Ecosystem
Ubuntu
61,691 known vulnerabilities.
Most affected packages
61,260 results · Feed
-
High 8.8
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authori…
-
High 8.2
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Au…
-
High 8.2
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to cont…
-
Medium 6.9
In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as…
-
High 7.5
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, s…
-
High 8.6
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQ…
-
Critical 9.5
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensi…
-
Low 2.8
ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds
A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_model_load of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-bounds read. The attack…
-
High 7.5
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attack…
-
High 7.5
A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of tren…
-
Medium 5.0CVE-2026-78850 Public exploit
An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / Site…
-
Medium 5.9
Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines wit…
-
Medium 6.5
Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens o…
-
Medium 5.3
Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comme…
-
High 7.5
Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SM…
-
Medium 6.1
GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vend…
-
High 7.5
GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --path…
-
High 8.1
GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to e…
-
High 7.5
GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when g…
-
High 7.5
GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing lon…
-
Medium 6.5
GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name
GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft …
-
High 7.1
FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP …
-
High 7.5
FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm…
-
High 7.1
FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can…
-
Medium 6.5
FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a …
-
Medium 4.0
FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token
FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host header. A remote unaut…
-
Medium 6.5
FreeRDP 2.0.0 before 3.32.0 Denial of Service via Serial IRP Null Handle
FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP_MJ_READ or IRP_MJ_WRITE before create or after close, causing…
-
Medium 5.9
FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap st…
-
Medium 6.5
FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA_FIRST
FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATA_FIRST message on an opened D…
-
Medium 4.3
FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE
FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious…
-
Medium 5.9
FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client a…
-
Medium 6.5
FreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client…
-
Medium 5.3
qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string
### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toString": "x" }`) or a null-pr…
-
Medium 6.3
Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write
A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The …
-
High 7.3
OpenSIPS rtpproxy rtpproxy_answer out-of-bounds
A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to versio…
-
High 8.8
Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)
Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV…
-
High 7.5
Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a …
-
High 7.5
Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_d…
-
High 7.5
Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentT…
-
Medium 4.2
LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authent…