Ecosystem
Debian
61,565 known vulnerabilities.
Most affected packages
Latest advisories
-
High max 7.6DSA-6189-1 2 CVEs
libpng1.6 - security update
-
High max 8.2DLA-4519-1 6 CVEs
netty - security update
-
Critical max 10.0DSA-6188-1 3 CVEs
lxd - security update
-
High max 8.2DLA-4518-1 2 CVEs
phpseclib - security update
-
UnscoredDLA-4517-1 0 CVEs
roundcube - security update
61,517 results · Feed
-
Unscored —
net: skbuff: propagate shared-frag marker in skb_zerocopy()
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for no…
-
Medium 6.3
libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmlto…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: fix use-after-free on lower qd…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: tun: Require CAP_NET_ADMIN to attach to an ownerles…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reclaim ended sessions on logoff and expirat…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection The pendin…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer connection scavenging while session lo…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short SESSION_SETUP responses s…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix fiemap wild read on empty truncate…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in s…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2_read() …
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Clear prev_fbuf on capture buffer rele…
-
Unscored —
SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update
SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update. With the array_datatypes option off, which is the default, insert(), update() and values() treat an arrayref column value as literal SQL. It…
-
Medium 5.3
Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py pe…
-
Medium 4.1
Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms compute…
-
Low 2.1
Botan is a C++ cryptography library. Prior to 3.13.0, Botan's X.509 Distinguished Name decoder flattens the Attribute-V…
-
Medium 5.4
CRIU is a checkpoint and restore tool for Linux. Prior to 4.2.1, CRIU injects a syscall;int3 sequence at the start of t…
-
Critical 9.2
CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle…
-
Unscored —
xen-netback: defer xenvif_mcast_addr_list_free()
In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen f…
-
Unscored —
xen-blkback: Avoid UAF when reading I/O statistics
In the Linux kernel, the following vulnerability has been resolved: xen-blkback: Avoid UAF when reading I/O statistics Reading I/O statistics via sysfs concurrently with tearing down a frontend device might result in UAF or a NULL dereference, as the reading …
-
Unscored —
xen-netback: Fix UAF when reading statistics data
In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix UAF when reading statistics data The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to …
-
Medium 5.5
EDFbrowser before 2.16 Out-of-Bounds Write via check_edf_file() Annotation Signals
EDFbrowser before 2.16 contains an out-of-bounds write vulnerability in check_edf_file() that allows attackers to overflow the 256-element annot_ch array by supplying excessive annotation signals. Attackers can craft an EDF+ or BDF+ file with more than 256 an…
-
Medium 4.4
Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation
A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper…
-
Low 2.3
Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true
The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external entity (XXE) injection in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to…
-
High 8.4
In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting …
-
Medium 6.9
Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects
The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] metadata attribute in S…
-
High 8.4
The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, s…
-
High 8.2
The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive regula…
-
Unscored —
Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> el…
-
High 8.7
The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted documen…
-
Medium 5.5
Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry
Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeig…
-
High 8.5
Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attacker…
-
High 8.2
Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10
There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.
-
Low 2.3
Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a remote attacker to control the host, scheme, and port of …
-
Medium 6.3
In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\Reque…
-
Low 2.3
Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers
The Symfony Security HTTP component AuthenticatorManager::authenticateUser() does not run the firewall user checker’s checkPostAuth() method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expir…
-
Medium 5.9
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes…