Ecosystem
Debian
61,817 known vulnerabilities.
Most affected packages
linux 20,203
chromium 5,831
linux-6.12 2,889
firefox-esr 1,430
thunderbird 1,395
webkit2gtk 960
imagemagick 867
wireshark 771
wpewebkit 597
xen 487
ffmpeg 442
qemu 442
gpac 393
wordpress 354
freerdp2 319
binutils 301
openssl 296
mediawiki 285
tiff 272
apache2 270
phpmyadmin 263
vim 258
freerdp3 248
asterisk 229
curl 222
samba 204
nvidia-graphics-drivers 198
tcpdump 187
cacti 175
glibc 173
clamav 169
ghostscript 168
python-django 164
bind9 159
wolfssl 151
xorg-server 151
openjdk-17 150
nvidia-graphics-drivers-tesla-470 148
graphicsmagick 147
golang-1.19 143
3,228 results · Clear filters · Feed
-
High 8.1CVE-2015-5600 Public exploit
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processi…
-
Unscored —CVE-2014-7912 Public exploit
The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other product…
-
High 7.5
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service …
KEV Oct 8, 2026 -
Unscored —
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly…
-
Unscored —CVE-2015-3202 Public exploit
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as r…
-
Unscored —
The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-v…
-
Unscored —
The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n,…
-
Unscored —
The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n…
-
Unscored —
The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.…
-
Unscored —
Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0…
-
Medium —
Improper Input Validation in Apache Jackrabbit
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet …
-
Unscored —
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in …
-
Unscored —
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in …
-
Low 3.7
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pr…
-
Critical 10.0
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and…
KEV Oct 8, 2026 -
Unscored —
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a…
-
Unscored —
internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentati…
-
Unscored —
The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers …
-
Unscored —CVE-2014-7822 Public exploit
The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restricti…
-
Unscored —
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.…
-
Unscored —
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,…
-
High 8.8CVE-2014-9495 Public exploit
Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when runnin…
-
Unscored —
The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client au…
-
Unscored —
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k…
-
Unscored —
The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly cal…
-
Unscored —
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificat…
-
Unscored —
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attacke…
-
Unscored —
Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via …
-
Unscored —CVE-2014-7208 Public exploit
GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in…
-
Unscored —
Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 …
-
Unscored —CVE-2014-9322 Public exploit
arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack …
-
Unscored —CVE-2014-9219 Public exploit
Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allo…
-
Unscored —
libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows r…
-
Unscored —CVE-2014-9236 Public exploit
Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier a…
-
Unscored —CVE-2014-9235 Public exploit
Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated…
-
Unscored —
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 al…
-
Medium —CVE-2014-3625 Public exploit
Improper Limitation of a Pathname to a Restricted Directory in Spring Framework
Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.
-
Unscored —
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow re…
-
Unscored —
The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 thr…
-
Unscored —
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to …