Ecosystem
Ubuntu
61,418 known vulnerabilities.
Most affected packages
linux-raspi2 20,483
linux-hwe 20,444
linux-azure 20,413
linux-riscv 20,409
linux-gcp 20,384
linux-gke 20,177
linux-hwe-edge 20,119
linux-oem 20,068
linux-azure-fde 19,895
linux-realtime 19,864
linux-raspi-realtime 19,862
linux-intel-iot-realtime 19,856
linux-azure-edge 19,853
linux-gke-4.15 19,851
linux-aws-5.0 19,791
linux-oracle-5.0 19,788
linux-gcp-5.3 19,758
linux-azure-5.3 19,748
linux-oracle-5.3 19,678
linux-aws-5.3 19,672
linux-oem-5.6 19,574
linux-hwe-5.8 19,518
linux-riscv-5.8 19,514
linux-oem-5.10 19,460
linux-aws-5.8 19,452
linux-gcp-5.8 19,451
linux-oracle-5.8 19,451
linux-gke-5.4 19,439
linux-gkeop-5.4 19,439
linux-azure-5.8 19,439
linux-hwe-5.11 19,411
linux-azure-5.11 19,390
linux-gcp-5.11 19,390
linux-oracle-5.11 19,390
linux-aws-5.11 19,389
linux-riscv-5.11 19,384
linux-intel-5.13 19,363
linux-oem-5.13 19,349
linux-hwe-5.13 19,322
linux-azure-5.13 19,304
2,752 results · Clear filters · Feed
-
Unscored —
The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a f…
-
Medium 5.9
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static…
-
Unscored —CVE-2017-5180 Public exploit
Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt…
-
Unscored —CVE-2016-10191 Public exploit
Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, an…
-
Unscored —CVE-2016-10190 Public exploit
Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3…
-
Unscored —CVE-2017-0411 Public exploit
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arb…
-
Unscored —CVE-2017-0412 Public exploit
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arb…
-
Unscored —
Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code vi…
-
High 7.5
PEAR core file overwrite vulnerability
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
-
Unscored —CVE-2016-2399 Public exploit
Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cau…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported vers…
-
High 7.5CVE-2016-4793 Public exploit
CakePHP allows remote attackers to spoof their IP
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
-
Unscored —
The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through …
-
Unscored —
The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x be…
-
Unscored —CVE-2016-6271 Public exploit
The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows man-in-the-middle attackers to conduct spoofing attacks by l…
-
Unscored —
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPr…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions…
-
Unscored —CVE-2016-7980 Public exploit
Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote …
-
Unscored —
Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to e…
-
Unscored —
The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PH…
-
Unscored —CVE-2016-2087 Public exploit
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary…
-
Unscored —
Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC serv…
-
Medium 5.5CVE-2017-5223 Public exploit
Local file disclosure in PHPMailer
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script…
-
Unscored —CVE-2017-5473 Public exploit
Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authenticat…
-
Unscored —
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a cra…
-
Unscored —CVE-2016-8467 Public exploit
An elevation of privilege vulnerability in the bootloader could enable a local attacker to execute arbitrary modem comm…
-
Unscored —CVE-2016-9813 Public exploit
The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of se…
-
Unscored —CVE-2016-10140 Public exploit
Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled w…
-
Unscored —
Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended …
-
Medium 4.8CVE-2016-4807 Public exploit
Web2py Reflected XSS vulnerability
Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).
-
Unscored —
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing the …
-
Unscored —
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when parsing Adobe T…
-
Unscored —
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability related to texture c…
-
Unscored —
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the p…
-
Unscored —
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript…
-
Unscored —
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurr…
-
High 7.3
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execut…
-
High 7.0CVE-2016-10010 Public exploit
sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which…
-
Critical 9.8
Remote code execution in PHPMailer
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping perf…
-
Critical 9.8
Remote code execution in PHPMailer
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
KEV Jul 7, 2025