CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 7:20 AM ET)

What this means for you

This week: 3,231 CVEs published, 236 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,231; Show in the list
Critical, last 7 days: 236; Show in the list
Healthcare-tagged, last 7 days: 8; Show in the list
Known exploited (CISA KEV): 1,760; Show in the list

107,210 CVEs

Showing 1,241 to 1,250.

CVE	Severity	Title	Published
CVE-2019-20218	High 7.5	selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error. Assigned by mitre	Jan 1, 2020
CVE-2016-1000027	Critical 9.8	Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data.	Jan 2, 2020
CVE-2019-20330	Critical 9.8	FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. Assigned by mitre	Jan 2, 2020
CVE-2019-19959	High 7.5	ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by… Assigned by mitre	Jan 3, 2020
CVE-2019-5188	High 7.5	A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. Assigned by talos	Jan 8, 2020
CVE-2019-20367	Critical 9.1	nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). Assigned by mitre	Jan 8, 2020
CVE-2020-0601 Known exploited	High 8.1	A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code… Assigned by microsoft	Jan 14, 2020
CVE-2020-0638 Known exploited	High 7.8	An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim sys… Assigned by microsoft	Jan 14, 2020
CVE-2020-0646 Known exploited	Critical 9.8	A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'. Assigned by microsoft	Jan 14, 2020
CVE-2020-2555 Known exploited Healthcare	Critical 9.8	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Assigned by oracle	Jan 15, 2020

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.