CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 07:30 UTC)

What this means for you

This week: 5,443 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,443; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product fedoraproject:fedora. Show all products

407 CVEs, showing 1 to 50Page 1 of 9Next

CVE	Severity	Title	Published
CVE-2012-1823 Known exploited	Critical 9.8	sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which al… Assigned by certcc	May 11, 2012
CVE-2014-0160 Known exploited	High 7.5	The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process… Assigned by redhat	Apr 7, 2014
CVE-2015-3306 Known exploited	Critical 10.0	The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Assigned by mitre	May 18, 2015
CVE-2015-5477 Known exploited	High 7.5	named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries. Assigned by mitre	Jul 29, 2015
CVE-2015-8126	High 7.5	Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x… Assigned by mitre	Nov 13, 2015
CVE-2016-3674	High 7.5	Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStre… Assigned by mitre	May 17, 2016
CVE-2016-5195 Known exploited	High 7.0	Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-… Assigned by Chrome	Nov 10, 2016
CVE-2018-1060	Medium 4.3	python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. Assigned by redhat	Jun 18, 2018
CVE-2018-1061	Medium 6.5	python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. Assigned by redhat	Jun 19, 2018
CVE-2018-14647	High 7.5	Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.	Sep 25, 2018
CVE-2018-19591	High 7.5	In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. Assigned by mitre	Dec 4, 2018
CVE-2018-1000880	Medium 6.5	libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read… Assigned by mitre	Dec 20, 2018
CVE-2018-1000879	Medium 6.5	libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c… Assigned by mitre	Dec 20, 2018
CVE-2018-20406	High 7.5	Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. Assigned by mitre	Dec 23, 2018
CVE-2019-6109	Medium 6.8	An issue was discovered in OpenSSH 7.9. Assigned by mitre	Jan 31, 2019
CVE-2019-6111	Medium 5.9	An issue was discovered in OpenSSH 7.9. Assigned by mitre	Jan 31, 2019
CVE-2019-9636	Medium 5.3	Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. Assigned by mitre	Mar 8, 2019
CVE-2018-12023	High 7.5	An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. Assigned by mitre	Mar 17, 2019
CVE-2018-12022	High 7.5	An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. Assigned by mitre	Mar 17, 2019
CVE-2019-3859	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. Assigned by redhat	Mar 20, 2019
CVE-2019-3862	High 7.3	An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. Assigned by redhat	Mar 20, 2019
CVE-2019-3855	High 7.5	An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. Assigned by redhat	Mar 21, 2019
CVE-2019-3858	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. Assigned by redhat	Mar 21, 2019
CVE-2019-9948	Critical 9.1	urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggerin… Assigned by mitre	Mar 23, 2019
CVE-2019-3857	High 7.5	An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3856	High 7.5	An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-5418 Known exploited	High 7.5	There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the targ… Assigned by hackerone	Mar 27, 2019
CVE-2019-0211 Known exploited	High 7.8	In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scrip… Assigned by apache	Apr 8, 2019
CVE-2019-11358 Healthcare	Medium 6.1	jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Assigned by mitre	Apr 19, 2019
CVE-2019-5436	High 7.8	A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. Assigned by hackerone	May 28, 2019
CVE-2019-8457	Critical 9.8	SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. Assigned by checkpoint	May 30, 2019
CVE-2019-10160	Critical 9.8	A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which s… Assigned by redhat	Jun 7, 2019
CVE-2018-20843	High 7.5	In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enoug… Assigned by mitre	Jun 24, 2019
CVE-2019-13272 Known exploited	High 7.8	In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obta… Assigned by mitre	Jul 17, 2019
CVE-2019-1010228 Healthcare	Critical 9.8	OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. Assigned by dwf	Jul 22, 2019
CVE-2019-14379	Critical 9.8	SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), lead… Assigned by mitre	Jul 29, 2019
CVE-2019-14439	High 7.5	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. Assigned by mitre	Jul 30, 2019
CVE-2019-10086 Healthcare	High 7.3	In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Ja… Assigned by apache	Aug 20, 2019
CVE-2019-16056	Medium 5.3	An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. Assigned by mitre	Sep 6, 2019
CVE-2019-16168	Medium 6.5	In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the… Assigned by mitre	Sep 9, 2019
CVE-2019-14540	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. Assigned by mitre	Sep 15, 2019
CVE-2019-16335	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. Assigned by mitre	Sep 15, 2019
CVE-2019-5481	Critical 9.8	Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. Assigned by hackerone	Sep 16, 2019
CVE-2019-5482	Critical 9.8	Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Assigned by hackerone	Sep 16, 2019
CVE-2019-5094	High 7.5	An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. Assigned by talos	Sep 24, 2019
CVE-2019-16928 Known exploited	Critical 9.8	Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Assigned by mitre	Sep 27, 2019
CVE-2019-16942	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Assigned by mitre	Oct 1, 2019
CVE-2019-16943	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.	Oct 1, 2019
CVE-2019-17498	High 8.1	In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a s… Assigned by mitre	Oct 21, 2019
CVE-2019-11043 Known exploited	High 8.7	Underflow in PHP-FPM can lead to RCE Assigned by php	Oct 28, 2019

Page 1 of 9Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.