CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 9:00 AM ET)

What this means for you

This week: 3,187 CVEs published, 240 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,187; Show in the list
Critical, last 7 days: 240; Show in the list
Healthcare-tagged, last 7 days: 8; Show in the list
Known exploited (CISA KEV): 1,760; Show in the list

Showing CVEs that name the product netapp:oncommand_workflow_automation. Show all products

51 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2024-28757	High 7.5	libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). Assigned by mitre	Mar 9, 2024
CVE-2024-1635	High 7.5	A vulnerability was found in Undertow.	Feb 19, 2024
CVE-2023-41993 Known exploited	High 8.8	The issue was addressed with improved checks. Assigned by apple	Sep 21, 2023
CVE-2022-43551	High 7.5	A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Assigned by hackerone	Dec 22, 2022
CVE-2022-43680	High 7.5	In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. Assigned by mitre	Oct 23, 2022
CVE-2022-42004	High 7.5	In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.	Oct 2, 2022
CVE-2022-42003	High 7.5	In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting,…	Oct 2, 2022
CVE-2022-37434	Critical 9.8	zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. Assigned by mitre	Aug 4, 2022
CVE-2022-27778	High 8.1	A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`. Assigned by hackerone	Jun 1, 2022
CVE-2022-1292	Critical 9.8	The c_rehash script allows command injection Assigned by openssl	May 3, 2022

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.