CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 10:00 UTC)

What this means for you

This week: 5,470 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,470; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product gnu:glibc. Show all products

48 CVEs, showing 1 to 48

CVE	Severity	Title	Published
CVE-2016-10228	Medium 5.9	The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an… Assigned by mitre	Mar 2, 2017
CVE-2018-19591	High 7.5	In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. Assigned by mitre	Dec 4, 2018
CVE-2019-6488	High 7.8	The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which ca… Assigned by mitre	Jan 18, 2019
CVE-2016-10739	Medium 5.3	In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, whic… Assigned by mitre	Jan 21, 2019
CVE-2019-7309	Medium 5.5	In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significan… Assigned by mitre	Feb 3, 2019
CVE-2019-9169	Critical 9.8	In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. Assigned by mitre	Feb 26, 2019
CVE-2019-1010022	Critical 9.8	GNU Libc current is affected by: Mitigation bypass. Assigned by dwf	Jul 15, 2019
CVE-2019-1010024	Medium 5.3	GNU Libc current is affected by: Mitigation bypass. Assigned by dwf	Jul 15, 2019
CVE-2019-1010023	Medium 5.4	GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. Assigned by dwf	Jul 15, 2019
CVE-2019-1010025	Medium 5.3	GNU Libc current is affected by: Mitigation bypass. Assigned by dwf	Jul 15, 2019
CVE-2019-19126	Low 3.3	On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing… Assigned by mitre	Nov 19, 2019
CVE-2020-10029	Medium 5.5	The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen… Assigned by mitre	Mar 4, 2020
CVE-2020-6096	High 8.1	An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Assigned by talos	Apr 1, 2020
CVE-2020-1751	Medium 5.1	An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Assigned by redhat	Apr 17, 2020
CVE-2020-1752	High 7.0	A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Assigned by redhat	Apr 30, 2020
CVE-2020-29562	Medium 4.8	The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program,… Assigned by mitre	Dec 4, 2020
CVE-2020-29573	High 7.5	sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long… Assigned by mitre	Dec 5, 2020
CVE-2019-25013	Medium 5.9	The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. Assigned by mitre	Jan 4, 2021
CVE-2021-3326	High 7.5	The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts th… Assigned by mitre	Jan 27, 2021
CVE-2021-27645	Low 2.5	The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting… Assigned by mitre	Feb 24, 2021
CVE-2020-27618	Medium 5.5	The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails t… Assigned by mitre	Feb 26, 2021
CVE-2021-33574	Critical 9.8	The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Assigned by mitre	May 25, 2021
CVE-2021-35942	Critical 9.1	The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially r… Assigned by mitre	Jul 22, 2021
CVE-2021-38604	High 7.5	In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. Assigned by mitre	Aug 12, 2021
CVE-2021-43396	High 7.5	In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an inter… Assigned by mitre	Nov 4, 2021
CVE-2022-23219	Critical 9.8	The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may… Assigned by mitre	Jan 14, 2022
CVE-2022-23218	Critical 9.8	The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may… Assigned by mitre	Jan 14, 2022
CVE-2021-3999	High 7.8	A flaw was found in glibc. Assigned by redhat	Aug 24, 2022
CVE-2021-3998	High 7.5	A flaw was found in glibc. Assigned by redhat	Aug 24, 2022
CVE-2023-25139	Critical 9.8	sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. Assigned by mitre	Feb 3, 2023
CVE-2023-0687	Medium 4.6	A vulnerability was found in GNU C Library 2.38. Assigned by VulDB	Feb 6, 2023
CVE-2023-4813	Medium 5.9	Glibc: potential use-after-free in gaih_inet() Assigned by redhat	Sep 12, 2023
CVE-2023-5156	High 7.5	Glibc: dos due to memory leak in getaddrinfo.c Assigned by redhat	Sep 25, 2023
CVE-2023-4911 Known exploited	High 7.8	Glibc: buffer overflow in ld.so leading to privilege escalation Assigned by redhat	Oct 3, 2023
CVE-2024-2961	High 7.3	The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may… Assigned by glibc	Apr 17, 2024
CVE-2024-33601	High 7.3	nscd: netgroup cache may terminate daemon on memory allocation failure Assigned by glibc	May 6, 2024
CVE-2024-33602	High 7.4	nscd: netgroup cache assumes NSS callback uses in-buffer strings Assigned by glibc	May 6, 2024
CVE-2026-0861	High 8.4	Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could co…	Jan 14, 2026
CVE-2026-0915	High 7.5	Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to…	Jan 15, 2026
CVE-2025-15281	High 7.5	Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which o…	Jan 20, 2026
CVE-2026-3904	Medium 6.2	Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on in… Assigned by glibc	Mar 11, 2026
CVE-2026-4437	High 7.5	gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response Assigned by glibc	Mar 20, 2026
CVE-2026-4438	Medium 5.4	gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames Assigned by glibc	Mar 20, 2026
CVE-2026-4046	High 7.5	iconv crash due to assertion failure with untrusted input Assigned by glibc	Mar 30, 2026
CVE-2026-5928	High 7.5	Potential buffer under-read in ungetwc Assigned by glibc	Apr 20, 2026
CVE-2026-5450	Critical 9.8	scanf %mc off-by-one heap buffer overflow Assigned by glibc	Apr 20, 2026
CVE-2026-5435	High 7.3	Potential buffer overflow in ns_sprintrrf TSIG handling path Assigned by glibc	Apr 28, 2026
CVE-2026-6238	Medium 6.5	Buffer overread in ns_printrrf with corrupted RDATA field Assigned by glibc	Apr 28, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.