CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 7:40 PM ET)

What this means for you

This week: 3,190 CVEs published, 235 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,190; Show in the list
Critical, last 7 days: 235; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product openimageio:openimageio. Show all products

21 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-7582	Medium 5.3	AcademySoftwareFoundation OpenImageIO DDS Image ddsinput.cpp out-of-bounds write Assigned by VulDB	May 1, 2026
CVE-2026-43906	High 8.5	OpenImageIO: HEIF Heap overflow Assigned by GitHub_M	May 14, 2026
CVE-2026-43909	High 8.8	OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder Assigned by GitHub_M	May 14, 2026
CVE-2026-43908	High 8.8	OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder Assigned by GitHub_M	May 14, 2026
CVE-2026-43907	High 8.3	OpenImageIO: Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR) Assigned by GitHub_M	May 14, 2026
CVE-2026-43996	Medium 5.5	OpenImageIO: Integer wraparound in bounds check of decode_pixel leads to out-of-bounds read in TGA paletted image decoder Assigned by GitHub_M	May 14, 2026
CVE-2026-43905	High 7.1	OpenImageIO: JPEG2000 (OpenJPH) signed integer overflow in buffer allocation Assigned by GitHub_M	May 14, 2026
CVE-2026-43904	High 8.4	OpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width Assigned by GitHub_M	May 14, 2026
CVE-2026-43903	High 8.4	OpenImageIO: SGI RLE decoder heap buffer overflow OIIO_DASSERT bounds checks are no-ops in release builds Assigned by GitHub_M	May 14, 2026
CVE-2026-50291	Medium 5.5	OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.cpp:399) Assigned by GitHub_M	Sep 17, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.