Ecosystem
Debian
61,995 known vulnerabilities.
Most affected packages
2,990 results · Clear filters · Feed
-
Critical 9.2
Laravel TokenGuard authentication bypass through non-string API credentials
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…
-
Critical 9.1CVE-2026-91403 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Critical 9.1
Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no
Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key a…
-
Critical 9.8
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK d…
-
Critical 10.0
Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0…
-
Critical 9.0
Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1…
-
Critical 9.3
Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are reco…
-
Critical 10.0
Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 throu…
-
Critical 10.0
Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.…
-
Critical 9.3
Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, a…
-
Critical 10.0
Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, fr…
-
Critical 9.8
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulner…
-
Critical 9.2
RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…
KEV Oct 26, 2026 -
Critical 9.2
RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…
KEV Oct 26, 2026 -
Critical 9.9
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns t…
-
Critical 9.1
Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates
Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys ar…
-
Critical 9.6
UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker l…
-
Critical 9.6
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system acc…
-
Critical 9.6
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system acc…
-
Critical 9.6
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass syste…
-
Critical 9.6
Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social eng…
-
Critical 9.6
Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cro…
-
Critical 9.6
Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sen…
-
Critical 9.6
Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromise…
-
Critical 9.6
Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engi…
-
Critical 9.6
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging soc…
-
Critical 9.6
Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromise…
-
Critical 9.6
Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system…
-
Critical 9.6
Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypa…
-
Critical 9.6
Incorrect authorization in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging soc…
-
Critical 9.6
Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web o…
-
Critical 9.6
UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveragi…
-
Critical 9.6
Improper input validation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveragin…
-
Critical 9.6
Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin…
-
Critical 9.6
Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised…
-
Critical 9.6
Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cr…
-
Critical 9.6
Improper privilege management in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a loc…
-
Critical 9.6
Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the…
-
Critical 9.6
Incorrect authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had comp…
-
Critical 9.6
Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveragin…