow in vim/vim
Assigned by @huntrdev
Dec 19, 2021
CVE-2021-4166High 7.1Out-of-bounds Read in vim/vim
Assigned by @huntrdev
Dec 25, 2021
CVE-2022-23134
Known exploited
Low 3.7Possible view of the setup pages by unauthenticated users if config file already exists
Assigned by Zabbix
Jan 13, 2022
CVE-2022-23990High 7.5Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
Assigned by mitre
Jan 26, 2022
CVE-2022-0391High 7.5A flaw was found in Python, specifically within the urllib.parse module.
Assigned by redhat
Feb 9, 2022
CVE-2022-21986High 7.5.NET Denial of Service Vulnerability
Assigned by microsoft
Feb 9, 2022
CVE-2022-0530Medium 5.5A flaw was found in Unzip.
Assigned by redhat
Feb 9, 2022
CVE-2022-0529Medium 5.5A flaw was found in Unzip.
Assigned by redhat
Feb 9, 2022
CVE-2022-25235Critical 9.8xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
Assigned by mitre
Feb 16, 2022
CVE-2022-25313Medium 6.5In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
Assigned by mitre
Feb 18, 2022
CVE-2022-25315Critical 9.8In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
Assigned by mitre
Feb 18, 2022
CVE-2022-25314High 7.5In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
Assigned by mitre
Feb 18, 2022
CVE-2021-20320Medium 5.5A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel.
Assigned by redhat
Feb 18, 2022
CVE-2022-24407High 8.8In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
Assigned by mitre
Feb 23, 2022
CVE-2022-23308High 7.5valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
Assigned by mitre
Feb 26, 2022
CVE-2022-0492
Known exploited
High 7.8A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function.
Assigned by redhat
Mar 3, 2022
CVE-2021-3737High 7.5A flaw was found in python.
Assigned by redhat
Mar 4, 2022
CVE-2022-0847
Known exploited
High 7.8A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus…
Assigned by redhat
Mar 7, 2022
CVE-2021-3733Medium 6.5There's a flaw in urllib's AbstractBasicAuthHandler class.
Assigned by redhat
Mar 7, 2022
PreviousPage 5 of 9Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.