Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
qt6-qtwebengine 553
firefox-esr 491
firefox 358
librewolf 358
qt5-qtwebengine 338
xen 333
chromium 305
thunderbird 227
imagemagick 223
webkit2gtk 207
wireshark 205
go 202
curl 196
openjdk11 183
mariadb 171
openjdk8 170
vim 167
apache2 151
postgresql15 150
nodejs 149
openjdk17 145
openssl 143
ffmpeg 132
dotnet8-runtime 128
dotnet9-runtime 114
bind 114
postgresql16 109
dotnet10-runtime 109
postgresql17 106
py3-django 106
tiff 100
freerdp 100
postgresql18 98
openjdk21 97
wolfssl 97
samba 92
xorg-server 87
imagemagick6 85
qemu 85
nodejs-current 84
10,741 results · Feed
-
Unscored —
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (I…
-
Unscored —
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (P…
-
Unscored —
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handsha…
-
Unscored —
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when p…
-
Unscored —
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) dur…
-
Unscored —
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal …
-
Unscored —
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal …
-
Unscored —
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) durin…
-
Unscored —
There is a stack-based buffer overflow in the lsx_ms_adpcm_block_expand_i function of adpcm.c in Sound eXchange (SoX) 1…
-
Unscored —
There is a heap-based buffer overflow in the ImaExpandS function of ima_rw.c in Sound eXchange (SoX) 14.4.2. A Crafted …
-
Unscored —
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when pro…
-
Unscored —
SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases w…
-
High 8.8
An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A sp…
-
Unscored —
libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.
-
Unscored —
ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26 has a use-after-free issue when the height or width is zero, r…
-
Unscored —
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in …
-
Unscored —
In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addre…
-
Unscored —
In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors…
-
Unscored —
In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overf…
-
Unscored —
In X.Org Server (aka xserver and xorg-server) before 1.19.4, an attacker authenticated to an X server with the X shared…
-
Unscored —
libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successf…
-
Medium 6.5
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those number…
-
Unscored —
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL c…
-
Critical 9.8
Mercurial is vulnerable to shell injection attack
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
-
Medium 6.5
When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 b…
-
High 7.5
Mercurial missing symlink check
Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
-
Unscored —
When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HT…
-
Unscored —
ReadDCMImage in coders/dcm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (NULL pointe…
-
Unscored —
GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an …
-
Unscored —CVE-2017-13704 EPSS 65%
In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call ge…
-
Unscored —
Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote…
-
Unscored —
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu…
-
Unscored —
dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vec…
-
Unscored —
Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or exec…
-
Unscored —
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu…
-
Unscored —
Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-s…
-
Unscored —
The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-para…
-
High 8.8
SaltStack Salt arbitrary command execution in Salt-api via ssh_client
Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.
-
High 8.8
SaltStack Salt Authentication Bypass when using the local_batch client from salt-api
When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.
-
Unscored —
ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows …