Ecosystem
Ubuntu
61,840 known vulnerabilities.
Most affected packages
2,808 results · Clear filters · Feed
-
Critical 9.8CVE-2026-105016 Public exploit
Microsoft QUIC Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
-
Critical 9.4
ASP.NET Core Tampering Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
-
Critical 9.1
ASP.NET Core Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
-
Critical 10.0
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation res…
-
Critical 9.8
x86/AMD: ineffectual Zenbleed workaround
The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice v…
-
Critical 9.8
Mitigation bypass in the DOM: Core & HTML component
Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
Critical 9.8
Invalid pointer, undefined behavior in the DOM: Notifications component
Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
Critical 9.1
Same-origin policy bypass in the DevTools component
Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
Critical 9.6
Sandbox escape in the DOM: Content Processes component
Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
Critical 9.6
Site isolation issue in the DOM: Web Authentication component
Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
Critical 9.6
Sandbox escape due to uninitialized memory in the DOM: Web Serial component
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
Critical 9.6
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
Critical 9.6
Sandbox escape due to use-after-free in the Networking component
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
-
Critical 9.6
Sandbox escape due to incorrect boundary conditions in the Networking component
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
-
Critical 9.6
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
-
Critical 10.0
Integer Overflow or Wraparound in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…
KEV Oct 29, 2026 -
Critical 9.4
Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication
The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped t…
-
Critical 9.1
Insufficient Session Revocation for JWT Authentication
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approx…
-
Critical 9.1
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ arguments is not…
-
Critical 9.3
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbi…
-
Critical 9.1
Double flow control refund on HTTP/2 server streams in net/http
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client…
-
Critical 9.8
Root.Mkdir(All) can follow junctions out of the root on Windows in os
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the la…
-
Critical 9.4
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related p…
-
Critical 9.3CVE-2026-92414 Public exploit
Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issu…
-
Critical 9.8
Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLit…
-
Critical 9.2CVE-2026-106445 Public exploit
Handlebars: JavaScript Injection via Own Property Check Bypass
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of F…
-
Critical 9.8
Mitigation bypass in the File Handling component
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.
-
Critical 9.8
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithm…
-
Critical 9.8
RDMA/siw: Bound fragmented header copies by the remaining length
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most …
-
Critical 9.1
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveN…
-
Critical 9.1
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of …
-
Critical 9.2
MLS X.509 credential not bound to the LeafNode signature key
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itsel…
-
Critical 9.3
Apache Traffic Server: SNI to Host header matching policy is not properly enforced
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supe…
-
Critical 9.2
Apache Thrift: C++ THttpTransport grows its line buffer without bound
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes t…
-
Critical 9.2
Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits…
-
Critical 9.8
Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some poten…
-
Critical 9.0
389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose r…
-
Critical 9.8
CVE-2026-104056
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than …
-
Critical 9.8
Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function
Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
Critical 9.8
Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.