Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
qt6-qtwebengine 553
firefox-esr 491
firefox 358
librewolf 358
qt5-qtwebengine 338
xen 333
chromium 305
thunderbird 227
imagemagick 223
webkit2gtk 207
wireshark 205
go 202
curl 196
openjdk11 183
mariadb 171
openjdk8 170
vim 167
apache2 151
postgresql15 150
nodejs 149
openjdk17 145
openssl 143
ffmpeg 132
dotnet8-runtime 128
dotnet9-runtime 114
bind 114
postgresql16 109
dotnet10-runtime 109
postgresql17 106
py3-django 106
tiff 100
freerdp 100
postgresql18 98
openjdk21 97
wolfssl 97
samba 92
xorg-server 87
imagemagick6 85
qemu 85
nodejs-current 84
10,741 results · Feed
-
Unscored —
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for ex…
-
Unscored —
A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide…
-
Unscored —
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernati…
-
Unscored —
Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a craft…
-
Unscored —
decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when t…
-
Unscored —
track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing.
-
Unscored —
An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING…
-
Low 2.6
XXE in Nokogiri
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external …
-
Unscored —
WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a mall…
-
Unscored —
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1…
-
Unscored —
Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related t…
-
Unscored —
GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function writ…
-
Unscored —
With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unpriv…
-
Unscored —
smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very signi…
-
Unscored —
smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of…
-
Low 3.7
Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted …
-
Unscored —
srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timest…
-
Unscored —
User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential p…
-
Unscored —
A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. W…
-
Medium 6.5
Enumeration of users in HashiCorp Vault
HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.
-
Unscored —
An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array…
-
Unscored —
An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC…
-
Unscored —
An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC …
-
Unscored —
An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a…
-
Unscored —
An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing g…
-
Unscored —
An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_RESET_WATCHES request, not all tracking …
-
Unscored —
An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the wat…
-
Unscored —
An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specif…
-
Unscored —
An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full p…
-
Unscored —
An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reportin…
-
Unscored —
An issue was discovered in Xen through 4.14.x. In the Ocaml xenstored implementation, the internal representation of th…
-
Unscored —
An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO …
-
Unscored —
An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and th…
-
Unscored —
An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block …
-
Unscored —
A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege …
-
Unscored —
An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch even…
-
Unscored —
An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vector…
-
Unscored —
An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must …
-
Unscored —
In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer o…
-
Critical 9.8
Authentication Bypass in github.com/russellhaering/gosaml2
The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of proces…