Ecosystem
Ubuntu
61,691 known vulnerabilities.
Most affected packages
12,665 results · Clear filters · Feed
-
Medium 6.0
BuildKit improperly handles special files in build snapshots
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
-
Medium 5.7
A malicious frontend can cause a daemon panic
A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.
-
Medium 5.9
Container blob cache can accept unverified content
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-inp…
-
Medium 4.7
django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class lead…
-
Medium 6.7
Environment/ini-file leaks
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every …
-
Medium 6.7
LFI and GET SSRF via GStreamer and HLS playlists
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their cont…
-
Medium 6.7
LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed…
-
Medium 6.7
LFI and GET SSRF via calcext:data-mappings and csv provider
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the d…
-
Medium 6.8
Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an e…
-
Medium 5.6
Stored XSS vulnerability in OAuth configuration form
The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arb…
-
Medium 5.3
SNMP trap injection in zabbix_trap_receiver.pl
The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.
-
Medium 6.9
Active agent heartbeat missing TLS check
Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, result…
-
Medium 5.1
Hidden host credentials inferable via multiselect.get filtering
Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it.
-
Medium 6.9
JavaScript preprocessing memory disclosure
The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.
-
Medium 4.7
Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of t…
-
Medium 5.4
Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names
Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing …
-
Medium 5.9
HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler…
-
Medium 6.9
CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys
In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true), never ran for a message using RFC 9709 content-encryption key derivation (id-al…
-
Medium 5.3
Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider
In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictat…
-
Medium 5.3
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_ite…
-
Medium 4.3
Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data vi…
-
Medium 5.9
uv: Path traversal on Windows through wheel extraction
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already pre…
-
Medium 6.3
Logback: Incomplete protection against CVE-2026-19880
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who in…
-
Medium 6.9
Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize
Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.…
-
Medium 6.9
Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
Medium 6.3
Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back
Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
Medium 6.3
Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`
Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
Medium 6.3
Apache Thrift: C++ WebSocket server transport does not read a full request length
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
Medium 6.3
Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0 and re-generate JS co…
-
Medium 6.9
Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match
Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compa…
-
Medium 6.9
Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op
Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
Medium 6.9
Apache Thrift: Perl TLS client disables certificate verification by default
Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
Medium 6.3
Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
Medium 6.4
Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation…
-
Medium 5.5
Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader
A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeate…
-
Medium 5.3
Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points
In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before…
-
Medium 4.0
geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point
geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character in…
-
Medium 5.3
Apache HTTP Server: mod_userdir information disclosure
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue af…
-
Medium 5.3
Apache HTTP Server: mod_dav_fs property database read access
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DA…
-
Medium 4.3
Apache HTTP Server: mod_dav shared lock overflow
A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue