Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
qt6-qtwebengine 553
firefox-esr 491
firefox 358
librewolf 358
qt5-qtwebengine 338
xen 333
chromium 305
thunderbird 227
imagemagick 223
webkit2gtk 207
wireshark 205
go 202
curl 196
openjdk11 183
mariadb 171
openjdk8 170
vim 167
apache2 151
postgresql15 150
nodejs 149
openjdk17 145
openssl 143
ffmpeg 132
dotnet8-runtime 128
dotnet9-runtime 114
bind 114
postgresql16 109
dotnet10-runtime 109
postgresql17 106
py3-django 106
tiff 100
freerdp 100
postgresql18 98
openjdk21 97
wolfssl 97
samba 92
xorg-server 87
imagemagick6 85
qemu 85
nodejs-current 84
10,741 results · Feed
-
Unscored —
HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will …
-
Unscored —
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerpri…
-
Unscored —
URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, all…
-
Unscored —
A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thu…
-
Unscored —
Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 4…
-
Unscored —
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. …
-
Unscored —
A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the …
-
Unscored —
Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory cor…
-
Unscored —
A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not…
-
Unscored —
WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, l…
-
Unscored —
The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing …
-
Unscored —
Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address …
-
Unscored —
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which all…
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iClou…
-
Unscored —
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mech…
-
Unscored —
libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.
-
Unscored —
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the …
-
Unscored —
In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may …
-
Unscored —
The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause informa…
-
Unscored —
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code …
-
Unscored —
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remot…
-
Critical 9.1
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of s…
-
Unscored —
curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in d…
-
Unscored —
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash. This was a…
-
Unscored —
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the DNS dissector could crash. This was addressed in epan/diss…
-
Unscored —
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive…
-
Unscored —
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dis…
-
Unscored —
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP dissector could crash. This was addressed in ep…
-
Unscored —
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. This was addressed in epan/di…
-
Medium 5.5
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addre…
-
Unscored —
An issue was discovered in PoDoFo 0.9.5. The function PdfDocument::Append() in PdfDocument.cpp in PoDoFo 0.9.5 allows r…
-
Unscored —
An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows re…
-
Unscored —
An issue was discovered in PoDoFo 0.9.5. There is an Excessive Recursion in the PdfPagesTree::GetPageNode() function of…
-
Unscored —
PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), …
-
Unscored —
The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) v…
-
Unscored —
The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such a…
-
Unscored —
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform rem…
-
Unscored —
jbig2_add_page in jbig2enc.cc in libjbig2enc.a in jbig2enc 0.29 allows remote attackers to cause a denial of service (u…
-
Unscored —
This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation…
-
Unscored —
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a…