Ecosystem
Debian
61,920 known vulnerabilities.
Most affected packages
11,608 results · Clear filters · Feed
-
Medium 5.5
division by zero in libpcap before 1.10.7
libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.
-
Medium 5.5
abort() in libpcap before 1.10.7 on an invalid BPF opcode
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
-
Medium 5.5
OOBR in libpcap before 1.10.7
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a cr…
-
Medium 5.6
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This h…
-
Medium 6.9
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to …
-
Medium 6.9
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer …
-
Medium 6.9
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
-
Medium 6.9
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
-
Medium 6.5CVE-2026-85769 Public exploit
Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize
A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on or state/migration restore), a malformed state blob can supply an oversized skip-block length that i…
-
Medium 5.9
undici vulnerable to Denial of Service via orphaned RetryHandler response body
undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If th…
-
Medium 6.3
PJSIP: Pre-authentication overflow in the telnet CLI error
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. Several command-line handling pa…
-
Medium 6.3
PJSIP: Pre-authentication overflow in the telnet CLI history
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall (handle_up_down() in cli_telnet…
-
Medium 6.9
PJSIP: SIP message header buffer overflow
PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers (such as Al…
-
Medium 5.9
undici vulnerable to Denial of Service via unbounded decompression of compressed responses
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to lim…
-
Medium 6.5
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie …
-
Medium 5.9
undici vulnerable to Denial of Service via WebSocketStream unclean close
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditi…
-
Medium 5.9
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that cross…
-
Medium 5.3
valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in…
-
Medium 5.9
Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE whi…
-
Medium 6.5
Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a…
-
Medium 5.9
Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the lib…
-
Medium 6.9
node-csv: Prototype replacement still reachable via columns path
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-pa…
-
Medium 6.5
Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leve…
-
Medium 5.3
Heap out-of-bounds read via corrupt nested BSON in field path error message
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to applicatio…
-
Medium 4.2
Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side…
-
Medium 5.3
Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser
An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success …
-
Medium 5.9
Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client
A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be r…
-
Medium 5.1
Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds
An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated pa…
-
Medium 5.1
BSON element injection via NUL-embedded document keys in builder append
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the libra…
-
Medium 6.5
Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path
Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an applicat…
-
Medium 6.2
Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can c…
-
Medium 4.7
Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk
A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing c…
-
Medium 5.3
Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash…
-
Medium 4.7
Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a la…
-
Medium 6.5
FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_in…
-
Medium 5.4
FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444
FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX_AVC444_BITMAP_STREAM with specific frame geometry to trigger an o…
-
Medium 5.6CVE-2026-84380 Public exploit
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setd…
-
Medium 5.3
HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-element (filename, conten…
-
Medium 5.9
HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text in _SSELineDecoder.decode() when an attacker-controlled or compromised S…
-
Medium 5.4
libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL…