CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 15:00 UTC)

What this means for you

This week: 5,499 CVEs published, 356 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,499; Show in the list
Critical, last 7 days: 356; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product fedoraproject:fedora. Show all products

407 CVEs, showing 301 to 350PreviousPage 7 of 9Next

CVE	Severity	Title	Published
CVE-2022-2849	High 7.8	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Aug 17, 2022
CVE-2022-2845	High 7.8	Improper Validation of Specified Quantity in Input in vim/vim Assigned by @huntrdev	Aug 17, 2022
CVE-2021-28861	Medium 6.5	Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. Assigned by mitre	Aug 23, 2022
CVE-2021-3997	Medium 5.5	A flaw was found in systemd. Assigned by redhat	Aug 23, 2022
CVE-2022-2946	High 7.8	Use After Free in vim/vim Assigned by @huntrdev	Aug 23, 2022
CVE-2022-32893 Known exploited	High 8.8	An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple	Aug 24, 2022
CVE-2022-3028	High 7.0	A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. Assigned by redhat	Aug 31, 2022
CVE-2022-2153	Medium 5.5	A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. Assigned by redhat	Aug 31, 2022
CVE-2021-3826	Medium 6.5	Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symb… Assigned by redhat	Sep 1, 2022
CVE-2022-3169	Medium 5.5	A flaw was found in the Linux kernel. Assigned by redhat	Sep 9, 2022
CVE-2020-10735	Medium 6.2	A flaw was found in python. Assigned by redhat	Sep 9, 2022
CVE-2022-40674	High 8.1	libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. Assigned by mitre	Sep 14, 2022
CVE-2022-40768	Medium 5.5	drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case. Assigned by mitre	Sep 18, 2022
CVE-2022-2856 Known exploited	Medium 6.5	Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML pag… Assigned by Chrome	Sep 26, 2022
CVE-2022-3038 Known exploited	High 8.8	Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Sep 26, 2022
CVE-2022-3075 Known exploited	Critical 9.6	Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted… Assigned by Chrome	Sep 26, 2022
CVE-2022-42721	Medium 5.5	A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked lis… Assigned by mitre	Oct 13, 2022
CVE-2022-42722	Medium 5.5	In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the b… Assigned by mitre	Oct 13, 2022
CVE-2022-42720	High 7.8	Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger… Assigned by mitre	Oct 13, 2022
CVE-2022-42719	High 8.8	A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the ke… Assigned by mitre	Oct 13, 2022
CVE-2022-41674	High 8.1	An issue was discovered in the Linux kernel before 5.19.16. Assigned by mitre	Oct 13, 2022
CVE-2022-37454	Critical 9.8	The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic… Assigned by mitre	Oct 21, 2022
CVE-2022-43680	High 7.5	In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. Assigned by mitre	Oct 24, 2022
CVE-2021-46848	Critical 9.1	GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der. Assigned by mitre	Oct 24, 2022
CVE-2022-42915	High 8.1	curl before 7.86.0 has a double free. Assigned by mitre	Oct 29, 2022
CVE-2022-42916	High 7.5	In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Assigned by mitre	Oct 29, 2022
CVE-2022-3821	Medium 5.5	An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. Assigned by redhat	Nov 8, 2022
CVE-2022-45061	High 7.5	An issue was discovered in Python before 3.11.1. Assigned by mitre	Nov 9, 2022
CVE-2022-36227	Critical 9.8	In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer d… Assigned by mitre	Nov 22, 2022
CVE-2022-45873	Medium 5.5	systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. Assigned by mitre	Nov 23, 2022
CVE-2022-4129	Medium 5.5	A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). Assigned by redhat	Nov 28, 2022
CVE-2022-43551	High 7.5	A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Assigned by hackerone	Dec 23, 2022
CVE-2022-48303	Medium 5.5	GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Assigned by mitre	Jan 30, 2023
CVE-2023-25136	Medium 6.5	OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Assigned by mitre	Feb 3, 2023
CVE-2023-0361	High 7.4	A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. Assigned by redhat	Feb 15, 2023
CVE-2023-24329	High 7.5	An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. Assigned by mitre	Feb 17, 2023
CVE-2023-23916	Medium 6.5	An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed mult… Assigned by hackerone	Feb 23, 2023
CVE-2023-27534	High 8.8	A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its inte… Assigned by hackerone	Mar 30, 2023
CVE-2023-27535	Medium 5.9	An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Assigned by hackerone	Mar 30, 2023
CVE-2023-27538	High 7.7	An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have pr… Assigned by hackerone	Mar 30, 2023
CVE-2023-27536	Medium 5.9	An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to che… Assigned by hackerone	Mar 30, 2023
CVE-2023-27533	Critical 9.8	A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during serve… Assigned by hackerone	Mar 30, 2023
CVE-2023-2033 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Apr 14, 2023
CVE-2023-2136 Known exploited	Critical 9.6	Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Assigned by Chrome	Apr 19, 2023
CVE-2023-2269	Medium 4.4	A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub… Assigned by redhat	Apr 25, 2023
CVE-2023-3079 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jun 5, 2023
CVE-2023-34969	Medium 6.5	D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. Assigned by mitre	Jun 8, 2023
CVE-2023-20867 Known exploited	Low 3.9	VMware Tools Authentication Bypass Vulnerability Assigned by vmware	Jun 13, 2023
CVE-2023-3212	Medium 4.4	A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. Assigned by redhat	Jun 23, 2023
CVE-2023-1206	Medium 5.7	A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. Assigned by redhat	Jun 30, 2023

PreviousPage 7 of 9Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.