CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 10:00 UTC)

What this means for you

This week: 5,470 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,470; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product x.org:x_server. Show all products

15 CVEs, showing 1 to 15

CVE	Severity	Title	Published
CVE-2025-62231	High 7.3	A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow.	Oct 30, 2025
CVE-2025-62230	High 7.3	A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup.	Oct 30, 2025
CVE-2026-34000	Critical 9.1	A flaw was found in the X.Org X server.	May 5, 2026
CVE-2026-34002	Critical 9.1	A flaw was found in the X.Org X server.	May 5, 2026
CVE-2026-50256	High 7.8	A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland.	Jun 5, 2026
CVE-2026-50257	High 7.8	A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence().	Jun 5, 2026
CVE-2026-50258	High 7.8	A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland.	Jun 5, 2026
CVE-2026-50259	High 7.8	A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland.	Jun 5, 2026
CVE-2026-50260	High 7.8	A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter().	Jun 5, 2026
CVE-2026-50261	High 7.8	A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter().	Jun 5, 2026
CVE-2026-50262	Medium 5.5	An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes().	Jun 5, 2026
CVE-2026-50263	Medium 5.5	A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow().	Jun 5, 2026
CVE-2026-50264	High 7.8	An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat.	Jun 5, 2026
CVE-2026-55999	High 7.8	Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyp…	Jul 8, 2026
CVE-2026-56000	High 7.8	Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() poi…	Jul 8, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.