Ecosystem
Alpine
10,677 known vulnerabilities.
Most affected packages
10,638 results · Feed
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 8.8CVE-2026-96230 Public exploit
ASP.NET Core Remote Code Execution Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 8.8
.NET Framework Elevation of Privilege Vulnerability
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Framework Remote Code Execution Vulnerability
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Framework Remote Code Execution Vulnerability
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
-
Critical 9.4
ASP.NET Core Tampering Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.4
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
-
High 7.3
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
Medium 5.9
ASP.NET Core Denial of Service Vulnerability
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Elevation of Privilege Vulnerability
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
Critical 9.1
ASP.NET Core Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
-
High 8.1
ASP.NET Core Elevation of Privilege Vulnerability
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
-
Medium 6.7
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
High 8.1
.NET and Visual Studio Remote Code Execution Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
-
High 7.5
ASP.NET Core Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
High 7.3
.NET Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
-
Medium 5.9
Microsoft QUIC Information Disclosure Vulnerability
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
-
Medium 5.9
.NET Information Disclosure Vulnerability
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
Medium 6.5
Unbounded memory allocation in the Prometheus rule conversion API
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
-
Medium 6.3
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to th…
-
Medium 6.5
Git Sync connection configuration can be modified with read-only access
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental p…
-
Critical 10.0
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation res…
-
Medium 4.7
gnttab: cache-flush handling may cause page reference leak
With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a pa…
-
High 7.5
Arm: multiple issues with GNTTABOP_cache_flush
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_ca…
-
Medium 5.5
VMX: VMentry failure with branch tracing and blocked states
For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulti…
-
High 8.8
grant-table: double version change race
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second c…
-
High 8.8
x86: XPTI may break on huge-memory systems
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. …
-
Critical 9.8
x86/AMD: ineffectual Zenbleed workaround
The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice v…
-
Critical 10.0
Integer Overflow or Wraparound in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…
KEV Oct 29, 2026 -
Medium 5.3
FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion
FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB image that triggers out-of-bounds memcpy during PN…