Ecosystem
Debian
61,817 known vulnerabilities.
Most affected packages
linux 20,203
chromium 5,831
linux-6.12 2,889
firefox-esr 1,430
thunderbird 1,395
webkit2gtk 960
imagemagick 867
wireshark 771
wpewebkit 597
xen 487
ffmpeg 442
qemu 442
gpac 393
wordpress 354
freerdp2 319
binutils 301
openssl 296
mediawiki 285
tiff 272
apache2 270
phpmyadmin 263
vim 258
freerdp3 248
asterisk 229
curl 222
samba 204
nvidia-graphics-drivers 198
tcpdump 187
cacti 175
glibc 173
clamav 169
ghostscript 168
python-django 164
bind9 159
wolfssl 151
xorg-server 151
openjdk-17 150
nvidia-graphics-drivers-tesla-470 148
graphicsmagick 147
golang-1.19 143
3,228 results · Clear filters · Feed
-
Unscored —
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib befo…
-
Unscored —
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an …
-
Unscored —CVE-2016-5699 Public exploit
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) bef…
-
Unscored —
Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3…
-
Unscored —
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password …
-
Unscored —CVE-2016-6512 Public exploit
epan/dissectors/packet-wap.c in Wireshark 2.x before 2.0.5 omits an overflow check in the tvb_get_guintvar function, wh…
-
Unscored —CVE-2016-6504 Public exploit
epan/dissectors/packet-ncp2222.inc in the NDS dissector in Wireshark 1.12.x before 1.12.13 does not properly maintain a…
-
Unscored —CVE-2016-6505 Public exploit
epan/dissectors/packet-packetbb.c in the PacketBB dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 all…
-
Unscored —CVE-2016-6516 Public exploit
Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linux kernel through 4.7 allows local users…
-
Unscored —CVE-2016-6187 Public exploit
The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 4.6.5 does not validate the buf…
-
Unscored —
net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, whi…
-
Medium 6.1CVE-2016-6186 Public exploit
Django Cross-site scripting Vulnerability
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject ar…
-
Unscored —
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitra…
-
Unscored —
Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of s…
-
Unscored —CVE-2016-4997 Public exploit
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linu…
-
Unscored —CVE-2016-4998 Public exploit
The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local…
-
Unscored —
The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attack…
-
Critical 9.8
phpMyAdmin Code Injection vulnerability
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted strin…
-
Unscored —
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted …
-
Unscored —CVE-2016-1583 Public exploit
The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to g…
-
Unscored —
Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to e…
-
Unscored —
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 all…
-
Critical 9.8
Improper Access Control in Apache Shiro
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
KEV Nov 3, 2021 -
Critical 9.8
Improper Input Validation in Apache ActiveMQ
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
KEV Feb 10, 2022 -
Unscored —CVE-2016-4486 Public exploit
The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certai…
-
Unscored —CVE-2016-4578 Public exploit
sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local u…
-
Unscored —
The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly ma…
-
Unscored —CVE-2016-4558 Public exploit
The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a den…
-
Unscored —CVE-2016-1838 Public exploit
The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before …
-
High 7.8CVE-2016-1834 Public exploit
Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X …
-
Unscored —CVE-2016-1839 Public exploit
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS bef…
-
High 7.5CVE-2016-3627 Public exploit
The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-de…
-
Medium 5.5
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary f…
KEV Nov 3, 2021 -
Unscored —
The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via…
-
Unscored —
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files v…
-
High 8.4
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6…
KEV Sep 9, 2024 -
Medium 5.5
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct…
KEV Nov 3, 2021 -
Unscored —
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a…
-
Unscored —CVE-2016-1575 Public exploit
The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which a…
-
Unscored —CVE-2016-1576 Public exploit
The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which al…