CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 22:50 UTC)

What this means for you

This week: 5,224 CVEs published, 344 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,224; Show in the list
Critical, last 7 days: 344; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

Showing CVEs that name the product debian:debian_linux. Show all products

1,059 CVEs, showing 951 to 1000PreviousPage 20 of 22Next

CVE	Severity	Title	Published
CVE-2019-6111	Medium 5.9	An issue was discovered in OpenSSH 7.9. Assigned by mitre	Jan 31, 2019
CVE-2018-19360	Critical 9.8	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization. Assigned by mitre	Jan 2, 2019
CVE-2018-19362	Critical 9.8	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization. Assigned by mitre	Jan 2, 2019
CVE-2018-19361	Critical 9.8	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization. Assigned by mitre	Jan 2, 2019
CVE-2018-14721	Critical 10.0	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic de… Assigned by mitre	Jan 2, 2019
CVE-2018-14720	Critical 9.8	FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization. Assigned by mitre	Jan 2, 2019
CVE-2018-14718	Critical 9.8	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization. Assigned by mitre	Jan 2, 2019
CVE-2018-14719	Critical 9.8	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deseriali… Assigned by mitre	Jan 2, 2019
CVE-2018-20482	Medium 4.7	GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c)… Assigned by mitre	Dec 26, 2018
CVE-2018-20406	High 7.5	Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. Assigned by mitre	Dec 23, 2018
CVE-2018-17480 Known exploited	High 8.8	Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code i… Assigned by Chrome	Dec 11, 2018
CVE-2018-19857	Critical 9.1	The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast conv… Assigned by mitre	Dec 5, 2018
CVE-2018-19543	High 7.8	An issue was discovered in JasPer 2.0.14. Assigned by mitre	Nov 26, 2018
CVE-2018-19542	Medium 6.5	An issue was discovered in JasPer 2.0.14. Assigned by mitre	Nov 26, 2018
CVE-2018-19540	High 8.8	An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.2… Assigned by mitre	Nov 26, 2018
CVE-2018-19541	High 8.8	An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.2… Assigned by mitre	Nov 26, 2018
CVE-2018-19539	Medium 6.5	An issue was discovered in JasPer 2.0.14. Assigned by mitre	Nov 26, 2018
CVE-2018-5407	Medium 4.7	Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'. Assigned by certcc	Nov 15, 2018
CVE-2018-6065 Known exploited	High 8.8	Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit he… Assigned by Chrome	Nov 14, 2018
CVE-2018-17463 Known exploited	High 8.8	Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Assigned by Chrome	Nov 14, 2018
CVE-2018-19139	Medium 5.5	An issue has been found in JasPer 2.0.14. Assigned by mitre	Nov 9, 2018
CVE-2018-0734	Medium 5.9	Timing attack against DSA Assigned by openssl	Oct 30, 2018
CVE-2018-0735	Medium 5.9	Timing attack against ECDSA signature generation Assigned by openssl	Oct 29, 2018
CVE-2018-15756 Healthcare	High 7.5	DoS Attack via Range Requests Assigned by dell	Oct 18, 2018
CVE-2018-11784	Medium 4.3	When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. Assigned by apache	Oct 4, 2018
CVE-2018-14647	High 7.5	Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.	Sep 25, 2018
CVE-2018-1000802	Critical 9.8	Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_arc… Assigned by mitre	Sep 18, 2018
CVE-2017-15422	Medium 6.5	Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a… Assigned by Chrome	Aug 28, 2018
CVE-2018-14567	Medium 6.5	libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a dif… Assigned by mitre	Aug 16, 2018
CVE-2018-7602 Known exploited	High 8.1	Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 Assigned by drupal	Jul 19, 2018
CVE-2018-14404	Medium 6.5	A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Assigned by mitre	Jul 19, 2018
CVE-2018-11040 Healthcare	High 7.5	Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through… Assigned by dell	Jun 25, 2018
CVE-2018-11039 Healthcare	Medium 5.9	Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including… Assigned by dell	Jun 25, 2018
CVE-2018-1061	Medium 6.5	python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. Assigned by redhat	Jun 19, 2018
CVE-2018-1060	Medium 4.3	python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. Assigned by redhat	Jun 18, 2018
CVE-2018-0495	Medium 4.7	Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_… Assigned by debian	Jun 13, 2018
CVE-2018-0732	High 7.5	Client DoS due to large DH parameter Assigned by openssl	Jun 12, 2018
CVE-2017-5436	High 8.8	An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font.	Jun 11, 2018
CVE-2016-9079 Known exploited	High 7.5	A use-after-free vulnerability in SVG Animation has been discovered. Assigned by mozilla	Jun 11, 2018
CVE-2016-9063	Critical 9.8	An integer overflow during the parsing of XML using the Expat library. Assigned by mozilla	Jun 11, 2018
CVE-2018-11212	Medium 6.5	An issue was discovered in libjpeg 9a and 9d. Assigned by mitre	May 16, 2018
CVE-2018-8014	Critical 9.8	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all ori… Assigned by apache	May 16, 2018
CVE-2018-1270 Healthcare	Critical 9.8	Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STO… Assigned by dell	Apr 6, 2018
CVE-2018-7600 Known exploited	Critical 9.8	Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or co… Assigned by drupal	Mar 29, 2018
CVE-2018-1304	Medium 5.9	The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84… Assigned by apache	Feb 28, 2018
CVE-2018-7489	Critical 9.8	FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization… Assigned by mitre	Feb 26, 2018
CVE-2018-1305	Medium 6.5	Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Assigned by apache	Feb 23, 2018
CVE-2017-7375	Critical 9.8	A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD… Assigned by mitre	Feb 19, 2018
CVE-2017-7376	Critical 9.8	Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects. Assigned by mitre	Feb 19, 2018
CVE-2018-6789 Known exploited	Critical 9.8	An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Assigned by mitre	Feb 8, 2018

PreviousPage 20 of 22Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.