CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 06:30 UTC)

What this means for you

This week: 5,437 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,437; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product oracle:http_server. Show all products

25 CVEs, showing 1 to 25

CVE	Severity	Title	Published
CVE-2019-0211 Known exploited	High 7.8	In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scrip… Assigned by apache	Apr 8, 2019
CVE-2018-20843	High 7.5	In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enoug… Assigned by mitre	Jun 24, 2019
CVE-2019-5443	High 7.8	A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine")… Assigned by hackerone	Jul 2, 2019
CVE-2019-5482	Critical 9.8	Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Assigned by hackerone	Sep 16, 2019
CVE-2019-10219 Healthcare	Medium 6.5	A vulnerability was found in Hibernate-Validator. Assigned by redhat	Nov 8, 2019
CVE-2020-1967	High 7.5	Segmentation fault in SSL_check_chain Assigned by openssl	Apr 21, 2020
CVE-2020-24977	Medium 6.5	GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. Assigned by mitre	Sep 3, 2020
CVE-2021-40438 Known exploited	Critical 9.0	mod_proxy SSRF Assigned by apache	Sep 16, 2021
CVE-2021-41617	High 7.0	sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Assigned by mitre	Sep 26, 2021
CVE-2021-4034 Known exploited	High 7.8	A local privilege escalation vulnerability was found on polkit's pkexec utility. Assigned by redhat	Jan 28, 2022
CVE-2022-0391	High 7.5	A flaw was found in Python, specifically within the urllib.parse module. Assigned by redhat	Feb 9, 2022
CVE-2022-25236	Critical 9.8	xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. Assigned by mitre	Feb 16, 2022
CVE-2022-25235	Critical 9.8	xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. Assigned by mitre	Feb 16, 2022
CVE-2022-25313	Medium 6.5	In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. Assigned by mitre	Feb 18, 2022
CVE-2022-25315	Critical 9.8	In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Assigned by mitre	Feb 18, 2022
CVE-2022-25314	High 7.5	In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. Assigned by mitre	Feb 18, 2022
CVE-2026-21962 Known exploited	Critical 10.0	Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Pro… Assigned by oracle	Jan 20, 2026
CVE-2026-34291	High 8.7	Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core).	Apr 21, 2026
CVE-2026-60363	Critical 9.8	Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin).	Jul 21, 2026
CVE-2026-60364	Critical 9.8	Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).	Jul 21, 2026
CVE-2026-60365	Critical 10.0	Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).	Jul 21, 2026
CVE-2026-60431	High 8.6	Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy).	Jul 21, 2026
CVE-2026-60438	Critical 9.1	Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl).	Jul 21, 2026
CVE-2026-60454	High 7.8	Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core).	Jul 21, 2026
CVE-2026-60530	High 7.8	Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so).	Jul 21, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.