CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 1:50 PM ET)

What this means for you

This week: 3,341 CVEs published, 273 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,341; Show in the list
Critical, last 7 days: 273; Show in the list
Healthcare-tagged, last 7 days: 7; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product qt:qt. Show all products

30 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2020-0570	High 7.3	Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access. Assigned by intel	Sep 14, 2020
CVE-2020-24742	High 7.8	An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files. Assigned by mitre	Aug 9, 2021
CVE-2023-51714	Critical 9.8	An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. Assigned by mitre	Dec 23, 2023
CVE-2025-10728	Critical 9.4	Uncontrolled recursion in Qt SVG module Assigned by TQtC	Oct 3, 2025
CVE-2025-10729	Critical 9.4	Use-after-free vulnerability in Qt SVG qsvghandler.cpp allows denial of service via crafted SVG Assigned by TQtC	Oct 3, 2025
CVE-2025-6338	Critical 9.2	Possible denial of service with multiple incoming connections to a Schannel based server with a TLS backend Assigned by TQtC	Oct 16, 2025
CVE-2025-23050	Low 3.1	QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). Assigned by mitre	Oct 30, 2025
CVE-2025-12385	High 8.7	Improper validation of <img> tag size in Text component parser Assigned by TQtC	Dec 3, 2025
CVE-2025-14576	High 7.4	Possible QML code injection in VectorImage component Assigned by TQtC	Apr 30, 2026
CVE-2026-6210	High 8.7	Type confusion and heap-buffer-overflow in Qt SVG marker handling causing application crash Assigned by TQtC	May 6, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.