Ecosystem
Debian
61,817 known vulnerabilities.
Most affected packages
linux 20,203
chromium 5,831
linux-6.12 2,889
firefox-esr 1,430
thunderbird 1,395
webkit2gtk 960
imagemagick 867
wireshark 771
wpewebkit 597
xen 487
ffmpeg 442
qemu 442
gpac 393
wordpress 354
freerdp2 319
binutils 301
openssl 296
mediawiki 285
tiff 272
apache2 270
phpmyadmin 263
vim 258
freerdp3 248
asterisk 229
curl 222
samba 204
nvidia-graphics-drivers 198
tcpdump 187
cacti 175
glibc 173
clamav 169
ghostscript 168
python-django 164
bind9 159
wolfssl 151
xorg-server 151
openjdk-17 150
nvidia-graphics-drivers-tesla-470 148
graphicsmagick 147
golang-1.19 143
3,228 results · Clear filters · Feed
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud …
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud …
-
Unscored —CVE-2018-4089 Public exploit
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. Saf…
-
Unscored —CVE-2018-0202 Public exploit
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause…
-
Unscored —
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a m…
-
Unscored —CVE-2018-1000140 Public exploit
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificate…
-
Medium 5.5CVE-2018-1324 Public exploit
Apache Commons Compress vulnerable to denial of service due to infinite loop
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack ag…
-
Critical 9.8
Paramiko not properly checking authentication before processing other requests
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed b…
-
High 8.8
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpat…
-
Unscored —
Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access…
-
Unscored —CVE-2018-8002 Public exploit
In PoDoFo 0.9.5, there exists an infinite loop vulnerability in PdfParserObject::ParseFileComplete() in PdfParserObject…
-
Unscored —
The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out…
-
Unscored —
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of s…
-
Unscored —
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vul…
-
High 7.5
uWSGI Directory Traversal vulnerability
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
-
Critical 9.8
FasterXML jackson-databind allows unauthenticated remote code execution
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JS…
-
Unscored —
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and C…
-
Unscored —
An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asteri…
-
Unscored —CVE-2018-7273 Public exploit
In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables us…
-
Unscored —CVE-2018-7254 Public exploit
The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-o…
-
Unscored —
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port …
-
Unscored —CVE-2018-1049 Public exploit
In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from k…
-
Critical 9.8
Missing certificate validation in Apache JMeter
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
-
Unscored —
LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in …
-
Critical 9.8
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted me…
KEV Nov 3, 2021 -
Low 3.6CVE-2018-1000030 Public exploit
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14…
-
Unscored —
Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious s…
-
Unscored —CVE-2018-6791 Public exploit
An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thu…
-
Unscored —
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the…
-
Critical 9.8
jackson-databind is vulnerable to a deserialization flaw
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
-
Unscored —CVE-2017-1000408 Public exploit
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environm…
-
Unscored —CVE-2017-1000409 Public exploit
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH enviro…
-
Unscored —
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before t…
-
Unscored —CVE-2017-18078 Public exploit
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the…
-
Unscored —CVE-2018-6323 Public exploit
The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU …
-
High 7.5
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon cr…
-
Unscored —CVE-2018-5764 Public exploit
The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses…
-
Unscored —
gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1…
-
Unscored —
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access co…
-
Unscored —CVE-2017-13216 Public exploit
In ashmem_ioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. This coul…