CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,499 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,499
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product radare:radare2. Show all products

31 CVEs, showing 1 to 31
CVESeverityTitlePublished
CVE-2025-60358Medium 5.5radare2 v.5.9.8 and before contains a memory leak in the function _load_relocations.Oct 16, 2025
CVE-2025-60359Medium 5.5radare2 v5.9.8 and before contains a memory leak in the function r_bin_object_new.Oct 17, 2025
CVE-2025-60360Medium 5.5radare2 v5.9.8 and before contains a memory leak in the function r2r_subprocess_init.Oct 17, 2025
CVE-2025-60361Low 3.3radare2 v5.9.8 and before contains a memory leak in the function bochs_open.Oct 17, 2025
CVE-2025-63744Medium 4.3A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c.Nov 14, 2025
CVE-2025-63745Medium 5.5A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c.Nov 14, 2025
CVE-2026-40499High 7.8radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in…Apr 15, 2026
CVE-2026-40527High 7.8radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_pa…Apr 17, 2026
CVE-2026-40517High 7.8radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with…Apr 22, 2026
CVE-2026-6940High 7.1radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the…Apr 23, 2026
CVE-2026-6941High 7.8radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to read or write files outside the configured project directory by importing a malic…Apr 23, 2026
CVE-2026-8695Critical 9.8radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed b…May 15, 2026
CVE-2026-8696Critical 9.8radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbi…May 15, 2026
CVE-2026-14757High 7.8A vulnerability was determined in radareorg radare2 up to 6.1.6.Jul 5, 2026
CVE-2026-14758Medium 5.5A vulnerability was identified in radareorg radare2 up to 6.1.6.Jul 5, 2026
CVE-2026-14759High 7.8A security flaw has been discovered in radareorg radare2 up to 6.1.6.Jul 5, 2026
CVE-2026-14760High 7.8A weakness has been identified in radareorg radare2 up to 6.1.6.Jul 5, 2026
CVE-2026-14761Medium 5.5A security vulnerability has been detected in radareorg radare2 up to 6.1.6.Jul 5, 2026
CVE-2026-14786Medium 5.5A security flaw has been discovered in radareorg radare2 up to 6.1.6.Jul 6, 2026
CVE-2026-14787High 7.8A weakness has been identified in radareorg radare2 up to 6.1.6.Jul 6, 2026
CVE-2026-14788High 7.8A security vulnerability has been detected in radareorg radare2 up to 6.1.6.Jul 6, 2026
CVE-2026-14789High 7.8A vulnerability was detected in radareorg radare2 up to 6.1.6.Jul 6, 2026
CVE-2026-81881Low 3.3radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-81878Medium 5.5radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-81879Medium 5.5radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-81880Medium 5.5radare2: Uncontrolled resource consumption in radare2 PEF loader
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-81884Low 2.5radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parser
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-81886Medium 5.5radare2: Uncontrolled memory allocation in radare2 dmp64 parser
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-81882Low 3.3radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-81885Medium 5.5radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-81883Low 3.3radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode
Assigned by GitHub_M
Sep 22, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.