Ecosystem
Debian
61,983 known vulnerabilities.
Most affected packages
61,931 results · Feed
-
High 7.1
Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, h…
-
Critical 9.1
Apache MINA SSHD: Asynchronous authentication can bypass signature verification
Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of th…
-
High 8.1
Apache MINA SSHD: Repeated-publickey policy bypass on server
Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config Authe…
-
Critical 9.1
Apache MINA SSHD: LDAP injection in sshd-ldap
Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support fo…
-
Medium 6.5
Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server
Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a …
-
Medium 6.5
Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read
Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementa…
-
High 7.5
Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies
Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provid…
-
Medium 6.5
Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension
Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very s…
-
Critical 9.1
Apache MINA SSHD: LDAP password authentication ineffective
A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-…
-
High 7.3
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attac…
-
Medium 4.3
Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster …
-
High 7.5
A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abno…
-
High 7.5
A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause a…
-
Medium 6.5
An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal p…
-
Medium 6.5
An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to by…
-
High 8.8
An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal …
-
High 7.6
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of…
-
Medium 6.5
Nothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow
A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the library stb_image_write.h of the component Image Encoding. Executing a manipulation can lead to integer overflow. …
-
Medium 6.5
Nothings stb stb_hexwave.h hexwave_init integer overflow
A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the library stb_hexwave.h. Performing a manipulation of the argument width/oversample results in integer overflow…
-
Low 3.3
Freedesktop Poppler SplashClip.cc clipToPath integer overflow
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The …
-
High 7.1
U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6
U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during n…
-
High 8.2
U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrup…
-
High 8.2
U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass len…
-
Medium 5.2
U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation
U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablks_count value …
-
Medium 5.9
U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder
U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash t…
-
High 8.2
U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly
U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netb…
-
Medium 5.8
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the…
-
High 7.3
virtualenv: Command injection via --prompt in activate.bat (batch activator)
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUA…
-
High 7.2
Barman snapshot backup deletion trusts unverified backup catalog metadata
Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman re…
-
High 7.7
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative diges…
-
High 7.8
virtualenv bash and fish activation scripts execute commands embedded in paths
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh scri…
-
Medium 5.4
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which val…
-
Low 3.3
Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow
A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit h…
-
High 7.5CVE-2026-102253 Public exploit
iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter messa…
-
High 7.8
VLC media player before 3.0.24 Path Traversal via skins2
VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VL…
-
High 7.5
Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who …
-
Medium 5.4
UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI …
-
Medium 6.5
Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had comp…
-
Medium 5.4
UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements…
-
Low 3.4
Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker who had…