Ecosystem
Alpine
10,696 known vulnerabilities.
Most affected packages
2,765 results · Clear filters · Feed
-
High 8.8
Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploi…
-
High 8.8
Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially explo…
-
High 7.5CVE-2023-39325 Public exploit
HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to v9.0.2010.
-
High 7.5
Microsoft QUIC Denial of Service Vulnerability
Microsoft QUIC Denial of Service Vulnerability
-
High 7.5CVE-2023-38171 EPSS 71%
Microsoft QUIC Denial of Service Vulnerability
Microsoft QUIC Denial of Service Vulnerability
-
High 7.5
HTTP/2 HPACK integer overflow and buffer allocation
Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limi…
-
High 7.8
Libx11: integer overflow in xcreateimage() leading to a heap overflow
A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.
-
High 7.5
HTTP/2 Stream Cancellation Attack
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
KEV Oct 10, 2023 -
High 8.8CVE-2023-43641 EPSS 17%
libcue vulnerable to out-of-bounds array access
libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Becaus…
-
High 7.1
Openvswitch don't match packets on nd_target field
A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field …
-
High 8.1
Arbitrary code execution during build via line directives in cmd/go
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The lin…
-
High 7.8
OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.
-
High 8.8
Electron affected by libvpx's heap buffer overflow in vp8 encoding
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
KEV Oct 2, 2023 -
High 7.8
Cri-o: /etc/passwd tampering privesc
A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
-
High 8.4
yt-dlp command injection when using `%q` in `--exec` on Windows
yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument,…
-
High 7.0CVE-2023-4504 Public exploit
OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in Septembe…
-
High 7.5
named may terminate unexpectedly under high DNS-over-TLS query load
A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affect…
-
High 7.5
A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly
The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing co…
-
High 7.8
Croc sender may send dangerous new files to receiver
An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized_keys file.
-
High 7.8
Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device
An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver.
-
High 7.5
K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack
An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.…
-
High 7.5
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl…
-
High 7.8
Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
-
High 7.8
Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
-
High 7.8
Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
-
High 7.8
Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
-
High 8.8
libwebp: OOB write in BuildHuffmanTable
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
KEV Sep 13, 2023 -
High 8.8
Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2
Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabili…
-
High 7.5
Browsing Context potentially not cleared when closing Private Window
When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This …
-
High 8.8
Buffer Overflow in WebGL glGetProgramiv
Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS. *This bug only affects Firefox on macOS. Other operating systems are unaffected.* This v…
-
High 8.8
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a…
KEV Feb 6, 2024 -
High 7.2
Authenticated command injection in SNMP options of a Device
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining …
-
High 8.8
A Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in Cacti
Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeric, the sql_save function directly utilizes user input. Many files and functions calling the sql_save…
-
High 8.8
Authenticated SQL injection vulnerability in reports_user.php in Cacti
Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in…
-
High 8.8
Authenticated SQL injection vulnerability in graphs.php in Cacti
Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in…
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.
-
High 7.5
DoS in lua-http library
Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service (DoS) attack to be executed by sending a properly crafted request to the server. Such a request causes the program to…
-
High 7.3
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.1840.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.1857.