Ecosystem
Debian
61,802 known vulnerabilities.
Most affected packages
169 results · Clear filters · Feed
-
Critical 10.0
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in…
KEV Mar 13, 2025 -
High 8.1
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) whe…
KEV May 6, 2025 -
Critical 10.0
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 t…
KEV Apr 1, 2025 -
High 7.8
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating …
KEV Feb 5, 2025 -
High 8.8
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 1…
KEV Nov 21, 2024 -
Critical 9.8
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timel…
KEV Oct 15, 2024 -
High 8.8
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a…
KEV Aug 26, 2024 -
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exp…
KEV Aug 28, 2024 -
Critical 9.3
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to ste…
KEV Jun 9, 2025 -
Critical 9.1
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code…
KEV May 1, 2025 -
High 7.8
net: fix __dst_negative_advice() race
In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first c…
KEV Aug 7, 2024 -
Medium 6.1
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
KEV Oct 24, 2024 -
High 8.3
Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code insid…
KEV May 28, 2024 -
Critical 9.6
Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside…
KEV May 20, 2024 -
High 8.3
Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bound…
KEV May 16, 2024 -
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slo…
KEV May 30, 2024 -
High 8.8
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15…
KEV Jan 23, 2024 -
High 8.8
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exp…
KEV Jan 17, 2024 -
Medium 5.3
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…
KEV Jun 26, 2024 -
High 7.8
Arbitrary Code Execution (ACE) Vulnerability
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, …
KEV Jan 2, 2024 -
High 8.8
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploi…
KEV Jan 2, 2024 -
Critical 10.0
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class …
KEV Nov 2, 2023 -
High 7.5
HTTP/2 Stream Cancellation Attack
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
KEV Oct 10, 2023 -
High 7.8
Glibc: buffer overflow in ld.so leading to privilege escalation
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binar…
KEV Nov 21, 2023 -
High 8.8
Electron affected by libvpx's heap buffer overflow in vp8 encoding
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
KEV Oct 2, 2023 -
Medium 6.1
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craf…
KEV Feb 12, 2024 -
High 8.8
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead t…
KEV Sep 25, 2023 -
High 8.8
libwebp: OOB write in BuildHuffmanTable
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
KEV Sep 13, 2023 -
High 8.8
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a…
KEV Feb 6, 2024 -
High 8.8
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap cor…
KEV Jun 7, 2023 -
High 8.8
Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap cor…
KEV Apr 17, 2023 -
High 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 …
KEV Apr 10, 2023 -
High 7.8
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities w…
KEV Jun 17, 2025 -
High 7.9
Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. …
KEV Mar 30, 2023 -
High 8.8
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…
KEV Mar 7, 2022 -
Critical 9.8
Unauthenticated Command Injection
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a serve…
KEV Feb 16, 2023 -
High 8.8
Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corr…
KEV Dec 5, 2022 -
High 8.8
Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit…
KEV Apr 15, 2022 -
High 8.8
Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corru…
KEV Mar 28, 2022 -
Critical 9.8
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) …
KEV Aug 9, 2022