Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Unscored —
A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in …
-
Unscored —
An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an …
-
Unscored —
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is use…
-
Unscored —
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used…
-
Unscored —
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.
-
Unscored —
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-…
-
Critical 9.1
NULL Pointer Dereference in mruby/mruby
mruby is vulnerable to NULL Pointer Dereference
-
High 7.5
Invalid handling of X509_verify_cert() internal errors in libssl
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is …
-
Unscored —
The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session obj…
-
High 8.2
HTML Cleaner allows crafted and SVG embedded scripts to pass through
lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ th…
-
Unscored —
The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
-
Medium 4.3
Grafana directory traversal for `.cvs` files
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source e…
-
Medium 4.3CVE-2021-43813 EPSS 57%
Directory Traversal in Grafana
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allo…
-
Unscored —
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such…
-
Unscored —
When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have …
-
Unscored —
Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to…
-
Unscored —
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user…
-
Unscored —
The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while …
-
Unscored —
By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geol…
-
Unscored —
Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled…
-
Unscored —
The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run …
-
Unscored —
Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to th…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some o…
-
Unscored —
A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory …
-
Unscored —
Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. T…
-
Unscored —
An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a p…
-
Unscored —
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that h…
-
Unscored —
Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within …
-
Unscored —
WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that…
-
Unscored —
When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly esc…
-
Unscored —
Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading ex…
-
Unscored —
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additi…
-
Unscored —
When receiving a URL through a SEND intent, Firefox would have searched for the text, but subsequent usages of the addr…
-
Unscored —
Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thu…
-
Unscored —
It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerabil…
-
Medium 6.7
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile
`Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit…
-
Unscored —CVE-2021-43527 EPSS 18%
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DE…
-
High 7.3
Potential bypass of an upstream access control based on URL paths in Django
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
-
High 7.5
Grafana path traversal
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url…
KEV Oct 9, 2025 -
Unscored —
grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain …