CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 08:40 UTC)

What this means for you

This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,437; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product oracle:mysql_enterprise_monitor. Show all products

36 CVEs, showing 1 to 36

CVE	Severity	Title	Published
CVE-2022-22968	Medium 5.3	In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectivel… Assigned by vmware	Apr 14, 2022
CVE-2022-22965 Known exploited	Critical 9.8	A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Assigned by vmware	Apr 1, 2022
CVE-2022-22963 Known exploited	Critical 9.8	In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression t… Assigned by vmware	Apr 1, 2022
CVE-2021-44533	Medium 5.3	Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Assigned by hackerone	Feb 24, 2022
CVE-2022-23307 Healthcare	High 8.8	A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution. Assigned by apache	Jan 18, 2022
CVE-2022-23305 Healthcare	Critical 9.8	SQL injection in JDBC Appender in Apache Log4j V1 Assigned by apache	Jan 18, 2022
CVE-2022-23302 Healthcare	High 8.8	Deserialization of untrusted data in JMSSink in Apache Log4j 1.x Assigned by apache	Jan 18, 2022
CVE-2021-45105 Healthcare	Medium 5.9	Apache Log4j2 does not always protect from infinite recursion in lookup evaluation Assigned by apache	Dec 18, 2021
CVE-2021-4104 Healthcare	High 7.5	Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 Assigned by apache	Dec 14, 2021
CVE-2021-3711	Critical 9.8	SM2 Decryption Buffer Overflow Assigned by openssl	Aug 24, 2021
CVE-2021-33037 Healthcare	Medium 5.3	Incorrect Transfer-Encoding handling with HTTP/1.0 Assigned by apache	Jul 12, 2021
CVE-2021-22118 Healthcare	High 7.8	In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory,… Assigned by vmware	May 27, 2021
CVE-2021-3450	High 7.4	CA certificate check bypass with X509_V_FLAG_X509_STRICT Assigned by openssl	Mar 25, 2021
CVE-2021-25122	High 7.5	Apache Tomcat h2c request mix-up Assigned by apache	Mar 1, 2021
CVE-2021-25329	High 7.0	Incomplete fix for CVE-2020-9484 Assigned by apache	Mar 1, 2021
CVE-2020-17530 Known exploited	Critical 9.8	Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Assigned by apache	Dec 11, 2020
CVE-2020-17527	High 7.5	Apache Tomcat: Request header mix-up between HTTP/2 streams Assigned by apache	Dec 3, 2020
CVE-2020-5421 Healthcare	High 8.7	RFD Protection Bypass via jsessionid Assigned by pivotal	Sep 19, 2020
CVE-2020-13935	High 7.5	The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Assigned by apache	Jul 14, 2020
CVE-2020-13934	High 7.5	An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. Assigned by apache	Jul 14, 2020
CVE-2020-11996	High 7.5	A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. Assigned by apache	Jun 26, 2020
CVE-2020-9484	High 7.0	When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;… Assigned by apache	May 20, 2020
CVE-2020-1967	High 7.5	Segmentation fault in SSL_check_chain Assigned by openssl	Apr 21, 2020
CVE-2020-1938 Known exploited	Critical 9.8	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Assigned by apache	Feb 24, 2020
CVE-2020-1935	Medium 4.8	In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as va… Assigned by apache	Feb 24, 2020
CVE-2020-5397 Healthcare	Medium 5.3	CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux Assigned by pivotal	Jan 17, 2020
CVE-2019-17563	High 7.5	When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. Assigned by apache	Dec 23, 2019
CVE-2019-1551	Medium 5.3	rsaz_512_sqr overflow bug on x86_64 Assigned by openssl	Dec 6, 2019
CVE-2018-15756 Healthcare	High 7.5	DoS Attack via Range Requests Assigned by dell	Oct 18, 2018
CVE-2018-11776 Known exploited	High 8.1	Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then:… Assigned by apache	Aug 22, 2018
CVE-2018-11040 Healthcare	High 7.5	Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through… Assigned by dell	Jun 25, 2018
CVE-2018-11039 Healthcare	Medium 5.9	Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including… Assigned by dell	Jun 25, 2018
CVE-2018-1258 Healthcare	High 8.8	Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. Assigned by dell	May 11, 2018
CVE-2017-12617 Known exploited	High 8.1	When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. Assigned by apache	Oct 3, 2017
CVE-2017-5645	Critical 9.8	In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,… Assigned by apache	Apr 17, 2017
CVE-2016-8735 Known exploited	Critical 9.8	Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an att… Assigned by apache	Apr 6, 2017

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.