CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 7:40 PM ET)

What this means for you

This week: 3,245 CVEs published, 236 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,245; Show in the list
Critical, last 7 days: 236; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product oracle:instantis_enterprisetrack. Show all products

23 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2017-5645	Critical 9.8	In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,… Assigned by apache	Apr 17, 2017
CVE-2017-12617 Known exploited	High 8.1	When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. Assigned by apache	Oct 3, 2017
CVE-2018-11784	Medium 4.3	When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. Assigned by apache	Oct 4, 2018
CVE-2019-0211 Known exploited	High 7.8	In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scrip… Assigned by apache	Apr 8, 2019
CVE-2019-10219 Healthcare	Medium 6.5	A vulnerability was found in Hibernate-Validator. Assigned by redhat	Nov 8, 2019
CVE-2019-17563	High 7.5	When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. Assigned by apache	Dec 23, 2019
CVE-2020-1935	Medium 4.8	In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as va… Assigned by apache	Feb 24, 2020
CVE-2020-1938 Known exploited	Critical 9.8	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Assigned by apache	Feb 24, 2020
CVE-2020-11655	High 7.5	SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled. Assigned by mitre	Apr 8, 2020
CVE-2020-9484	High 7.0	When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;… Assigned by apache	May 20, 2020

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.