Ecosystem
Debian
61,817 known vulnerabilities.
Most affected packages
3,227 results · Clear filters · Feed
-
Unscored —CVE-2019-5489 Public exploit
The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe pag…
-
High 8.8
Archive_Tar contains Potential RCE if filename starts with phar://
PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called with…
-
Critical 9.8CVE-2018-20433 Public exploit
XML External Entity Reference in mchange:c3p0
c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
-
Critical 9.8
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checkin…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted met…
-
Critical 9.8
Privilege Escalation in Kubernetes
In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backe…
-
Unscored —
A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully exe…
-
Unscored —
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. This was addressed in wiretap/…
-
Unscored —
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh …
-
Unscored —CVE-2018-18955 Public exploit
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escala…
-
Unscored —CVE-2018-5407 Public exploit
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attack…
-
Unscored —CVE-2018-19131 Public exploit
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.
-
Medium 5.3
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessiv…
-
Unscored —
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ …
-
Unscored —
A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabl…
-
Medium 6.1CVE-2016-6328 Public exploit
A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can…
-
Unscored —
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map…
-
Unscored —
ACME mini_httpd before 1.30 lets remote users read arbitrary files.
-
High 7.8CVE-2018-15687 Public exploit
systemd: chown_one() can dereference symlinks
A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.
-
High 7.0CVE-2018-15686 Public exploit
systemd: reexec state injection: fgets() on overlong lines leads to line splitting
A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected relea…
-
Unscored —
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options w…
-
Unscored —
LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.…
-
Critical 10.0CVE-2018-4013 Public exploit
An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server …
-
Unscored —
A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and wri…
-
Critical 9.1
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client cou…
-
Unscored —CVE-2018-17961 Public exploit
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving er…
-
Critical 9.8
Unrestricted Upload of File with Dangerous Type in blueimp-file-upload
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
-
High 7.5CVE-2018-18074 Public exploit
Insufficiently Protected Credentials in Requests
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
-
Unscored —
_set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by…
-
Unscored —CVE-2018-1000810 Public exploit
The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 conta…
-
Unscored —
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x b…
-
High 7.8
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with …
KEV Jan 26, 2026 -
High 7.5CVE-2018-11761 Public exploit
High severity vulnerability that affects org.apache.tika:tika-core
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
-
Unscored —CVE-2018-17182 Public exploit
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles…
-
Unscored —CVE-2018-17144 Public exploit
Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16…
-
Unscored —
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements …
-
High 7.5
High severity vulnerability that affects OPCFoundation.NetStandard.Opc.Ua
Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.
-
Critical 9.8
TCPDF vulnerable to attackers triggering deserialization of arbitrary data
An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
-
Unscored —CVE-2018-16517 Public exploit
asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the attacker to cause a den…
-
Unscored —
The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packets
The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various…