CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Nov 2, 2026, 2:50 AM ET)

What this means for you

This week: 3,474 CVEs published, 268 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,474; Show in the list
Critical, last 7 days: 268; Show in the list
Healthcare-tagged, last 7 days: 2; Show in the list
Known exploited (CISA KEV): 1,765; Show in the list

Showing CVEs that name the product libjpeg-turbo:libjpeg-turbo. Show all products

16 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2013-6629	Medium 5.0	The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain dup…	Nov 18, 2013
CVE-2016-3616	High 8.8	The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.	Feb 13, 2017
CVE-2014-9092	Medium 6.5	libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker.	Oct 10, 2017
CVE-2017-15232	Medium 6.5	libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.	Oct 10, 2017
CVE-2018-1152	Medium 6.5	libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.	Jun 18, 2018
CVE-2018-19664	Medium 6.5	libjpeg-turbo 2.0.1 has a heap-based buffer over-read in the put_pixel_rows function in wrbmp.c, as demonstrated by djpeg.	Nov 29, 2018
CVE-2018-20330	High 8.8	The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer overflow via a BMP image because multiplication of pitch and height is mishandled, as demons…	Dec 21, 2018
CVE-2018-14498	Medium 6.5	get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit…	Mar 7, 2019
CVE-2019-13960	Medium 5.5	In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect width and height values in the image header.	Jul 18, 2019
CVE-2020-13790	High 8.1	libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.	Jun 3, 2020

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.