CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 06:40 UTC)

What this means for you

This week: 5,437 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,437; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product canonical:ubuntu_linux. Show all products

206 CVEs, showing 51 to 100PreviousPage 2 of 5Next

CVE	Severity	Title	Published
CVE-2020-9484	High 7.0	When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;… Assigned by apache	May 20, 2020
CVE-2020-12769	Medium 5.5	An issue was discovered in the Linux kernel before 5.4.17. Assigned by mitre	May 9, 2020
CVE-2019-20795	Medium 4.4	iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. Assigned by mitre	May 9, 2020
CVE-2020-12762	High 7.8	json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. Assigned by mitre	May 9, 2020
CVE-2020-11652 Known exploited	Medium 6.5	An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. Assigned by mitre	Apr 30, 2020
CVE-2020-11651 Known exploited	Critical 9.8	An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. Assigned by mitre	Apr 30, 2020
CVE-2020-1752	High 7.0	A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Assigned by redhat	Apr 30, 2020
CVE-2020-12243	High 7.5	In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash). Assigned by mitre	Apr 28, 2020
CVE-2020-1751	Medium 5.1	An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Assigned by redhat	Apr 17, 2020
CVE-2020-11655	High 7.5	SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled. Assigned by mitre	Apr 9, 2020
CVE-2020-11609	Medium 4.3	An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. Assigned by mitre	Apr 7, 2020
CVE-2020-11501	High 7.4	GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. Assigned by mitre	Apr 3, 2020
CVE-2020-11494	Medium 4.4	An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. Assigned by mitre	Apr 2, 2020
CVE-2020-10531	High 8.8	An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. Assigned by mitre	Mar 12, 2020
CVE-2020-10029	Medium 5.5	The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen… Assigned by mitre	Mar 4, 2020
CVE-2019-17026 Known exploited	High 8.8	Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. Assigned by mozilla	Mar 2, 2020
CVE-2020-1935	Medium 4.8	In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as va… Assigned by apache	Feb 24, 2020
CVE-2020-9327	High 7.5	In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations. Assigned by mitre	Feb 21, 2020
CVE-2019-9674	High 7.5	Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. Assigned by mitre	Feb 4, 2020
CVE-2020-8492	Medium 6.5	Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks agains… Assigned by mitre	Jan 30, 2020
CVE-2019-20444	Critical 9.1	HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invali… Assigned by mitre	Jan 29, 2020
CVE-2019-20445	Critical 9.1	HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. Assigned by mitre	Jan 29, 2020
CVE-2020-7247 Known exploited	Critical 9.8	smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated… Assigned by mitre	Jan 29, 2020
CVE-2020-7595	High 7.5	xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. Assigned by mitre	Jan 21, 2020
CVE-2019-20367	Critical 9.1	nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). Assigned by mitre	Jan 8, 2020
CVE-2019-5188	High 7.5	A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. Assigned by talos	Jan 8, 2020
CVE-2019-19959	High 7.5	ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by… Assigned by mitre	Jan 3, 2020
CVE-2019-20218	High 7.5	selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error. Assigned by mitre	Jan 2, 2020
CVE-2019-19965	Medium 4.7	In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race… Assigned by mitre	Dec 25, 2019
CVE-2019-19956	High 7.5	xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs. Assigned by mitre	Dec 24, 2019
CVE-2019-12418	High 7.0	When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration f… Assigned by apache	Dec 23, 2019
CVE-2019-17563	High 7.5	When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. Assigned by apache	Dec 23, 2019
CVE-2019-19906	High 7.5	cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. Assigned by mitre	Dec 19, 2019
CVE-2019-1551	Medium 5.3	rsaz_512_sqr overflow bug on x86_64 Assigned by openssl	Dec 6, 2019
CVE-2019-19462	Medium 5.5	relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result. Assigned by mitre	Nov 30, 2019
CVE-2019-19244	High 7.5	sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. Assigned by mitre	Nov 25, 2019
CVE-2019-19242	Medium 5.9	SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c. Assigned by mitre	Nov 25, 2019
CVE-2019-19126	Low 3.3	On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing… Assigned by mitre	Nov 19, 2019
CVE-2019-19083	Medium 4.7	Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption). Assigned by mitre	Nov 18, 2019
CVE-2019-19082	Medium 4.7	Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption). Assigned by mitre	Nov 18, 2019
CVE-2019-19066	Medium 4.7	A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering b… Assigned by mitre	Nov 18, 2019
CVE-2019-19054	Medium 4.7	A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by tri… Assigned by mitre	Nov 18, 2019
CVE-2019-11043 Known exploited	High 8.7	Underflow in PHP-FPM can lead to RCE Assigned by php	Oct 28, 2019
CVE-2019-2215 Known exploited	High 7.8	A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. Assigned by google_android	Oct 11, 2019
CVE-2019-16866	High 7.5	Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. Assigned by mitre	Oct 3, 2019
CVE-2019-16935	Medium 6.1	The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field.	Sep 28, 2019
CVE-2019-16928 Known exploited	Critical 9.8	Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Assigned by mitre	Sep 27, 2019
CVE-2019-16869	High 7.5	Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. Assigned by mitre	Sep 26, 2019
CVE-2019-13627	Medium 6.3	It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Assigned by mitre	Sep 25, 2019
CVE-2019-5094	High 7.5	An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. Assigned by talos	Sep 24, 2019

PreviousPage 2 of 5Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.