CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,433 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,433
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product redhat:openshift_container_platform. Show all products

103 CVEs, showing 1 to 50Page 1 of 3Next
CVESeverityTitlePublished
CVE-2018-5968High 8.1FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization fl…
Assigned by mitre
Jan 22, 2018
CVE-2017-7525Critical 9.8A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the malicious…
Assigned by redhat
Feb 6, 2018
CVE-2017-15095Critical 9.8A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously craft…
Assigned by redhat
Feb 6, 2018
CVE-2018-12115High 7.5In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()`…
Assigned by nodejs
Aug 21, 2018
CVE-2018-1000861
Known exploited
Critical 9.8A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that all…
Assigned by mitre
Dec 10, 2018
CVE-2018-19360Critical 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Assigned by mitre
Jan 2, 2019
CVE-2018-19362Critical 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Assigned by mitre
Jan 2, 2019
CVE-2018-19361Critical 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Assigned by mitre
Jan 2, 2019
CVE-2018-14721Critical 10.0FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic de…
Assigned by mitre
Jan 2, 2019
CVE-2018-14720Critical 9.8FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Assigned by mitre
Jan 2, 2019
CVE-2018-14718Critical 9.8FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
Assigned by mitre
Jan 2, 2019
CVE-2018-14719Critical 9.8FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deseriali…
Assigned by mitre
Jan 2, 2019
CVE-2019-1003030
Known exploited
Critical 9.9A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able t…
Assigned by jenkins
Mar 8, 2019
CVE-2019-1003029
Known exploited
Critical 9.9A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jen…
Assigned by jenkins
Mar 8, 2019
CVE-2019-9636Medium 5.3Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization.
Assigned by mitre
Mar 8, 2019
CVE-2018-12023High 7.5An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.
Assigned by mitre
Mar 17, 2019
CVE-2018-12022High 7.5An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.
Assigned by mitre
Mar 17, 2019
CVE-2019-7609
Known exploited
Critical 9.8Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer.
Assigned by elastic
Mar 25, 2019
CVE-2019-0211
Known exploited
High 7.8In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scrip…
Assigned by apache
Apr 8, 2019
CVE-2018-11307Critical 9.8An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5.
Assigned by mitre
Jul 9, 2019
CVE-2019-14379Critical 9.8SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), lead…
Assigned by mitre
Jul 29, 2019
CVE-2019-14892High 7.5A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2…
Assigned by redhat
Mar 2, 2020
CVE-2020-1712High 7.8A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages.
Assigned by redhat
Mar 31, 2020
CVE-2020-25639Medium 4.4A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC.
Assigned by redhat
Mar 4, 2021
CVE-2021-4104
Healthcare
High 7.5Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
Assigned by apache
Dec 14, 2021
CVE-2021-3560
Known exploited
High 7.8It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user.
Assigned by redhat
Feb 16, 2022
CVE-2023-44487
Known exploited
High 7.5The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Assigned by mitre
Oct 10, 2023
CVE-2023-48795Medium 5.9The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from…
Assigned by mitre
Dec 18, 2023
CVE-2024-1635High 7.5A vulnerability was found in Undertow.Feb 19, 2024
CVE-2024-6387High 8.1Openssh: regresshion - race condition in ssh allows rce/dos
Assigned by redhat
Jul 1, 2024
CVE-2024-9341Medium 5.4Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library
Assigned by redhat
Oct 1, 2024
CVE-2024-12085High 7.5Rsync: info leak via uninitialized stack contents
Assigned by redhat
Jan 14, 2025
CVE-2025-5914High 7.8Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c
Assigned by redhat
Jun 9, 2025
CVE-2025-6021High 7.5Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2
Assigned by redhat
Jun 12, 2025
CVE-2025-6170Low 2.5Libxml2: stack buffer overflow in xmllint interactive shell command handling
Assigned by redhat
Jun 16, 2025
CVE-2025-7424High 7.5Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes
Assigned by redhat
Jul 10, 2025
CVE-2025-13601High 7.7A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function.Nov 26, 2025
CVE-2026-0989Low 3.7A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled.Jan 15, 2026
CVE-2026-0990Medium 5.9A flaw was found in libxml2, an XML parsing library.Jan 15, 2026
CVE-2026-0992Low 2.9A flaw was found in the libxml2 library.Jan 15, 2026
CVE-2025-12801Medium 6.5Nfs-utils: rpc.mountd in the nfs-utils privilege escalation
Assigned by redhat
Mar 4, 2026
CVE-2026-3441High 7.1A flaw was found in GNU Binutils.Mar 16, 2026
CVE-2026-3442High 7.1A flaw was found in GNU Binutils.Mar 16, 2026
CVE-2026-4424High 7.5Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing
Assigned by redhat
Mar 19, 2026
CVE-2026-4426Medium 6.5A flaw was found in libarchive.Mar 19, 2026
CVE-2026-4647Medium 6.1A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables.Mar 23, 2026
CVE-2026-4897Medium 5.5A flaw was found in polkit.Mar 26, 2026
CVE-2026-0964Medium 6.3A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory.Mar 26, 2026
CVE-2026-0966High 8.2A flaw was found in libssh.Mar 26, 2026
CVE-2026-5121High 7.5Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing
Assigned by redhat
Mar 30, 2026
Page 1 of 3Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.