CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 08:23 UTC)

What this means for you

This week: 5,434 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,434; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product netapp:oncommand_system_manager. Show all products

10 CVEs, showing 1 to 10

CVE	Severity	Title	Published
CVE-2019-11358 Healthcare	Medium 6.1	jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Assigned by mitre	Apr 19, 2019
CVE-2019-12418	High 7.0	When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration f… Assigned by apache	Dec 23, 2019
CVE-2020-1935	Medium 4.8	In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as va… Assigned by apache	Feb 24, 2020
CVE-2020-1938 Known exploited	Critical 9.8	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Assigned by apache	Feb 24, 2020
CVE-2020-11022 Healthcare	Medium 6.9	jQuery has a potential XSS vulnerability Assigned by GitHub_M	Apr 29, 2020
CVE-2020-11023 Known exploited Healthcare	Medium 6.9	Potential XSS vulnerability in jQuery Assigned by GitHub_M	Apr 29, 2020
CVE-2020-11996	High 7.5	A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. Assigned by apache	Jun 26, 2020
CVE-2020-13934	High 7.5	An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. Assigned by apache	Jul 14, 2020
CVE-2020-13935	High 7.5	The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Assigned by apache	Jul 14, 2020
CVE-2020-17527	High 7.5	Apache Tomcat: Request header mix-up between HTTP/2 streams Assigned by apache	Dec 3, 2020

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.