CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 20:23 UTC)

What this means for you

This week: 5,370 CVEs published, 344 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,370; Show in the list
Critical, last 7 days: 344; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

Showing CVEs that name the product debian:debian_linux. Show all products

948 CVEs, showing 751 to 800PreviousPage 16 of 19Next

CVE	Severity	Title	Published
CVE-2020-5258	High 7.7	Prototype pollution in dojo Assigned by GitHub_M	Mar 10, 2020
CVE-2020-10029	Medium 5.5	The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen… Assigned by mitre	Mar 4, 2020
CVE-2020-9547	Critical 9.8	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibati…	Mar 2, 2020
CVE-2020-9546	Critical 9.8	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hika…	Mar 2, 2020
CVE-2020-9548	Critical 9.8	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core). Assigned by mitre	Mar 2, 2020
CVE-2020-6418 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Feb 27, 2020
CVE-2020-1938 Known exploited	Critical 9.8	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Assigned by apache	Feb 24, 2020
CVE-2020-1935	Medium 4.8	In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as va… Assigned by apache	Feb 24, 2020
CVE-2020-8840	Critical 9.8	FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. Assigned by mitre	Feb 10, 2020
CVE-2020-8492	Medium 6.5	Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks agains… Assigned by mitre	Jan 30, 2020
CVE-2019-20444	Critical 9.1	HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invali… Assigned by mitre	Jan 29, 2020
CVE-2019-20445	Critical 9.1	HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. Assigned by mitre	Jan 29, 2020
CVE-2020-7247 Known exploited	Critical 9.8	smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated… Assigned by mitre	Jan 29, 2020
CVE-2020-7595	High 7.5	xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. Assigned by mitre	Jan 21, 2020
CVE-2019-20388	High 7.5	xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. Assigned by mitre	Jan 21, 2020
CVE-2019-20367	Critical 9.1	nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). Assigned by mitre	Jan 8, 2020
CVE-2019-5188	High 7.5	A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. Assigned by talos	Jan 8, 2020
CVE-2019-20330	Critical 9.8	FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. Assigned by mitre	Jan 3, 2020
CVE-2019-20218	High 7.5	selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error. Assigned by mitre	Jan 2, 2020
CVE-2019-19965	Medium 4.7	In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race… Assigned by mitre	Dec 25, 2019
CVE-2019-19925	High 7.5	zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. Assigned by mitre	Dec 24, 2019
CVE-2019-19923	High 7.5	flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. Assigned by mitre	Dec 24, 2019
CVE-2019-19956	High 7.5	xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs. Assigned by mitre	Dec 24, 2019
CVE-2019-12418	High 7.0	When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration f… Assigned by apache	Dec 23, 2019
CVE-2019-17563	High 7.5	When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. Assigned by apache	Dec 23, 2019
CVE-2019-19926	High 7.5	multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. Assigned by mitre	Dec 23, 2019
CVE-2019-19906	High 7.5	cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. Assigned by mitre	Dec 19, 2019
CVE-2019-19880	High 7.5	exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled. Assigned by mitre	Dec 18, 2019
CVE-2019-1551	Medium 5.3	rsaz_512_sqr overflow bug on x86_64 Assigned by openssl	Dec 6, 2019
CVE-2019-19530	Medium 4.6	In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka CID-c52873e5a1ef. Assigned by mitre	Dec 3, 2019
CVE-2013-4235	Medium 4.7	shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees Assigned by redhat	Dec 3, 2019
CVE-2019-19462	Medium 5.5	relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result. Assigned by mitre	Nov 30, 2019
CVE-2019-19126	Low 3.3	On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing… Assigned by mitre	Nov 19, 2019
CVE-2019-19066	Medium 4.7	A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering b… Assigned by mitre	Nov 18, 2019
CVE-2019-5010	High 7.5	An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6.	Oct 31, 2019
CVE-2019-11043 Known exploited	High 8.7	Underflow in PHP-FPM can lead to RCE Assigned by php	Oct 28, 2019
CVE-2019-17498	High 8.1	In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a s… Assigned by mitre	Oct 21, 2019
CVE-2019-17531	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Assigned by mitre	Oct 12, 2019
CVE-2019-2215 Known exploited	High 7.8	A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. Assigned by google_android	Oct 11, 2019
CVE-2019-17267	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.	Oct 7, 2019
CVE-2019-16943	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.	Oct 1, 2019
CVE-2019-16942	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Assigned by mitre	Oct 1, 2019
CVE-2019-16935	Medium 6.1	The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field.	Sep 28, 2019
CVE-2019-16928 Known exploited	Critical 9.8	Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Assigned by mitre	Sep 27, 2019
CVE-2019-16869	High 7.5	Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. Assigned by mitre	Sep 26, 2019
CVE-2019-5094	High 7.5	An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. Assigned by talos	Sep 24, 2019
CVE-2019-5482	Critical 9.8	Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Assigned by hackerone	Sep 16, 2019
CVE-2019-5481	Critical 9.8	Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. Assigned by hackerone	Sep 16, 2019
CVE-2019-16335	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. Assigned by mitre	Sep 15, 2019
CVE-2019-14540	Critical 9.8	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. Assigned by mitre	Sep 15, 2019

PreviousPage 16 of 19Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.