Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
qt6-qtwebengine 553
firefox-esr 491
firefox 358
librewolf 358
qt5-qtwebengine 338
xen 333
chromium 305
thunderbird 227
imagemagick 223
webkit2gtk 207
wireshark 205
go 202
curl 196
openjdk11 183
mariadb 171
openjdk8 170
vim 167
apache2 151
postgresql15 150
nodejs 149
openjdk17 145
openssl 143
ffmpeg 132
dotnet8-runtime 128
dotnet9-runtime 114
bind 114
postgresql16 109
dotnet10-runtime 109
postgresql17 106
py3-django 106
tiff 100
freerdp 100
postgresql18 98
openjdk21 97
wolfssl 97
samba 92
xorg-server 87
imagemagick6 85
qemu 85
nodejs-current 84
10,741 results · Feed
-
Unscored —
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watc…
-
Unscored —
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2, tvOS 12.2, Saf…
-
High 8.8
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS…
KEV May 4, 2022 -
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 1…
-
Unscored —CVE-2018-1311 Public exploit
The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external…
-
Unscored —
Libspiro through 20190731 has a stack-based buffer overflow in the spiro_to_bpath0() function in spiro.c.
-
High 7.5
knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with ve…
-
Unscored —
In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notification…
-
Unscored —
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.…
-
Unscored —
In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or …
-
Unscored —
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network acce…
-
Unscored —
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled da…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possi…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerat…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging r…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) …
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest O…
-
Unscored —
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before…
-
Medium 5.3
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly…
-
High 7.1
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh …
-
Medium 5.4
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS…
-
Unscored —
radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, u…
-
Unscored —CVE-2019-1551 EPSS 14%
rsaz_512_sqr overflow bug on x86_64
There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect wou…
-
Critical 9.8
phpMyAdmin unsanitized Git information
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
-
Unscored —
In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at…
-
Unscored —
In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/a…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation wher…
-
Unscored —
An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrec…
-
Unscored —
An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c mishandles buffer…
-
Unscored —
An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorre…
-
Unscored —
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current enco…
-
Unscored —
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0x…
-
High 7.3
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properl…
-
High 7.3
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling sc…
-
Unscored —
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
-
Unscored —CVE-2019-18679 EPSS 43%
An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to i…
-
High 7.5
TCP-pipelined queries can bypass tcp-clients limit
With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than t…
-
Medium 6.4
Ansible password prompts could expose passwords
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
-
Low 3.7
ecdsa Denial of Service vulnerability in signature verification and signature malleability
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
-
Unscored —
WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…