Ecosystem
Debian
61,920 known vulnerabilities.
Most affected packages
11,608 results · Clear filters · Feed
-
Medium 5.9
Jwcrypto: jwcrypto: denial of service via malformed jwe tokens
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a Memory…
-
Medium 4.9
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the…
-
Medium 4.7
Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode…
-
Medium 5.4
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input…
-
Medium 4.4
Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to l…
-
Medium 6.5
Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that pas…
-
Medium 6.1
Spring Framework Cross-site Scripting via EscapedErrors
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScrip…
-
Medium 4.3
Spring Framework Path Traversal via Backslash in SpringTemplateLoader
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring…
-
Medium 5.3
NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads…
-
Medium 4.0
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length…
-
Medium 6.1
Spring Framework Open Redirect in UrlFileNameViewController
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6…
-
Medium 6.5
A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gd…
-
Medium 6.5
An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a …
-
Medium 5.5
Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings
A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password …
-
Medium 6.5
Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allo…
-
Medium 6.5
Nagios Core CSRF via cmd.cgi
Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Na…
-
Medium 5.5
Gimp: stack vla size underflow denial of service in seattle
A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue le…
-
Medium 5.9
NLTK 3.10.2 Regular Expression Denial of Service via tgrep
NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against …
-
Medium 6.9
Remote TCP DoS by throttling the TCP receive window
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
-
Medium 6.3
Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token withou…
-
Medium 4.2
Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes
Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the ser…
-
Medium 6.8
Apache Tomcat: Authenticated WebSocket session survives end of HTTP session
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not …
-
Medium 5.7
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash blu…
-
Medium 4.4
Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation
A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated …
-
Medium 5.3CVE-2026-77680 Public exploit
Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7…
-
Medium 6.5
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cycli…
-
Medium 6.5
Improper input validation in Network in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker le…
-
Medium 5.9
Incorrect provision of specified functionality in Proxy in Google Chrome on on Windows prior to 152.0.7977.65 allowed a…
-
Medium 4.3
Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote att…
-
Medium 6.5
Improper input validation in Cookies in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromi…
-
Medium 6.5
Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read me…
-
Medium 6.5
Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak se…
-
Medium 6.5
Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive …
-
Medium 5.5
Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensiti…
-
Medium 6.5
Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to potentially ob…
-
Medium 6.5
Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access …
-
Medium 6.5
Missing authorization in InterestGroups in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compr…
-
Medium 6.5
Information leak in Passwords in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sens…
-
Medium 4.3
Improper input validation in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypa…
-
Medium 4.3
Incorrect authorization in Browser in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leve…