Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
qt6-qtwebengine 553
firefox-esr 491
firefox 358
librewolf 358
qt5-qtwebengine 338
xen 333
chromium 305
thunderbird 227
imagemagick 223
webkit2gtk 207
wireshark 205
go 202
curl 196
openjdk11 183
mariadb 171
openjdk8 170
vim 167
apache2 151
postgresql15 150
nodejs 149
openjdk17 145
openssl 143
ffmpeg 132
dotnet8-runtime 128
dotnet9-runtime 114
bind 114
postgresql16 109
dotnet10-runtime 109
postgresql17 106
py3-django 106
tiff 100
freerdp 100
postgresql18 98
openjdk21 97
wolfssl 97
samba 92
xorg-server 87
imagemagick6 85
qemu 85
nodejs-current 84
10,741 results · Feed
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed e…
-
Unscored —
Signatures are written to disk before and read during verification, which might be subject to a race condition when a m…
-
Unscored —
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal…
-
Unscored —
When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that …
-
Unscored —
OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted o…
-
Unscored —
If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional un…
-
Unscored —
When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully pre…
-
Unscored —
Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usua…
-
Unscored —
When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an att…
-
Unscored —
Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This bug only aff…
-
Unscored —
Address bar search suggestions in private browsing mode were re-using session data from normal mode. *This bug only aff…
-
Unscored —
A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading t…
-
Unscored —
A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager t…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corr…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed e…
-
Unscored —
In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bou…
-
Medium 6.5
Improper network isolation in Hashicorp Nomad
HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.
-
Unscored —
Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificat…
-
Medium 6.8
Repository credentials passed to alternate domain
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain…
-
Unscored —
Use after free in Network service in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially expl…
-
Unscored —
Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to instal…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corr…
KEV Nov 3, 2021 -
Unscored —
Use after free in Accessibility in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to ins…
-
Unscored —
Use after free in Spell check in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to insta…
-
Unscored —
Use after free in Loader in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap …
-
Unscored —
Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform o…
-
Unscored —
Use after free in Autofill in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit hea…
-
Unscored —
Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed a remote attacker who had compromised the …
-
Unscored —
Use after free in BFCache in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap…
-
Unscored —CVE-2021-31618 EPSS 52%
NULL pointer dereference on specially crafted HTTP/2 request
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…
-
Unscored —CVE-2021-22901 EPSS 64%
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used whe…
-
Low 3.1
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TEL…
-
High 8.8
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
-
Unscored —
HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialize…
-
Unscored —
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in u…
-
Unscored —
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a d…