Ecosystem
Ubuntu
61,451 known vulnerabilities.
Most affected packages
linux-raspi2 20,483
linux-hwe 20,444
linux-azure 20,413
linux-riscv 20,409
linux-gcp 20,384
linux-gke 20,177
linux-hwe-edge 20,119
linux-oem 20,068
linux-azure-fde 19,895
linux-realtime 19,864
linux-raspi-realtime 19,862
linux-intel-iot-realtime 19,856
linux-azure-edge 19,853
linux-gke-4.15 19,851
linux-aws-5.0 19,791
linux-oracle-5.0 19,788
linux-gcp-5.3 19,758
linux-azure-5.3 19,748
linux-oracle-5.3 19,678
linux-aws-5.3 19,672
linux-oem-5.6 19,574
linux-hwe-5.8 19,518
linux-riscv-5.8 19,514
linux-oem-5.10 19,460
linux-aws-5.8 19,452
linux-gcp-5.8 19,451
linux-oracle-5.8 19,451
linux-gke-5.4 19,439
linux-gkeop-5.4 19,439
linux-azure-5.8 19,439
linux-hwe-5.11 19,411
linux-azure-5.11 19,390
linux-gcp-5.11 19,390
linux-oracle-5.11 19,390
linux-aws-5.11 19,389
linux-riscv-5.11 19,384
linux-intel-5.13 19,363
linux-oem-5.13 19,349
linux-hwe-5.13 19,322
linux-azure-5.13 19,304
248 results · Clear filters · Feed
-
High 7.8
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb…
KEV Sep 9, 2024 -
High 8.1
Unrestricted Upload of File with Dangerous Type Apache Tomcat
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP fil…
KEV Mar 25, 2022 -
Critical 9.8
Code Injection in PHPUnit
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., ex…
KEV Feb 15, 2022 -
Critical 9.8
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, all…
KEV Mar 30, 2023 -
High 7.8
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion…
KEV May 24, 2022 -
High 8.8
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0…
KEV Jun 8, 2022 -
Critical 9.8
Apache Tomcat Improper Access Control vulnerability
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this lis…
KEV May 12, 2023 -
High 8.8
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac…
KEV Jun 8, 2022 -
Critical 9.8
Remote code execution in PHPMailer
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
KEV Jul 7, 2025 -
High 7.0
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by le…
KEV Mar 3, 2022 -
High 8.8
Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Lin…
KEV Mar 3, 2022 -
High 8.8
WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory…
KEV May 24, 2022 -
High 7.8
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary cod…
KEV Mar 25, 2022 -
Critical 9.8
Improper Access Control in Apache Shiro
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
KEV Nov 3, 2021 -
Critical 9.8
Improper Input Validation in Apache ActiveMQ
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
KEV Feb 10, 2022 -
High 7.8
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as…
KEV Mar 3, 2022 -
Medium 5.5
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary f…
KEV Nov 3, 2021 -
High 8.4
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6…
KEV Sep 9, 2024 -
Medium 5.5
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct…
KEV Nov 3, 2021 -
Critical 9.8
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows re…
KEV May 12, 2023 -
High 7.8
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or p…
KEV Mar 3, 2022 -
High 8.8
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, d…
KEV Jun 8, 2022 -
High 8.8
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X an…
KEV May 25, 2022 -
High 8.8
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and…
KEV May 25, 2022 -
High 8.8
Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and be…
KEV May 25, 2022 -
Critical 9.8
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers…
KEV Nov 3, 2021 -
High 7.8
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.53…
KEV Mar 3, 2022 -
High 7.4
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly mo…
KEV Aug 26, 2026 -
High 8.8
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remot…
KEV May 25, 2022 -
High 7.5
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service …
KEV Oct 8, 2026 -
Critical 9.8
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote atta…
KEV Mar 3, 2022 -
High 7.8
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Playe…
KEV Apr 13, 2022 -
High 7.8
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 1…
KEV Apr 13, 2022 -
High 7.8
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13…
KEV Mar 3, 2022 -
High 7.8
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows a…
KEV Apr 13, 2022 -
Critical 10.0
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and…
KEV Oct 8, 2026 -
High 7.8
Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.45…
KEV Mar 3, 2022 -
High 7.8
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows…
KEV Apr 13, 2022 -
High 7.8
Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.43…
KEV May 25, 2022 -
High 7.8
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windo…
KEV Apr 13, 2022