Ecosystem
Ubuntu
61,421 known vulnerabilities.
Most affected packages
linux-raspi2 20,483
linux-hwe 20,444
linux-azure 20,413
linux-riscv 20,409
linux-gcp 20,384
linux-gke 20,177
linux-hwe-edge 20,119
linux-oem 20,068
linux-azure-fde 19,895
linux-realtime 19,864
linux-raspi-realtime 19,862
linux-intel-iot-realtime 19,856
linux-azure-edge 19,853
linux-gke-4.15 19,851
linux-aws-5.0 19,791
linux-oracle-5.0 19,788
linux-gcp-5.3 19,758
linux-azure-5.3 19,748
linux-oracle-5.3 19,678
linux-aws-5.3 19,672
linux-oem-5.6 19,574
linux-hwe-5.8 19,518
linux-riscv-5.8 19,514
linux-oem-5.10 19,460
linux-aws-5.8 19,452
linux-gcp-5.8 19,451
linux-oracle-5.8 19,451
linux-gke-5.4 19,439
linux-gkeop-5.4 19,439
linux-azure-5.8 19,439
linux-hwe-5.11 19,411
linux-azure-5.11 19,390
linux-gcp-5.11 19,390
linux-oracle-5.11 19,390
linux-aws-5.11 19,389
linux-riscv-5.11 19,384
linux-intel-5.13 19,363
linux-oem-5.13 19,349
linux-hwe-5.13 19,322
linux-azure-5.13 19,304
2,752 results · Clear filters · Feed
-
Unscored —
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to …
-
Unscored —CVE-2014-0476 Public exploit
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute …
-
Unscored —
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct…
-
Unscored —
Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and be…
-
Low 3.4
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which ma…
-
High 8.8
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, wh…
KEV Oct 2, 2025 -
Unscored —
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial …
-
Unscored —
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers …
-
Unscored —CVE-2014-3631 Public exploit
The assoc_array_gc function in the associative-array implementation in lib/assoc_array.c in the Linux kernel before 3.1…
-
Unscored —
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, wh…
-
Critical 9.8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values o…
KEV Jan 28, 2022 -
Critical 9.8
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, whic…
KEV Jan 28, 2022 -
Unscored —
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and O…
-
Unscored —CVE-2014-1564 Public exploit
Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize …
-
Unscored —
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dep…
-
Unscored —
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, do…
-
Unscored —CVE-2014-5207 Public exploit
fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NO…
-
Unscored —
Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 bef…
-
Unscored —
The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a de…
-
Unscored —CVE-2014-5116 Public exploit
The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent atta…
-
Unscored —
Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 route…
-
Unscored —
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a deni…
-
Unscored —CVE-2014-4943 Public exploit
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by…
-
Unscored —CVE-2014-2477 Public exploit
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.…
-
Unscored —CVE-2014-4699 Public exploit
The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the save…
-
Medium —
Rosetta-Flash JSONP Vulnerability in hapi
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restr…
-
Unscored —CVE-2014-1739 Public exploit
The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not init…
-
Unscored —CVE-2014-4014 Public exploit
The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inappl…
-
Medium —CVE-2014-3004 Public exploit
Improper Restriction of XML External Entity Reference in Castor
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
-
High 7.8
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two dif…
KEV May 25, 2022 -
Unscored —
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCip…
-
Unscored —
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1…
-
Unscored —
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.…
-
Unscored —
Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.1…
-
Medium —
Integer Overflow or Wraparound in Apache Tomcat
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumpti…
-
Unscored —CVE-2014-3865 Public exploit
Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files ou…
-
Unscored —
Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Res…
-
Medium 6.1CVE-2014-3146 Public exploit
lxml Cross-site Scripting Via Control Characters
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
-
Medium —CVE-2014-3225 Public exploit
Cobbler Path Traversal vulnerability
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.
-
Medium 5.5
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver …
KEV May 12, 2023