CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 10:30 UTC)

What this means for you

This week: 5,476 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,476; Show in the list
Critical, last 7 days: 358; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product torproject:tor. Show all products

14 CVEs, showing 1 to 14

CVE	Severity	Title	Published
CVE-2016-9079 Known exploited	High 7.5	A use-after-free vulnerability in SVG Animation has been discovered. Assigned by mozilla	Jun 11, 2018
CVE-2026-44597	Critical 9.1	Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.	May 7, 2026
CVE-2026-44599	Medium 5.3	Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.	May 7, 2026
CVE-2026-44600	Medium 5.3	Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010.	May 7, 2026
CVE-2026-44601	High 7.5	Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009.	May 7, 2026
CVE-2026-44602	High 7.5	Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.	May 7, 2026
CVE-2026-44603	Critical 9.1	Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.	May 7, 2026
CVE-2026-77584	High 7.0	Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. Assigned by mitre	Aug 20, 2026
CVE-2026-77587	Medium 5.9	Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. Assigned by mitre	Aug 20, 2026
CVE-2026-77638	High 8.9	Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach. Assigned by mitre	Aug 20, 2026
CVE-2026-77639	Medium 5.3	Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compressi… Assigned by mitre	Aug 20, 2026
CVE-2026-77640	Low 3.7	tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. Assigned by mitre	Aug 20, 2026
CVE-2026-77641	Medium 6.5	tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. Assigned by mitre	Aug 20, 2026
CVE-2026-77642	High 7.5	tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Assigned by mitre	Aug 20, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.