CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 6:50 PM ET)

What this means for you

This week: 3,199 CVEs published, 234 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,199; Show in the list
Critical, last 7 days: 234; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product splunk:universal_forwarder. Show all products

54 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2023-27534	High 8.8	A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its inte… Assigned by hackerone	Mar 29, 2023
CVE-2023-27535	Medium 5.9	An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Assigned by hackerone	Mar 29, 2023
CVE-2023-27537	Medium 5.9	A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". Assigned by hackerone	Mar 29, 2023
CVE-2023-27538	High 7.7	An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have pr… Assigned by hackerone	Mar 29, 2023
CVE-2023-27536	Medium 5.9	An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to che… Assigned by hackerone	Mar 29, 2023
CVE-2023-27533	Critical 9.8	A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during serve… Assigned by hackerone	Mar 29, 2023
CVE-2023-23915	Medium 6.5	A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Assigned by hackerone	Feb 22, 2023
CVE-2023-23916	Medium 6.5	An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed mult… Assigned by hackerone	Feb 22, 2023
CVE-2023-23914	Critical 9.1	A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Assigned by hackerone	Feb 22, 2023
CVE-2022-43552	Medium 5.9	A use after free vulnerability exists in curl <7.87.0. Assigned by hackerone	Feb 8, 2023

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.