CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 08:30 UTC)

What this means for you

This week: 5,432 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,432; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product opensuse:leap. Show all products

123 CVEs, showing 1 to 50Page 1 of 3Next

CVE	Severity	Title	Published
CVE-2015-4902 Known exploited	Medium 5.3	Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment. Assigned by oracle	Oct 21, 2015
CVE-2015-8126	High 7.5	Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x… Assigned by mitre	Nov 13, 2015
CVE-2015-7575	Medium 5.9	Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in T… Assigned by redhat	Jan 9, 2016
CVE-2016-0752 Known exploited	High 7.5	Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read… Assigned by redhat	Feb 16, 2016
CVE-2016-1646 Known exploited	High 8.8	The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to c… Assigned by Chrome	Mar 29, 2016
CVE-2016-3427 Known exploited	Critical 9.8	Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vector… Assigned by oracle	Apr 21, 2016
CVE-2016-3718 Known exploited	Medium 5.5	The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Assigned by redhat	May 5, 2016
CVE-2016-3715 Known exploited	Medium 5.5	The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Assigned by redhat	May 5, 2016
CVE-2016-3714 Known exploited	High 8.4	The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code… Assigned by redhat	May 5, 2016
CVE-2016-0718	Critical 9.8	Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. Assigned by redhat	May 26, 2016
CVE-2016-5131	High 8.8	Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via… Assigned by Chrome	Jul 23, 2016
CVE-2016-10165	High 7.1	The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which… Assigned by mitre	Feb 3, 2017
CVE-2016-9841	Critical 9.8	inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Assigned by microfocus	May 23, 2017
CVE-2016-9840	High 8.8	inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Assigned by microfocus	May 23, 2017
CVE-2018-1115	Medium 4.2	postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. Assigned by redhat	May 10, 2018
CVE-2018-11212	Medium 6.5	An issue was discovered in libjpeg 9a and 9d. Assigned by mitre	May 16, 2018
CVE-2018-1000802	Critical 9.8	Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_arc… Assigned by mitre	Sep 18, 2018
CVE-2018-14647	High 7.5	Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.	Sep 25, 2018
CVE-2018-19542	Medium 6.5	An issue was discovered in JasPer 2.0.14. Assigned by mitre	Nov 26, 2018
CVE-2018-19539	Medium 6.5	An issue was discovered in JasPer 2.0.14. Assigned by mitre	Nov 26, 2018
CVE-2018-1000880	Medium 6.5	libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read… Assigned by mitre	Dec 20, 2018
CVE-2018-1000879	Medium 6.5	libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c… Assigned by mitre	Dec 20, 2018
CVE-2018-20482	Medium 4.7	GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c)… Assigned by mitre	Dec 26, 2018
CVE-2016-10739	Medium 5.3	In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, whic… Assigned by mitre	Jan 21, 2019
CVE-2019-8906	Medium 4.4	do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused. Assigned by mitre	Feb 18, 2019
CVE-2019-9636	Medium 5.3	Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. Assigned by mitre	Mar 8, 2019
CVE-2019-3859	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. Assigned by redhat	Mar 20, 2019
CVE-2019-3862	High 7.3	An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. Assigned by redhat	Mar 20, 2019
CVE-2019-3855	High 7.5	An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. Assigned by redhat	Mar 21, 2019
CVE-2019-3858	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. Assigned by redhat	Mar 21, 2019
CVE-2019-9923	High 7.5	pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers. Assigned by mitre	Mar 22, 2019
CVE-2019-9948	Critical 9.1	urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggerin… Assigned by mitre	Mar 23, 2019
CVE-2019-3863	High 7.5	A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. Assigned by redhat	Mar 25, 2019
CVE-2019-3861	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3860	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3857	High 7.5	An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3856	High 7.5	An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-5418 Known exploited	High 7.5	There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the targ… Assigned by hackerone	Mar 27, 2019
CVE-2019-0211 Known exploited	High 7.8	In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scrip… Assigned by apache	Apr 8, 2019
CVE-2019-11358 Healthcare	Medium 6.1	jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Assigned by mitre	Apr 19, 2019
CVE-2019-5436	High 7.8	A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. Assigned by hackerone	May 28, 2019
CVE-2019-8457	Critical 9.8	SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. Assigned by checkpoint	May 30, 2019
CVE-2019-10160	Critical 9.8	A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which s… Assigned by redhat	Jun 7, 2019
CVE-2019-12900	Critical 9.8	BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. Assigned by mitre	Jun 19, 2019
CVE-2019-12904	Medium 5.9	In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. Assigned by mitre	Jun 19, 2019
CVE-2018-20843	High 7.5	In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enoug… Assigned by mitre	Jun 24, 2019
CVE-2019-12972	Medium 5.5	An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. Assigned by mitre	Jun 26, 2019
CVE-2019-13602	High 7.8	An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow a… Assigned by mitre	Jul 14, 2019
CVE-2019-13962	Critical 9.8	lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height. Assigned by mitre	Jul 18, 2019
CVE-2019-14250	Medium 5.5	An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. Assigned by mitre	Jul 24, 2019

Page 1 of 3Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.