Ecosystem
Azure Linux
13,277 known vulnerabilities.
Most affected packages
13,257 results · Feed
-
Medium 5.3
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can se…
-
Medium 6.2
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 do not safely validate the required num_scan_inputs a…
-
Medium 6.2
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an em…
-
Medium 6.2
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInference_opset1_to_6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verify…
-
High 7.5
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before r…
-
Medium 6.5
zip: AES Entry HMAC Authentication Bypass on Premature EOF
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reache…
-
Critical 10.0CVE-2026-115905 Public exploit
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling th…
-
Unscored —
drm/vc4: drain the hangcheck timer and works on V3D unbind
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: …
-
Unscored —
ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
In the Linux kernel, the following vulnerability has been resolved: ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM The probe function puts the device into the runtime PM active state with only the "iis" bus clock enabled, but it also sets pr…
-
Unscored —
drm/amdgpu: serialize vblank counter reads against GPU reset
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: serialize vblank counter reads against GPU reset The vblank counter callback reads display registers and scanout position without holding reset_domain->sem. During GPU recovery, d…
-
Unscored —
net: openvswitch: validate transport header presence in set_ipv6_addr
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in set_ipv6_addr When executing IPv6 address rewrite actions on IPv6 fragments, set_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv…
-
Medium 4.5
Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getN…
-
Low 2.0
Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.
-
Medium 6.3
GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The att…
-
Low 3.7
adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names
adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or read…
-
Critical 9.4
Distrust compromised intermediate certificates in ssl module
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configur…
-
Low 2.1
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function sour…
-
Critical 9.9CVE-2026-115893 Public exploit
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. …
-
Critical 9.9CVE-2026-115889 Public exploit
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with ma…
-
Medium 5.4
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Tw…
-
Low 3.1
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that th…
-
High 7.5
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, witho…
-
High 7.5
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line le…
-
High 8.7
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously addin…
-
Medium 4.9
Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the c…
-
High 7.4CVE-2026-106069 Public exploit
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…
-
Low 3.3CVE-2026-106073 Public exploit
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…
-
Low 3.6CVE-2026-106071 Public exploit
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…
-
Medium 6.7CVE-2026-106072 Public exploit
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint whe…
-
Medium 4.8CVE-2026-106074 Public exploit
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, a…
-
High 7.4CVE-2026-105483 Public exploit
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…
-
Medium 6.5CVE-2026-105481 Public exploit
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the…
-
High 7.4CVE-2026-105482 Public exploit
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …
-
Medium 4.7
serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's sour…
-
Unscored —
dm-integrity: fix NULL pointer dereference when the 'R' flag is used
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the user activates the device in the 'R' mode, a cras…
-
High 8.8
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token…
-
High 8.8
KVM: x86: Use active memslots for the per-vCPU MMIO cache
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fil…
-
High 7.5
bnxt_en: fix DMA mapping length for padded small packets
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfa…
-
Unscored —
fs: Free any excess xarray nodes in clear_inode()
In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear_inode() For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have …
-
Critical 9.8
net/mlx5e: Prevent stale XSK buffer release on refill retry
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF_XDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent ba…