CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 05:50 UTC)

What this means for you

This week: 5,436 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product redhat:enterprise_linux_server_tus. Show all products

50 CVEs, showing 1 to 50

CVE	Severity	Title	Published
CVE-2026-5201	High 7.5	A flaw was found in the gdk-pixbuf library.	Mar 31, 2026
CVE-2025-13601	High 7.7	A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function.	Nov 26, 2025
CVE-2025-6021	High 7.5	Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 Assigned by redhat	Jun 12, 2025
CVE-2024-12085	High 7.5	Rsync: info leak via uninitialized stack contents Assigned by redhat	Jan 14, 2025
CVE-2023-4911 Known exploited	High 7.8	Glibc: buffer overflow in ld.so leading to privilege escalation Assigned by redhat	Oct 3, 2023
CVE-2023-4813	Medium 5.9	Glibc: potential use-after-free in gaih_inet() Assigned by redhat	Sep 12, 2023
CVE-2019-8720 Known exploited	High 8.8	A vulnerability was found in WebKit. Assigned by redhat	Mar 6, 2023
CVE-2022-0847 Known exploited	High 7.8	A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus… Assigned by redhat	Mar 7, 2022
CVE-2021-3733	Medium 6.5	There's a flaw in urllib's AbstractBasicAuthHandler class. Assigned by redhat	Mar 7, 2022
CVE-2022-0492 Known exploited	High 7.8	A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. Assigned by redhat	Mar 3, 2022
CVE-2021-4034 Known exploited	High 7.8	A local privilege escalation vulnerability was found on polkit's pkexec utility. Assigned by redhat	Jan 28, 2022
CVE-2021-40438 Known exploited	Critical 9.0	mod_proxy SSRF Assigned by apache	Sep 16, 2021
CVE-2019-19906	High 7.5	cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. Assigned by mitre	Dec 19, 2019
CVE-2019-5544 Known exploited	Critical 9.8	OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. Assigned by vmware	Dec 6, 2019
CVE-2019-5010	High 7.5	An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6.	Oct 31, 2019
CVE-2019-11043 Known exploited	High 8.7	Underflow in PHP-FPM can lead to RCE Assigned by php	Oct 28, 2019
CVE-2019-10086 Healthcare	High 7.3	In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Ja… Assigned by apache	Aug 20, 2019
CVE-2019-10160	Critical 9.8	A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which s… Assigned by redhat	Jun 7, 2019
CVE-2019-0211 Known exploited	High 7.8	In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scrip… Assigned by apache	Apr 8, 2019
CVE-2019-3856	High 7.5	An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3857	High 7.5	An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3863	High 7.5	A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. Assigned by redhat	Mar 25, 2019
CVE-2019-3855	High 7.5	An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. Assigned by redhat	Mar 21, 2019
CVE-2019-9636	Medium 5.3	Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. Assigned by mitre	Mar 8, 2019
CVE-2019-6109	Medium 6.8	An issue was discovered in OpenSSH 7.9. Assigned by mitre	Jan 31, 2019
CVE-2019-6111	Medium 5.9	An issue was discovered in OpenSSH 7.9. Assigned by mitre	Jan 31, 2019
CVE-2018-12121	High 7.5	Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB… Assigned by nodejs	Nov 28, 2018
CVE-2018-5407	Medium 4.7	Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'. Assigned by certcc	Nov 15, 2018
CVE-2018-11784	Medium 4.3	When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. Assigned by apache	Oct 4, 2018
CVE-2018-14634 Known exploited	High 7.8	An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. Assigned by redhat	Sep 25, 2018
CVE-2017-12617 Known exploited	High 8.1	When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. Assigned by apache	Oct 3, 2017
CVE-2017-12615 Known exploited	High 8.1	When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Assigned by apache	Sep 19, 2017
CVE-2016-6796	High 7.5	A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via… Assigned by apache	Aug 11, 2017
CVE-2016-6797	High 7.5	The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global J… Assigned by apache	Aug 10, 2017
CVE-2016-6794	Medium 5.3	When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. Assigned by apache	Aug 10, 2017
CVE-2016-5018	Critical 9.1	In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomca… Assigned by apache	Aug 10, 2017
CVE-2016-0762	Medium 5.9	The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplie… Assigned by apache	Aug 10, 2017
CVE-2017-8291 Known exploited	High 7.8	Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an in… Assigned by mitre	Apr 27, 2017
CVE-2017-5645	Critical 9.8	In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,… Assigned by apache	Apr 17, 2017
CVE-2016-10165	High 7.1	The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which… Assigned by mitre	Feb 3, 2017
CVE-2016-5388	High 8.1	Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted cli… Assigned by redhat	Jul 19, 2016
CVE-2016-3718 Known exploited	Medium 5.5	The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Assigned by redhat	May 5, 2016
CVE-2016-3715 Known exploited	Medium 5.5	The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Assigned by redhat	May 5, 2016
CVE-2016-3427 Known exploited	Critical 9.8	Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vector… Assigned by oracle	Apr 21, 2016
CVE-2015-8126	High 7.5	Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x… Assigned by mitre	Nov 13, 2015
CVE-2015-4495 Known exploited	High 8.8	The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain p… Assigned by mozilla	Aug 8, 2015
CVE-2015-2590 Known exploited	Critical 9.8	Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors… Assigned by oracle	Jul 16, 2015
CVE-2014-7169 Known exploited	Critical 9.8	GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or poss… Assigned by mitre	Sep 25, 2014
CVE-2014-6271 Known exploited	Critical 9.8	GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, a… Assigned by debian	Sep 24, 2014
CVE-2014-0160 Known exploited	High 7.5	The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process… Assigned by redhat	Apr 7, 2014

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.