Ecosystem
Debian
61,921 known vulnerabilities.
Most affected packages
61,870 results · Feed
-
Low 3.6
Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_transla…
-
Medium 6.5
Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup
A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.
-
Medium 6.4
Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between …
-
Low 2.5
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary…
-
High 7.0
util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privil…
-
Low 2.5
Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_l…
-
High 8.2
Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet …
-
Medium 5.1
Angular DevTools (Local DoS)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages fr…
-
Medium 5.3
Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename
Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. Attackers can supply filenames with path separato…
-
Medium 5.5
unshield through 1.6.2 Heap Out-of-Bounds Read via unshield_get_file_table
unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-ran…
-
Medium 6.1
MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort
MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and c…
-
Medium 6.5
libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow
libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an …
-
Medium 6.5
libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigne…
-
Medium 6.5
libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on un…
-
Medium 5.3
Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse
Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-T…
-
Low 3.1
miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network…
-
Low 3.1
miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving d…
-
Medium 6.1
libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs
libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vb…
-
High 8.7
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop…
-
High 7.0CVE-2026-53613 Public exploit
util-linux mount target TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before…
-
High 7.0
util-linux mount hook_owner TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount …
-
Medium 6.5
NGINX ngx_http_js_module vulnerability
Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Nam…
-
Medium 5.3
NGINX ngx_http_js_module vulnerability
Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthen…
-
Medium 5.3
NGINX ngx_http_v3_module vulnerability
Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnera…
-
High 8.1
NGINX map directive and regex matching vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same re…
-
High 8.1CVE-2026-97205 Public exploit
NGINX ngx_http_core_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a U…
-
High 8.1CVE-2026-15176 Public exploit
NGINX ngx_http_core_module vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achi…
-
Medium 6.5CVE-2026-97629 Public exploit
NGINX ngx_http_ssl_module vulnerability
Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to for…
-
High 7.2
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.…
-
High 7.8
xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote …
-
Low 3.3
LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader
LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC10…
-
Medium 6.3
LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header
LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count tha…
-
Low 3.6
Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, cor…
-
Medium 6.3
libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path
libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to …
-
Medium 6.3
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a sm…
-
Medium 6.1
Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory
Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part…
-
Medium 6.1
Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value
Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT…
-
Medium 5.5
quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search
quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective t…
-
Medium 5.5
OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier o…
-
Medium 5.5
OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(…