Ecosystem
Ubuntu
61,840 known vulnerabilities.
Most affected packages
61,409 results · Feed
-
High 7.5
gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the rep…
-
Medium 6.5
gitoxide gix-packetline before 0.21.5 Denial of Service
gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index o…
-
Low 3.1
gitoxide before 0.38.2 Credential Helper Protocol Field Injection
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return crede…
-
Medium 5.3
gitoxide before 0.33.0 Path Traversal via symlink following
gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink during non-exclusive (incremental) materialization (destination_is_initially_empty: f…
-
High 7.5
gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing
gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity…
-
Medium 6.5
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its…
-
High 7.4
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response…
-
Medium 6.5
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression s…
-
Low 3.1
Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the acc…
-
Medium 4.3
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process…
-
Low 3.1
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the conf…
-
Medium 4.3
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to …
-
High 7.5
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which…
-
Medium 4.3
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentic…
-
Critical 9.1
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free…
-
Medium 5.9
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more th…
-
Low 3.1
None None None No publicly available exploits are known.
-
Low 3.7
When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes…
-
Medium 5.9
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin …
-
High 7.4
None None None No publicly available exploits are known.
-
Medium 6.5
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal h…
-
Medium 4.3
An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid command…
-
Medium 6.5
An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disp…
-
Medium 4.3
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an…
-
Medium 4.3
An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial o…
-
Medium 4.8
Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator…
-
High 7.5
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authent…
-
Medium 5.9
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a …
-
Medium 4.3
When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused …
-
High 7.5
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email address…
-
Medium 5.4
Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor
A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to …
-
High 8.8CVE-2026-80724 Public exploit
ptp: vmclock: prevent read-only mappings from becoming writable
In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Usersp…
-
High 8.4
of: reserved_mem: prevent OOB when too many dynamic regions are defined
In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dynamic regions are defined On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_…
-
High 8.8
wifi: mac80211: validate individual TWT params before driver setup
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it. An individual …
-
High 8.8
Bluetooth: ISO: ensure no dangling hcon references in iso_conn
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso_conn After iso_conn_del(), ISO sockets should not dereference the hcon any more. Currently, clearing iso_conn::hcon relies on iso_con…
-
Unscored —
mm: mglru: fix stale batch updates after memcg reparenting
In the Linux kernel, the following vulnerability has been resolved: mm: mglru: fix stale batch updates after memcg reparenting The mglru page table walker batches per-generation size deltas in walk->nr_pages while walking page tables without holding the lruve…
-
High 7.5
iomap: add a separate bio_set for iomap_split_ioend
In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bio_set for iomap_split_ioend iomap_split_ioend can split bios that already come from iomap_ioend_bioset and thus deadlock when the bioset is exhausted. Add a separate b…
-
High 7.8
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
In the Linux kernel, the following vulnerability has been resolved: mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() In pcpu_create_chunk(), nr_pages is the total contiguous backing allocation, i.e., nr_units * pcpu_unit_pages, but pcpu…
-
High 7.8
ALSA: pcm: wake linked drain waiters on unlink
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink snd_pcm_drain() on a linked stream parks an on-stack wait entry on the drained peer's runtime->sleep, and after schedule_timeout() removes it on…
-
High 7.5
sctp: validate Adaptation Indication parameter length
In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctp_verify_…