Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
qt6-qtwebengine 553
firefox-esr 491
firefox 358
librewolf 358
qt5-qtwebengine 338
xen 333
chromium 305
thunderbird 227
imagemagick 223
webkit2gtk 207
wireshark 205
go 202
curl 196
openjdk11 183
mariadb 171
openjdk8 170
vim 167
apache2 151
postgresql15 150
nodejs 149
openjdk17 145
openssl 143
ffmpeg 132
dotnet8-runtime 128
dotnet9-runtime 114
bind 114
postgresql16 109
dotnet10-runtime 109
postgresql17 106
py3-django 106
tiff 100
freerdp 100
postgresql18 98
openjdk21 97
wolfssl 97
samba 92
xorg-server 87
imagemagick6 85
qemu 85
nodejs-current 84
10,741 results · Feed
-
Medium 5.3
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead user…
-
Low 3.3
A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-aft…
-
Medium 5.3
The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.
-
Medium 6.5
The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read v…
-
Low 3.3
The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if…
-
Medium 5.3
The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an inpu…
-
Medium 5.3
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with…
-
Medium 5.3
The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to …
-
Low 3.7
The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if t…
-
Unscored —CVE-2018-14767 EPSS 29%
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag …
-
Medium 4.2
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtu…
-
Unscored —
An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header exte…
-
Unscored —
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMG…
-
Unscored —
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.
-
Unscored —
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() ma…
-
Unscored —
ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recove…
-
Unscored —
ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows local users to achieve partial plaintext recovery (f…
-
High 7.5
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect t…
-
Medium 5.5
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; …
-
High 7.5
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker cou…
-
Medium 5.5
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds…
-
Medium 4.3
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the…
-
Medium 5.5
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local…
-
Medium 5.2
It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially u…
-
Medium 6.5
It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user syst…
-
High 7.5
An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server …
-
High 7.4
A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max…
-
High 7.4CVE-2017-12150 EPSS 13%
It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when c…
-
Medium 4.1
An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14…
-
Medium 6.1
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024…
-
Medium 5.3CVE-2018-10906 Public exploit
In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is ac…
-
Unscored —
FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia …
-
Unscored —
FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F form…
-
Unscored —
FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF form…
-
Unscored —
FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva fo…
-
Unscored —
FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format …
-
Unscored —
FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in …
-
Unscored —
The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory co…
-
Unscored —
An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5O_sdsp…
-
Unscored —
trim_whitespace in lexer.l in libConfuse v3.2.1 has an out-of-bounds read.