CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 1:50 PM ET)

What this means for you

This week: 3,215 CVEs published, 247 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,215; Show in the list
Critical, last 7 days: 247; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,760; Show in the list

3,215 CVEs

Showing 11 to 20.

CVE	Severity	Title	Published
CVE-2026-116265	Not yet scored	MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations Assigned by CPANSec	Oct 28, 2026
CVE-2026-110183	Medium 4.3	PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking Assigned by PostgreSQL	Oct 28, 2026
CVE-2026-110182	Medium 4.3	PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data Assigned by PostgreSQL	Oct 28, 2026
CVE-2026-110181	Medium 6.5	PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data Assigned by PostgreSQL	Oct 28, 2026
CVE-2026-116264	Not yet scored	MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary Assigned by CPANSec	Oct 28, 2026
CVE-2026-105620	Medium 6.5	PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query Assigned by PostgreSQL	Oct 28, 2026
CVE-2026-105619	Medium 4.8	PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views Assigned by PostgreSQL	Oct 28, 2026
CVE-2026-105618	Medium 5.7	PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent Assigned by PostgreSQL	Oct 28, 2026
CVE-2026-105617	Medium 5.7	PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule Assigned by PostgreSQL	Oct 28, 2026
CVE-2026-105616	Medium 5.7	PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting Assigned by PostgreSQL	Oct 28, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.