CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 14:10 UTC)

What this means for you

This week: 5,511 CVEs published, 359 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,511; Show in the list
Critical, last 7 days: 359; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product fedoraproject:fedora. Show all products

407 CVEs, showing 201 to 250PreviousPage 5 of 9Next

CVE	Severity	Title	Published
CVE-2021-40438 Known exploited	Critical 9.0	mod_proxy SSRF Assigned by apache	Sep 16, 2021
CVE-2021-30952 Known exploited	High 8.8	An integer overflow was addressed with improved input validation. Assigned by apple	Aug 24, 2021
CVE-2021-30858 Known exploited	High 8.8	A use after free issue was addressed with improved memory management. Assigned by apple	Aug 24, 2021
CVE-2021-39152	High 8.5	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-39150	High 8.5	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-39140	Medium 6.3	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-39154	High 8.5	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-39153	High 8.5	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-39151	High 8.5	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-39149	High 8.5	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-39148	High 8.5	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-39147	High 8.5	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-39146	High 8.5	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-39145	High 8.5	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-39141	High 8.5	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-39139	High 8.8	XStream is a simple library to serialize objects to XML and back again.	Aug 23, 2021
CVE-2021-37750	Medium 6.5	The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server fiel… Assigned by mitre	Aug 23, 2021
CVE-2021-39144 Known exploited	High 8.5	XStream is vulnerable to a Remote Command Execution attack Assigned by GitHub_M	Aug 23, 2021
CVE-2021-38604	High 7.5	In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. Assigned by mitre	Aug 12, 2021
CVE-2021-38166	High 7.8	In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. Assigned by mitre	Aug 7, 2021
CVE-2021-22924	Low 3.7	libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take… Assigned by hackerone	Aug 5, 2021
CVE-2021-22925	Medium 5.3	curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. Assigned by hackerone	Aug 5, 2021
CVE-2021-22923	Medium 5.3	When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to e… Assigned by hackerone	Aug 5, 2021
CVE-2021-22922	Medium 6.5	When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to… Assigned by hackerone	Aug 5, 2021
CVE-2021-34556	Medium 5.5	In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism… Assigned by mitre	Aug 2, 2021
CVE-2021-35477	Medium 5.5	In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting sto… Assigned by mitre	Aug 2, 2021
CVE-2021-33910	Medium 5.5	basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker)… Assigned by mitre	Jul 20, 2021
CVE-2021-30554 Known exploited	High 8.8	Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jul 2, 2021
CVE-2021-36087	Low 3.3	The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). Assigned by mitre	Jul 1, 2021
CVE-2021-36086	Low 3.3	The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). Assigned by mitre	Jul 1, 2021
CVE-2021-36085	Low 3.3	The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map). Assigned by mitre	Jul 1, 2021
CVE-2021-36084	Low 3.3	The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper). Assigned by mitre	Jul 1, 2021
CVE-2021-30551 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jun 15, 2021
CVE-2021-22898	Low 3.1	curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Assigned by hackerone	Jun 11, 2021
CVE-2021-31957	Medium 5.9	ASP.NET Core Denial of Service Vulnerability	Jun 8, 2021
CVE-2021-33560	High 7.5	Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen app… Assigned by mitre	Jun 8, 2021
CVE-2021-30533 Known exploited	Medium 6.5	Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe. Assigned by Chrome	Jun 7, 2021
CVE-2021-3516	High 7.8	There's a flaw in libxml2's xmllint in versions before 2.9.11. Assigned by redhat	Jun 1, 2021
CVE-2021-29505	High 8.8	XStream is software for serializing Java objects to XML and back again.	May 28, 2021
CVE-2020-25710	High 7.5	A flaw was found in OpenLDAP in versions before 2.4.56. Assigned by redhat	May 28, 2021
CVE-2021-33574	Critical 9.8	The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Assigned by mitre	May 25, 2021
CVE-2021-3426	Medium 5.7	There's a flaw in Python 3's pydoc. Assigned by redhat	May 20, 2021
CVE-2021-3517	High 8.6	There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. Assigned by redhat	May 19, 2021
CVE-2021-3518	High 8.8	There's a flaw in libxml2 in versions before 2.9.11. Assigned by redhat	May 18, 2021
CVE-2021-3537	Medium 5.9	A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. Assigned by redhat	May 14, 2021
CVE-2021-31204	High 7.3	.NET and Visual Studio Elevation of Privilege Vulnerability	May 11, 2021
CVE-2020-13529	Medium 6.1	An exploitable denial-of-service vulnerability exists in Systemd 245. Assigned by talos	May 10, 2021
CVE-2021-25317	Low 3.3	cups: ownership of /var/log/cups allows the lp user to create files as root Assigned by suse	May 5, 2021
CVE-2020-36327	High 8.8	Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chos… Assigned by mitre	Apr 29, 2021
CVE-2021-21224 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Assigned by Chrome	Apr 26, 2021

PreviousPage 5 of 9Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.