Ecosystem
Alpine
10,696 known vulnerabilities.
Most affected packages
2,765 results · Clear filters · Feed
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.1858.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.
-
High 7.8
Untrusted Search Path in vim/vim
Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.
-
High 7.8
Integer Overflow or Wraparound in vim/vim
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.
-
High 7.5
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a cl…
-
High 7.1
A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vspher…
-
High 7.5
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertm…
-
High 7.5
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.…
-
High 7.5
A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauth…
-
High 8.8
Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the …
-
High 8.8
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the poli…
-
High 7.5
Postgresql: extension script @substitutions@ within quoting allow sql injection
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non…
-
High 8.6
Security issue with external entity loading in XML without enabling it
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the us…
-
High 7.2
Unauthorized error injection in Intel(R) SGX or Intel(R) TDX for some Intel(R) Xeon(R) Processors may allow a privilege…
-
High 7.5
.NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
KEV Aug 9, 2023 -
High 7.5
.NET Core and Visual Studio Denial of Service Vulnerability
.NET Core and Visual Studio Denial of Service Vulnerability
-
High 7.8
.NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
-
High 7.5
Incomplete Internal State Distinction in ntpsec
ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3).
-
High 7.8CVE-2023-38497 Public exploit
Cargo not respecting umask when extracting crate archives
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate c…
-
High 7.5
Certifi's removal of e-Tugra root certificate
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were…
-
High 8.6
Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octet…
-
High 7.5
cryptography mishandles SSH certificates
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
-
High 7.5
Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of p…
-
High 7.0
Heap overflow issue with the Lua cjson library used by Redis
Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions…
-
High 8.1
ASP.NET and Visual Studio Security Feature Bypass Vulnerability
ASP.NET and Visual Studio Security Feature Bypass Vulnerability
-
High 8.1
.NET and Visual Studio Elevation of Privilege Vulnerability
.NET and Visual Studio Elevation of Privilege Vulnerability
-
High 7.4CVE-2023-36824 EPSS 77%
Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis
Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potential…
-
High 7.8
Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker t…
-
High 7.5
llhttp vulnerable to HTTP request smuggling
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…
-
High 7.5
Exceeding the recursive-clients quota may cause named to terminate unexpectedly when stale-answer-client-timeout is set to 0
If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a st…
-
High 7.1
NuGet Client Remote Code Execution Vulnerability
NuGet Client Remote Code Execution Vulnerability
-
High 7.5
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
-
High 7.5
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
-
High 7.8
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
-
High 7.8
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
-
High 7.3
.NET and Visual Studio Elevation of Privilege Vulnerability
.NET and Visual Studio Elevation of Privilege Vulnerability
-
High 7.3
.NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
-
High 7.3
.NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
-
High 8.8
Type confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap cor…
-
High 7.2
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could per…