Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
qt6-qtwebengine 553
firefox-esr 491
firefox 358
librewolf 358
qt5-qtwebengine 338
xen 333
chromium 305
thunderbird 227
imagemagick 223
webkit2gtk 207
wireshark 205
go 202
curl 196
openjdk11 183
mariadb 171
openjdk8 170
vim 167
apache2 151
postgresql15 150
nodejs 149
openjdk17 145
openssl 143
ffmpeg 132
dotnet8-runtime 128
dotnet9-runtime 114
bind 114
postgresql16 109
dotnet10-runtime 109
postgresql17 106
py3-django 106
tiff 100
freerdp 100
postgresql18 98
openjdk21 97
wolfssl 97
samba 92
xorg-server 87
imagemagick6 85
qemu 85
nodejs-current 84
10,741 results · Feed
-
High 7.5
Allocation of Resources Without Limits or Throttling in HashiCorp Nomad
HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 0.10.3.
-
Unscored —
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configurati…
-
Unscored —
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.…
-
Medium 6.5
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HT…
-
Unscored —
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the…
-
Critical 9.8
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to…
KEV Mar 25, 2022 -
Unscored —
In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon laun…
-
Unscored —
Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to…
-
Unscored —
opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in t…
-
Unscored —
The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket cl…
-
Unscored —
Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure…
-
Unscored —
In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, wit…
-
Unscored —
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15…
-
Unscored —
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15…
-
Unscored —CVE-2019-1352 EPSS 24%
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual…
-
Unscored —CVE-2019-1354 EPSS 23%
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual…
-
Unscored —CVE-2019-1351 Public exploit
A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual…
-
Unscored —CVE-2019-1349 EPSS 34%
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual…
-
Unscored —CVE-2019-1350 EPSS 26%
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual…
-
Unscored —
The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the bl…
-
High 7.5
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
-
High 7.5
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
-
Medium 6.5
There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and…
-
Medium 5.4
There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.…
-
Medium 6.5
All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set…
-
Unscored —CVE-2020-7237 EPSS 37%
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug …
-
Critical 9.8CVE-2019-17361 EPSS 15%
SaltStack Salt is vulnerable to command injection
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
-
Unscored —
Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automati…
-
Unscored —
In Wireshark 3.0.x before 3.0.8, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c…
-
High 7.5
Clam AntiVirus (ClamAV) Software Email Parsing Vulnerability
A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to ineffici…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions th…
-
Low 3.7
Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are…
-
Medium 4.8CVE-2020-2655 Public exploit
Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java…
-
High 8.1
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions…
-
Medium 4.8
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions th…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that…
-
Medium 6.8
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions…
-
Medium 5.9
Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …
-
High 8.1
Certificate validation bypass on Windows in crypto/x509
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making …
KEV Nov 3, 2021