Ecosystem
Ubuntu
61,840 known vulnerabilities.
Most affected packages
61,409 results · Feed
-
High 7.3
OpenZFS: user-namespace capability check allows unprivileged local authorization bypass
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected…
-
High 7.8
Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project files
A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, bus_load() reads the number of bus handles from the file attribute "bus_handles" using attri…
-
Medium 5.9
NLTK 3.10.2 Regular Expression Denial of Service via tgrep
NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against …
-
High 7.5
NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex
NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patt…
-
High 8.2
OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite
The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.
-
Critical 9.8
OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings
The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account take…
-
Critical 9.1
Arbitrary file overwrite and deletion local and remote in OpenRGB
Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.
-
Medium 6.3
Broken access control in dashboard snapshots
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).
-
High 8.2
Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.
-
High 8.2
Remote UDP DoS by sending multiple DNS Cookie options
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remo…
-
Medium 6.9
Remote TCP DoS by throttling the TCP receive window
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
-
High 8.2
Wrong interpretation of ACL ranges
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access cou…
-
High 7.0
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 a…
-
Critical 9.8
Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, pas…
-
High 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows…
-
Critical 9.8
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_…
-
Critical 9.8
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support …
-
Critical 9.8
The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechani…
-
Medium 6.5
libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid index…
-
Medium 6.1CVE-2026-39275 Public exploit
Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary cod…
-
High 7.5
Stomper 5e2741e is vulnerable to Denial of Service. When a broker sends data to a client whose TCP connection was alrea…
-
Critical 9.8
Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection…
-
High 7.5
Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same…
-
High 7.5
stomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP c…
-
High 7.5
In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null po…
-
Medium 6.3
Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token withou…
-
Medium 4.2
Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes
Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the ser…
-
Medium 6.8
Apache Tomcat: Authenticated WebSocket session survives end of HTTP session
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not …
-
High 7.5
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through…
-
High 8.1
Apache Tomcat: Principal lookup can fail open in some cases
Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 throu…
-
High 7.6
Bluez: stack overflow in name2utf8 causes dos and potential code execution
A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target devic…
-
Medium 5.7
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash blu…
-
Critical 9.1
Apache Tomcat: Redirect after FORM auth may bypass method specific constraints
Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, fr…
-
High 8.1
Apache Tomcat: Servlet role references can bypass declarative role constraints
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-…
-
High 7.5
Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 t…
-
Critical 9.8
Apache Tomcat: Limited replay attack possible with DIGEST authentication
Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that …
-
Critical 9.8
Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to …
-
High 8.1
Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.…
-
Critical 9.1
Apache Tomcat: Bypass longest prefix security constraint
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: f…
-
High 7.6
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, app…