CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,200 CVEs published, 235 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,200
Show in the list
Critical, last 7 days
235
Show in the list
Healthcare-tagged, last 7 days
9
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product redhat:cost_management. Show all products

10 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-18382Medium 6.8Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url
Assigned by redhat
Jul 30, 2026
CVE-2026-18378High 7.6Project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)
Assigned by redhat
Jul 30, 2026
CVE-2026-18381High 7.6Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address
Assigned by redhat
Jul 30, 2026
CVE-2026-13757Medium 6.2P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing
Assigned by redhat
Jun 29, 2026
CVE-2026-45447High 8.8Heap Use-After-Free in the PKCS7_verify() Function
Assigned by openssl
Jun 9, 2026
CVE-2026-4878Medium 6.7Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()
Assigned by redhat
Apr 9, 2026
CVE-2026-2100Medium 5.3P11-kit: null dereference via c_derivekey with specific null parameters
Assigned by redhat
Mar 26, 2026
CVE-2025-15467High 8.8Stack buffer overflow in CMS (Auth)EnvelopedData parsing
Assigned by openssl
Jan 27, 2026
CVE-2025-5278Medium 4.4Coreutils: heap buffer under-read in gnu coreutils sort via key specification
Assigned by redhat
May 27, 2025
CVE-2023-44487
Known exploited
High 7.5The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Assigned by mitre
Oct 9, 2023

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.