CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 11:50 UTC)

What this means for you

This week: 5,501 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,501; Show in the list
Critical, last 7 days: 358; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product opensuse:backports_sle. Show all products

11 CVEs, showing 1 to 11

CVE	Severity	Title	Published
CVE-2020-16009 Known exploited	High 8.8	Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Nov 3, 2020
CVE-2020-15999 Known exploited	Critical 9.6	Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Nov 3, 2020
CVE-2020-12641 Known exploited	Critical 9.8	rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. Assigned by mitre	May 4, 2020
CVE-2019-19925	High 7.5	zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. Assigned by mitre	Dec 24, 2019
CVE-2019-19923	High 7.5	flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. Assigned by mitre	Dec 24, 2019
CVE-2019-19926	High 7.5	multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. Assigned by mitre	Dec 23, 2019
CVE-2019-19880	High 7.5	exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled. Assigned by mitre	Dec 18, 2019
CVE-2019-5459	High 7.1	An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read. Assigned by hackerone	Jul 30, 2019
CVE-2019-13962	Critical 9.8	lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height. Assigned by mitre	Jul 18, 2019
CVE-2019-13602	High 7.8	An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow a… Assigned by mitre	Jul 14, 2019
CVE-2019-11358 Healthcare	Medium 6.1	jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Assigned by mitre	Apr 19, 2019

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.