CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 9:40 PM ET)

What this means for you

This week: 3,084 CVEs published, 231 critical, and 4 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,084; Show in the list
Critical, last 7 days: 231; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product netapp:bootstrap_os. Show all products

23 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2019-17498	High 8.1	In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a s… Assigned by mitre	Oct 20, 2019
CVE-2021-36086	Low 3.3	The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). Assigned by mitre	Jun 30, 2021
CVE-2022-23308	High 7.5	valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. Assigned by mitre	Feb 25, 2022
CVE-2022-0492 Known exploited	High 7.8	A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. Assigned by redhat	Mar 2, 2022
CVE-2022-22576	High 8.1	An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was au… Assigned by hackerone	May 25, 2022
CVE-2022-2068	Critical 9.8	The c_rehash script allows command injection Assigned by openssl	Jun 21, 2022
CVE-2022-32208	Medium 5.9	When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. Assigned by hackerone	Jul 6, 2022
CVE-2022-32206	Medium 6.5	curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. Assigned by hackerone	Jul 6, 2022
CVE-2022-32207	Critical 9.8	When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In… Assigned by hackerone	Jul 6, 2022
CVE-2022-35252	Low 3.7	When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Assigned by hackerone	Sep 22, 2022

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.