Ecosystem
Alpine
10,696 known vulnerabilities.
Most affected packages
10,657 results · Feed
-
Unscored —
x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains w…
-
Unscored —
x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security…
-
Unscored —
x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains w…
-
Critical 9.9
CairoSVG improperly processes SVG files loaded from external resources
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-sid…
-
High 7.5
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127…
-
Medium 4.8
Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler
Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When an outbound request made by the Go HTTP client fails, the `html.ServerError` is returned unescaped without the expected C…
-
Unscored —
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. Th…
-
High 7.5
An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should b…
-
Unscored —
Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at …
-
Unscored —
Libde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_seg…
-
High 7.4
Nomad Job Submitter Privilege Escalation Using Workload Identity
HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1.
-
Low 2.7
Nomad ACLs Can Not Deny Access to Workload's Own Variables
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1.
-
High 7.5
PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versi…
-
Critical 9.1
Full authentication bypass if SASL authorization username is specified
maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating …
-
Critical 9.8
A Buffer Overflow vulnerabilityexists in Pev 0.81 via the pe_exports function from exports.c.. The array offsets_to_Nam…
-
High 8.4
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.
-
High 7.8
emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailt…
-
High 7.8
emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto:…
-
Unscored —
Incorrect calculation on P256 curves in crypto/internal/nistec
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.
-
High 8.8
Heap buffer overflow in UMA in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the r…
-
High 8.8
Heap buffer overflow in Web Audio API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially …
-
High 8.8
Heap buffer overflow in Metrics in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised t…
-
Unscored —
Stack buffer overflow in Crash reporting in Google Chrome on Windows prior to 111.0.5563.64 allowed a remote attacker w…
-
High 8.8
Type confusion in CSS in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap cor…
-
High 7.5
Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.
-
Critical 9.8
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…
-
Medium 6.6
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.
-
Medium 6.5
Credentials inlined to Git URLs could end up in provenance attestation in BuildKit
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenanc…
-
Medium 5.3
Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow
A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.
-
Medium 6.3
ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via pa…
-
Critical 9.8
Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and p…
-
High 7.5
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!…
-
High 8.8CVE-2019-8720 Exploited
A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lea…
KEV May 23, 2022 -
High 7.3
Incorrect Calculation of Buffer Size in vim/vim
Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.
-
High 7.0
Opencontainers runc Incorrect Authorization vulnerability
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom …
-
Medium 6.8
LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-servic…
-
Low 3.7
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos …
-
Medium 6.6
Gradle usage of long IDs for PGP keys opens potential for collision attacks
Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a …
-
High 7.3
Divide By Zero in vim/vim
Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.