Ecosystem
Ubuntu
61,840 known vulnerabilities.
Most affected packages
linux-raspi2 20,485
linux-hwe 20,446
linux-azure 20,415
linux-riscv 20,411
linux-gcp 20,386
linux-gke 20,179
linux-hwe-edge 20,121
linux-oem 20,070
linux-azure-fde 19,897
linux-realtime 19,866
linux-raspi-realtime 19,864
linux-intel-iot-realtime 19,858
linux-azure-edge 19,855
linux-gke-4.15 19,853
linux-aws-5.0 19,793
linux-oracle-5.0 19,790
linux-gcp-5.3 19,760
linux-azure-5.3 19,750
linux-oracle-5.3 19,680
linux-aws-5.3 19,674
linux-oem-5.6 19,576
linux-hwe-5.8 19,520
linux-riscv-5.8 19,516
linux-oem-5.10 19,462
linux-aws-5.8 19,454
linux-gcp-5.8 19,453
linux-oracle-5.8 19,453
linux-gke-5.4 19,441
linux-gkeop-5.4 19,441
linux-azure-5.8 19,441
linux-hwe-5.11 19,413
linux-azure-5.11 19,392
linux-gcp-5.11 19,392
linux-oracle-5.11 19,392
linux-aws-5.11 19,391
linux-riscv-5.11 19,386
linux-intel-5.13 19,365
linux-oem-5.13 19,351
linux-hwe-5.13 19,324
linux-azure-5.13 19,306
12,735 results · Clear filters · Feed
-
Medium 6.5
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have …
-
Medium 6.5
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. Th…
-
Medium 4.3
The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This…
-
Medium 6.5
The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instruction…
-
Medium 6.1
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could…
-
Medium 6.1
Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affe…
-
Medium 5.3
When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerabilit…
-
Medium 4.3
When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of pre…
-
Medium 6.1
When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus l…
-
Medium 5.5
When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to un…
-
Medium 6.5
When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resultin…
-
Medium 4.3
If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulner…
-
Medium 6.5
An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so b…
-
Medium 6.5
An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the…
-
Medium 6.5
Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. T…
-
Medium 4.3
When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to…
-
Medium 5.5
An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnera…
-
Medium 6.5
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an ema…
-
Medium 6.5
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*:…
-
Medium 4.3
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential use…
-
Medium 6.5
When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the S…
-
Medium 6.5
If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server t…
-
Medium 6.5
Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen withou…
-
Medium 6.5
Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for…
-
Medium 6.5
Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seei…
-
Medium 6.5
Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free …
-
Medium 4.3
Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers be…
-
Medium 6.5
Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timin…
-
Medium 6.5
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of …
-
Medium 6.1
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the bro…
-
Medium 6.1
Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause…
-
Medium 6.1
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access…
-
Medium 6.5
During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that lea…
-
Medium 6.5
Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a…
-
Medium 6.5
By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context …
-
Medium 6.1
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected ele…
-
Medium 5.9
pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
-
Medium 6.5
Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<…
-
Medium 6.5
If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may …
-
Medium 6.5
Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to conne…