Ecosystem
Debian
61,802 known vulnerabilities.
Most affected packages
169 results · Clear filters · Feed
-
Critical 9.8
Remote Code Execution in Spring Framework
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…
KEV Apr 4, 2022 -
High 7.8
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This…
KEV Aug 26, 2026 -
High 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS…
KEV Feb 11, 2022 -
High 7.8
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in co…
KEV Apr 25, 2022 -
High 7.8
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. T…
KEV Jun 2, 2026 -
Critical 10.0
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specifi…
KEV Mar 28, 2022 -
High 7.8
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privil…
KEV May 12, 2023 -
High 8.4
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functi…
KEV Aug 21, 2024 -
High 7.8
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid too…
KEV Jun 27, 2022 -
Medium 6.6
Double Free in net/packet/af_packet.c leading to priviledge escalation
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1…
KEV Apr 11, 2022 -
Low 3.7
Possible view of the setup pages by unauthenticated users if config file already exists
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
KEV Feb 22, 2022 -
Critical 9.0
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…
KEV May 1, 2023 -
Critical 10.0
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …
KEV Dec 10, 2021 -
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially expl…
KEV Nov 3, 2021 -
Critical 9.8
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
KEV Jun 22, 2023 -
High 8.8
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap …
KEV Nov 3, 2021 -
High 8.8
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corru…
KEV Nov 3, 2021 -
Critical 9.8
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories a…
KEV Nov 3, 2021 -
High 7.5
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not…
KEV Nov 3, 2021 -
Critical 9.0
mod_proxy SSRF
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
KEV Dec 1, 2021 -
High 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, …
KEV Nov 3, 2021 -
High 8.5
XStream is vulnerable to a Remote Command Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affec…
KEV Mar 10, 2023 -
High 8.3
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
KEV Oct 6, 2025 -
High 8.8
Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corr…
KEV Nov 3, 2021 -
High 8.8
Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to p…
KEV Nov 3, 2021 -
Medium 6.8
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exe…
KEV Nov 17, 2021 -
High 8.8
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting …
KEV Oct 20, 2022 -
High 8.8
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap co…
KEV Nov 3, 2021 -
High 7.2
SSRF in adminer
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is …
KEV Sep 29, 2025 -
High 8.8
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit hea…
KEV Nov 3, 2021 -
High 7.8
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privileg…
KEV Apr 6, 2022 -
Medium 6.1
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attac…
KEV Jun 22, 2023 -
High 7.8
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrappe…
KEV Aug 25, 2022 -
Critical 9.6
Heap buffer overflow in CefSharp
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
KEV Nov 3, 2021 -
Medium 5.5
Netlogon Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could ru…
KEV Nov 3, 2021 -
Medium 6.3
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML att…
KEV Jun 26, 2024 -
Critical 9.8
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters i…
KEV Jun 22, 2023 -
Medium 6.9
Potential XSS vulnerability in jQuery
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…
KEV Jan 23, 2025 -
High 7.8
In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could…
KEV Nov 3, 2021 -
High 8.8
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are…
KEV Nov 3, 2021