CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 7:00 PM ET)

What this means for you

This week: 3,198 CVEs published, 234 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,198; Show in the list
Critical, last 7 days: 234; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product netapp:ontap_9. Show all products

8 CVEs

Showing 1 to 8.

CVE	Severity	Title	Published
CVE-2026-22063	Medium 6.0	CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products Assigned by netapp	Oct 27, 2026
CVE-2026-22049	High 8.7	ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could… Assigned by netapp	Jul 22, 2026
CVE-2026-22052	Medium 5.3	ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Assigned by netapp	Mar 4, 2026
CVE-2026-22050	Medium 6.9	ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapsho… Assigned by netapp	Jan 12, 2026
CVE-2024-38475 Known exploited	Critical 9.1	Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. Assigned by apache	Jul 1, 2024
CVE-2023-27535	Medium 5.9	An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Assigned by hackerone	Mar 29, 2023
CVE-2022-42915	High 8.1	curl before 7.86.0 has a double free. Assigned by mitre	Oct 28, 2022
CVE-2022-27780	Medium 5.3	The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a different URL usingthe wrong host name when it is later retrieved.F… Assigned by hackerone	May 31, 2022

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.