CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 1:10 PM ET)

What this means for you

This week: 3,349 CVEs published, 273 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,349; Show in the list
Critical, last 7 days: 273; Show in the list
Healthcare-tagged, last 7 days: 10; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product libpng:libpng. Show all products

15 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-34757	Medium 5.1	LIBPNG has a yse-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST leading to corrupted chunk data and potential heap information disclosure Assigned by GitHub_M	Apr 9, 2026
CVE-2026-33636	High 7.6	LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64 Assigned by GitHub_M	Mar 26, 2026
CVE-2026-33416	High 7.5	LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` Assigned by GitHub_M	Mar 26, 2026
CVE-2026-3713	Medium 5.3	pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow Assigned by VulDB	Mar 8, 2026
CVE-2026-25646	High 8.3	LIBPNG has a heap buffer overflow in png_set_quantize Assigned by GitHub_M	Feb 10, 2026
CVE-2025-28164	Medium 5.5	Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function. Assigned by mitre	Jan 26, 2026
CVE-2025-28162	Medium 5.5	Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations… Assigned by mitre	Jan 26, 2026
CVE-2026-22801	Medium 6.8	LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_* Assigned by GitHub_M	Jan 12, 2026
CVE-2026-22695	Medium 6.1	LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix) Assigned by GitHub_M	Jan 12, 2026
CVE-2025-66293	High 7.1	LIBPNG has an out-of-bounds read in png_image_read_composite Assigned by GitHub_M	Dec 3, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.