CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 07:30 UTC )
This week: 5,443 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,443 Show in the list Critical, last 7 days 355 Show in the list Healthcare-tagged, last 7 days 4 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product redhat:jboss_core_services . Show all products
23 CVEs, showing 1 to 23
CVE Severity Title Published CVE-2019-0211 Known exploited
High 7.8 In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scrip… Assigned by apache
Apr 8, 2019 CVE-2021-3537 Medium 5.9 A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. Assigned by redhat
May 14, 2021 CVE-2021-3518 High 8.8 There's a flaw in libxml2 in versions before 2.9.11. Assigned by redhat
May 18, 2021 CVE-2020-25709 High 7.5 A flaw was found in OpenLDAP. Assigned by redhat
May 18, 2021 CVE-2021-3517 High 8.6 There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. Assigned by redhat
May 19, 2021 CVE-2020-25710 High 7.5 A flaw was found in OpenLDAP in versions before 2.4.56. Assigned by redhat
May 28, 2021 CVE-2021-3516 High 7.8 There's a flaw in libxml2's xmllint in versions before 2.9.11. Assigned by redhat
Jun 1, 2021 CVE-2021-3541 Medium 6.5 A flaw was found in libxml2. Assigned by redhat
Jul 9, 2021 CVE-2021-40438 Known exploited
Critical 9.0 mod_proxy SSRF Assigned by apache
Sep 16, 2021 CVE-2023-44487 Known exploited
High 7.5 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Assigned by mitre
Oct 10, 2023 CVE-2024-8176 High 7.5 Libexpat: expat: improper restriction of xml entity expansion depth in libexpat Assigned by redhat
Mar 14, 2025 CVE-2025-6021 High 7.5 Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 Assigned by redhat
Jun 12, 2025 CVE-2025-49796 Critical 9.1 Libxml: type confusion leads to denial of service (dos) Assigned by redhat
Jun 16, 2025 CVE-2025-49795 High 7.5 Libxml: null pointer dereference leads to denial of service (dos) Assigned by redhat
Jun 16, 2025 CVE-2025-6170 Low 2.5 Libxml2: stack buffer overflow in xmllint interactive shell command handling Assigned by redhat
Jun 16, 2025 CVE-2025-49794 Critical 9.1 Libxml: heap use after free (uaf) leads to denial of service (dos) Assigned by redhat
Jun 16, 2025 CVE-2026-0989 Low 3.7 A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. Jan 15, 2026 CVE-2026-0990 Medium 5.9 A flaw was found in libxml2, an XML parsing library. Jan 15, 2026 CVE-2026-0992 Low 2.9 A flaw was found in the libxml2 library. Jan 15, 2026 CVE-2025-15467 High 8.8 Stack buffer overflow in CMS (Auth)EnvelopedData parsing Assigned by openssl
Jan 27, 2026 CVE-2026-27135 High 7.5 nghttp2 Denial of service: Assertion failure due to the missing state validation Assigned by GitHub_M
Mar 18, 2026 CVE-2026-6732 High 7.5 A flaw was found in libxml2. Apr 23, 2026 CVE-2026-45186 Low 2.9 In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. Assigned by mitre
May 10, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
