CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 17:00 UTC)

What this means for you

This week: 5,369 CVEs published, 351 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,369; Show in the list
Critical, last 7 days: 351; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product debian:debian_linux. Show all products

947 CVEs, showing 501 to 550PreviousPage 11 of 19Next

CVE	Severity	Title	Published
CVE-2022-1462	Medium 6.3	An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. Assigned by redhat	May 31, 2022
CVE-2022-22576	High 8.1	An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was au… Assigned by hackerone	May 26, 2022
CVE-2022-1679	High 7.8	A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. Assigned by redhat	May 16, 2022
CVE-2022-29885	High 7.5	EncryptInterceptor does not provide complete protection on insecure networks Assigned by apache	May 12, 2022
CVE-2022-30333 Known exploited	Critical 9.8	RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. Assigned by mitre	May 9, 2022
CVE-2022-1619	Medium 6.1	Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim Assigned by @huntrdev	May 8, 2022
CVE-2022-1616	High 7.3	Use after free in append_command in vim/vim Assigned by @huntrdev	May 7, 2022
CVE-2022-29155	Critical 9.8	In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. Assigned by mitre	May 4, 2022
CVE-2022-1292	Critical 9.8	The c_rehash script allows command injection Assigned by openssl	May 3, 2022
CVE-2022-29824	Medium 6.5	In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf) and tree.c (xmlBuffer) don't check for integer overflows. Assigned by mitre	May 3, 2022
CVE-2018-25032	High 7.5	zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. Assigned by mitre	Mar 25, 2022
CVE-2022-0778	High 7.5	Infinite loop in BN_mod_sqrt() reachable when parsing certificates Assigned by openssl	Mar 15, 2022
CVE-2022-23960	Medium 5.6	Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. Assigned by mitre	Mar 12, 2022
CVE-2022-0492 Known exploited	High 7.8	A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. Assigned by redhat	Mar 3, 2022
CVE-2022-23308	High 7.5	valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. Assigned by mitre	Feb 26, 2022
CVE-2021-44533	Medium 5.3	Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Assigned by hackerone	Feb 24, 2022
CVE-2022-24407	High 8.8	In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. Assigned by mitre	Feb 23, 2022
CVE-2022-25314	High 7.5	In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. Assigned by mitre	Feb 18, 2022
CVE-2022-25315	Critical 9.8	In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Assigned by mitre	Feb 18, 2022
CVE-2022-25313	Medium 6.5	In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. Assigned by mitre	Feb 18, 2022
CVE-2022-25235	Critical 9.8	xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. Assigned by mitre	Feb 16, 2022
CVE-2022-25236	Critical 9.8	xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. Assigned by mitre	Feb 16, 2022
CVE-2021-3560 Known exploited	High 7.8	It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. Assigned by redhat	Feb 16, 2022
CVE-2022-0529	Medium 5.5	A flaw was found in Unzip. Assigned by redhat	Feb 9, 2022
CVE-2022-0530	Medium 5.5	A flaw was found in Unzip. Assigned by redhat	Feb 9, 2022
CVE-2022-23990	High 7.5	Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. Assigned by mitre	Jan 26, 2022
CVE-2021-22600 Known exploited	Medium 6.6	Double Free in net/packet/af_packet.c leading to priviledge escalation Assigned by Google	Jan 26, 2022
CVE-2022-0351	High 8.4	Access of Memory Location Before Start of Buffer in vim/vim Assigned by @huntrdev	Jan 25, 2022
CVE-2022-23852	Critical 9.8	Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. Assigned by mitre	Jan 24, 2022
CVE-2022-0235	Medium 6.1	node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor	Jan 16, 2022
CVE-2022-23219	Critical 9.8	The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may… Assigned by mitre	Jan 14, 2022
CVE-2022-23218	Critical 9.8	The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may… Assigned by mitre	Jan 14, 2022
CVE-2022-0213	Medium 6.8	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Jan 14, 2022
CVE-2022-23134 Known exploited	Low 3.7	Possible view of the setup pages by unauthenticated users if config file already exists Assigned by Zabbix	Jan 13, 2022
CVE-2022-22822	Critical 9.8	addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Assigned by mitre	Jan 8, 2022
CVE-2022-22823	Critical 9.8	build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Assigned by mitre	Jan 8, 2022
CVE-2022-22824	Critical 9.8	defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Assigned by mitre	Jan 8, 2022
CVE-2022-22825	High 8.8	lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Assigned by mitre	Jan 8, 2022
CVE-2022-22826	High 8.8	nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Assigned by mitre	Jan 8, 2022
CVE-2022-22827	High 8.8	storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Assigned by mitre	Jan 8, 2022
CVE-2021-45960	High 8.8	In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memo… Assigned by mitre	Jan 1, 2022
CVE-2021-45949	Medium 5.5	Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).	Jan 1, 2022
CVE-2021-4166	High 7.1	Out-of-bounds Read in vim/vim Assigned by @huntrdev	Dec 25, 2021
CVE-2021-45105 Healthcare	Medium 5.9	Apache Log4j2 does not always protect from infinite recursion in lookup evaluation Assigned by apache	Dec 18, 2021
CVE-2021-23450	High 7.5	Prototype Pollution Assigned by snyk	Dec 17, 2021
CVE-2021-0920 Known exploited	Medium 6.4	In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. Assigned by google_android	Dec 15, 2021
CVE-2021-45046 Known exploited	Critical 9.0	Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack Assigned by apache	Dec 14, 2021
CVE-2021-44228 Known exploited	Critical 10.0	Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints Assigned by apache	Dec 10, 2021
CVE-2021-43797	Medium 6.5	HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling Assigned by GitHub_M	Dec 9, 2021
CVE-2021-38003 Known exploited	High 8.8	Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Nov 23, 2021

PreviousPage 11 of 19Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.