Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
qt6-qtwebengine 553
firefox-esr 491
firefox 358
librewolf 358
qt5-qtwebengine 338
xen 333
chromium 305
thunderbird 227
imagemagick 223
webkit2gtk 207
wireshark 205
go 202
curl 196
openjdk11 183
mariadb 171
openjdk8 170
vim 167
apache2 151
postgresql15 150
nodejs 149
openjdk17 145
openssl 143
ffmpeg 132
dotnet8-runtime 128
dotnet9-runtime 114
bind 114
postgresql16 109
dotnet10-runtime 109
postgresql17 106
py3-django 106
tiff 100
freerdp 100
postgresql18 98
openjdk21 97
wolfssl 97
samba 92
xorg-server 87
imagemagick6 85
qemu 85
nodejs-current 84
10,741 results · Feed
-
Unscored —
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechani…
-
High 8.1
PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication res…
-
Medium 6.8
A use-after-free vulnerability exists in the way Webkit’s GraphicsContext handles certain events in WebKitGTK 2.30.4. A…
-
High 8.8
An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64. A specially crafted HTML we…
-
Medium 6.8
A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitG…
-
High 7.5
Regular Expression Denial of Service in Addressable templates
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addr…
-
Unscored —
There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able …
-
Unscored —
In the xrdp package (in branches through 3.14) for Alpine Linux, RDP sessions are vulnerable to man-in-the-middle attac…
-
Unscored —CVE-2021-30557 EPSS 12%
Use after free in TabGroups in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install…
-
Unscored —
Use after free in WebAudio in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit hea…
-
Unscored —
Use after free in Sharing in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a…
-
High 8.8CVE-2021-30554 Exploited
Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap c…
KEV Nov 3, 2021 -
Critical 9.8
SQL Injection in Django
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
-
Unscored —
An out-of-bounds write vulnerability was found in DjVuLibre in DJVU::DjVuTXT::decode() in DjVuText.cpp via a crafted dj…
-
Unscored —
xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary…
-
Unscored —
inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operat…
-
Unscored —
x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security v…
-
Unscored —
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-o…
-
Unscored —
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circu…
-
Unscored —
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to…
-
Low 3.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management plugin
RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management` plugin, its consumer tag was rendered without proper <script…
-
Unscored —
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information ca…
-
High 7.5
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authe…
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. A heap buffer overflow in function DJVU::GBitmap::decode() via crafte…
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::has_data() via craf…
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds write in function DJVU::filter_bv() via crafted djvu…
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. An integer overflow in function render() in tools/ddjvu via crafted d…
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. A Stack overflow in function DJVU::DjVuDocument::get_djvu_file() via …
-
Unscored —
A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vu…
-
Unscored —
When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with…
-
Unscored —
By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, re…
-
Unscored —
Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We …
-
Unscored —
Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS pa…
-
Unscored —
If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and g…
-
Unscored —
A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when…
-
Unscored —
A compromised content process could have performed session history manipulations it should not have been able to due to…
-
Unscored —
When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been int…
-
Unscored —
Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy preve…
-
Unscored —
The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash…
-
Unscored —
Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking r…