Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
qt6-qtwebengine 553
firefox-esr 491
firefox 358
librewolf 358
qt5-qtwebengine 338
xen 333
chromium 305
thunderbird 227
imagemagick 223
webkit2gtk 207
wireshark 205
go 202
curl 196
openjdk11 183
mariadb 171
openjdk8 170
vim 167
apache2 151
postgresql15 150
nodejs 149
openjdk17 145
openssl 143
ffmpeg 132
dotnet8-runtime 128
dotnet9-runtime 114
bind 114
postgresql16 109
dotnet10-runtime 109
postgresql17 106
py3-django 106
tiff 100
freerdp 100
postgresql18 98
openjdk21 97
wolfssl 97
samba 92
xorg-server 87
imagemagick6 85
qemu 85
nodejs-current 84
10,741 results · Feed
-
Medium 6.5
A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNA…
-
Unscored —
A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDo…
-
Unscored —
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh …
-
Unscored —
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a stack-based buffer overflow in …
-
Unscored —
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There is a NULL pointer dereference in ifil…
-
Unscored —
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a heap-based buffer overflow in t…
-
Unscored —
Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of …
-
Unscored —
psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because…
-
Unscored —
psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of…
-
Unscored —
psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions becaus…
-
Unscored —
An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device…
-
Unscored —
ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application cr…
-
Unscored —
ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer der…
-
Unscored —
An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. …
-
Critical 9.8CVE-2018-16395 EPSS 11%
Ruby Openssl Allows Incorrect Value Comparison
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return t…
-
Unscored —CVE-2018-5407 Public exploit
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attack…
-
Unscored —CVE-2018-12543 EPSS 36%
In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting …
-
Unscored —
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote…
-
High 8.0
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER …
-
Unscored —CVE-2018-19206 EPSS 56%
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload att…
-
Medium 5.3
An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS quer…
-
Unscored —
keepalived 2.0.8 used mode 0666 when creating new temporary files upon a call to PrintData or PrintStats, potentially l…
-
Unscored —
keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData o…
-
Unscored —
keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintDat…
-
High 8.2
nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to c…
-
Medium 5.3
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessiv…
-
Medium 5.3CVE-2018-16844 EPSS 13%
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessiv…
-
Unscored —
A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabl…
-
High 8.1
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap proble…
-
High 7.5
An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authori…
-
Unscored —
An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a…
-
Medium 6.1CVE-2016-6328 Public exploit
A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can…
-
Medium 6.4
It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos a…
-
Medium 4.4
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function…
-
Medium 4.3
A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy…
-
Medium 4.3
Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to…
-
Unscored —CVE-2018-0734 EPSS 12%
Timing attack against DSA
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affec…
-
Unscored —
Timing attack against ECDSA signature generation
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.…
-
Unscored —
ACME mini_httpd before 1.30 lets remote users read arbitrary files.
-
Unscored —
An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related…