CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 09:23 UTC)

What this means for you

This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,437; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product netapp:active_iq_unified_manager. Show all products

135 CVEs, showing 51 to 100PreviousPage 2 of 3Next

CVE	Severity	Title	Published
CVE-2022-1292	Critical 9.8	The c_rehash script allows command injection Assigned by openssl	May 3, 2022
CVE-2022-29824	Medium 6.5	In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf) and tree.c (xmlBuffer) don't check for integer overflows. Assigned by mitre	May 3, 2022
CVE-2022-22968	Medium 5.3	In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectivel… Assigned by vmware	Apr 14, 2022
CVE-2015-20107	High 7.8	In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. Assigned by mitre	Apr 13, 2022
CVE-2018-25032	High 7.5	zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. Assigned by mitre	Mar 25, 2022
CVE-2022-26488	High 7.0	In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. Assigned by mitre	Mar 7, 2022
CVE-2022-23308	High 7.5	valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. Assigned by mitre	Feb 26, 2022
CVE-2022-24407	High 8.8	In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. Assigned by mitre	Feb 23, 2022
CVE-2022-0391	High 7.5	A flaw was found in Python, specifically within the urllib.parse module. Assigned by redhat	Feb 9, 2022
CVE-2022-23437	Medium 6.5	Infinite loop within Apache XercesJ xml parser Assigned by apache	Jan 24, 2022
CVE-2021-46143	High 8.1	In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. Assigned by mitre	Jan 6, 2022
CVE-2021-45960	High 8.8	In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memo… Assigned by mitre	Jan 1, 2022
CVE-2021-44228 Known exploited	Critical 10.0	Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints Assigned by apache	Dec 10, 2021
CVE-2021-43618	High 7.5	GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platform… Assigned by mitre	Nov 15, 2021
CVE-2021-41617	High 7.0	sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Assigned by mitre	Sep 26, 2021
CVE-2021-3711	Critical 9.8	SM2 Decryption Buffer Overflow Assigned by openssl	Aug 24, 2021
CVE-2021-22926	High 7.5	libcurl-using applications can ask for a specific client certificate to be used in a transfer. Assigned by hackerone	Aug 5, 2021
CVE-2021-36222	High 7.5	ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference… Assigned by mitre	Jul 22, 2021
CVE-2021-35942	Critical 9.1	The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially r… Assigned by mitre	Jul 22, 2021
CVE-2021-36090 Healthcare	High 7.5	Apache Commons Compress 1.0 to 1.20 denial of service vulnerability Assigned by apache	Jul 13, 2021
CVE-2021-35517 Healthcare	High 7.5	Apache Commons Compress 1.1 to 1.20 denial of service vulnerability Assigned by apache	Jul 13, 2021
CVE-2021-35516 Healthcare	High 7.5	Apache Commons Compress 1.6 to 1.20 denial of service vulnerability Assigned by apache	Jul 13, 2021
CVE-2021-35515 Healthcare	High 7.5	Apache Commons Compress 1.6 to 1.20 denial of service vulnerability Assigned by apache	Jul 13, 2021
CVE-2021-3541	Medium 6.5	A flaw was found in libxml2. Assigned by redhat	Jul 9, 2021
CVE-2021-36086	Low 3.3	The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). Assigned by mitre	Jul 1, 2021
CVE-2021-22901	High 8.1	curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. Assigned by hackerone	Jun 11, 2021
CVE-2021-3520	Critical 9.8	There's a flaw in lz4. Assigned by redhat	Jun 2, 2021
CVE-2021-3517	High 8.6	There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. Assigned by redhat	May 19, 2021
CVE-2021-3518	High 8.8	There's a flaw in libxml2 in versions before 2.9.11. Assigned by redhat	May 18, 2021
CVE-2021-3537	Medium 5.9	A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. Assigned by redhat	May 14, 2021
CVE-2020-13529	Medium 6.1	An exploitable denial-of-service vulnerability exists in Systemd 245. Assigned by talos	May 10, 2021
CVE-2021-29425 Healthcare	Medium 6.5	Possible limited path traversal vulnerabily in Apache Commons IO Assigned by apache	Apr 13, 2021
CVE-2021-20305	High 8.1	A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply fun… Assigned by redhat	Apr 5, 2021
CVE-2021-3449	Medium 5.9	NULL pointer deref in signature_algorithms processing Assigned by openssl	Mar 25, 2021
CVE-2021-20231	Critical 9.8	A flaw was found in gnutls. Assigned by redhat	Mar 12, 2021
CVE-2021-27219	High 7.5	An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Assigned by mitre	Feb 15, 2021
CVE-2021-27218	High 7.5	An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. Assigned by mitre	Feb 15, 2021
CVE-2021-23337	High 7.2	Command Injection Assigned by snyk	Feb 15, 2021
CVE-2021-21290	Medium 6.2	Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files Assigned by GitHub_M	Feb 8, 2021
CVE-2021-3156 Known exploited	High 7.8	Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends wit… Assigned by mitre	Jan 26, 2021
CVE-2021-3177	Critical 9.8	Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untru… Assigned by mitre	Jan 19, 2021
CVE-2020-13956	Medium 5.3	Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host… Assigned by apache	Dec 2, 2020
CVE-2020-28196	High 7.5	MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite l… Assigned by mitre	Nov 6, 2020
CVE-2020-24977	Medium 6.5	GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. Assigned by mitre	Sep 3, 2020
CVE-2020-24616	High 8.1	FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). Assigned by mitre	Aug 25, 2020
CVE-2020-15778	High 7.8	scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. Assigned by mitre	Jul 24, 2020
CVE-2019-20907	Medium 5.5	In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. Assigned by mitre	Jul 13, 2020
CVE-2020-14145	Medium 5.9	The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. Assigned by mitre	Jun 29, 2020
CVE-2020-14195	High 8.1	FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity). Assigned by mitre	Jun 16, 2020
CVE-2020-14155	Medium 5.3	libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. Assigned by mitre	Jun 15, 2020

PreviousPage 2 of 3Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.