Ecosystem
Ubuntu
61,418 known vulnerabilities.
Most affected packages
linux-raspi2 20,483
linux-hwe 20,444
linux-azure 20,413
linux-riscv 20,409
linux-gcp 20,384
linux-gke 20,177
linux-hwe-edge 20,119
linux-oem 20,068
linux-azure-fde 19,895
linux-realtime 19,864
linux-raspi-realtime 19,862
linux-intel-iot-realtime 19,856
linux-azure-edge 19,853
linux-gke-4.15 19,851
linux-aws-5.0 19,791
linux-oracle-5.0 19,788
linux-gcp-5.3 19,758
linux-azure-5.3 19,748
linux-oracle-5.3 19,678
linux-aws-5.3 19,672
linux-oem-5.6 19,574
linux-hwe-5.8 19,518
linux-riscv-5.8 19,514
linux-oem-5.10 19,460
linux-aws-5.8 19,452
linux-gcp-5.8 19,451
linux-oracle-5.8 19,451
linux-gke-5.4 19,439
linux-gkeop-5.4 19,439
linux-azure-5.8 19,439
linux-hwe-5.11 19,411
linux-azure-5.11 19,390
linux-gcp-5.11 19,390
linux-oracle-5.11 19,390
linux-aws-5.11 19,389
linux-riscv-5.11 19,384
linux-intel-5.13 19,363
linux-oem-5.13 19,349
linux-hwe-5.13 19,322
linux-azure-5.13 19,304
2,752 results · Clear filters · Feed
-
Medium 6.1CVE-2016-6186 Public exploit
Django Cross-site scripting Vulnerability
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject ar…
-
Unscored —
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitra…
-
Unscored —
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows…
-
Unscored —
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows…
-
Unscored —
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows…
-
Unscored —
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.63…
-
Unscored —
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.63…
-
Unscored —
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows…
-
Unscored —
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows…
-
Unscored —
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.63…
-
Unscored —
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows…
-
Unscored —
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.63…
-
Unscored —
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.63…
-
Unscored —
Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of s…
-
Unscored —CVE-2016-4997 Public exploit
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linu…
-
Unscored —CVE-2016-4998 Public exploit
The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local…
-
Unscored —
The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attack…
-
Critical 9.8
phpMyAdmin Code Injection vulnerability
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted strin…
-
Unscored —
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted …
-
Unscored —CVE-2016-1583 Public exploit
The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to g…
-
Unscored —
Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to e…
-
Unscored —CVE-2016-2494 Public exploit
Off-by-one error in sdcard/sdcard.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before…
-
Unscored —
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 all…
-
Critical 9.8
Improper Access Control in Apache Shiro
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
KEV Nov 3, 2021 -
Critical 9.8
Improper Input Validation in Apache ActiveMQ
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
KEV Feb 10, 2022 -
Unscored —CVE-2016-4486 Public exploit
The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certai…
-
Unscored —CVE-2016-4578 Public exploit
sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local u…
-
Unscored —
The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly ma…
-
Unscored —CVE-2016-4558 Public exploit
The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a den…
-
Unscored —CVE-2016-1838 Public exploit
The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before …
-
High 7.8CVE-2016-1834 Public exploit
Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X …
-
Unscored —CVE-2016-1839 Public exploit
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS bef…
-
Unscored —
Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20…
-
High 7.5CVE-2016-3627 Public exploit
The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-de…
-
Unscored —
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote…
-
Unscored —
The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var…
-
Unscored —CVE-2015-3152 Public exploit
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use th…
-
High 7.8
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as…
KEV Mar 3, 2022 -
Medium 5.5
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary f…
KEV Nov 3, 2021 -
Unscored —
The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via…