Ecosystem
Wolfi
8,498 known vulnerabilities.
Most affected packages
14 results · Clear filters · Feed
-
Critical 9.2
Out-of-Bounds Write in Google Brotli Decoder
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …
KEV Oct 27, 2026 -
Critical 9.2
RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…
KEV Oct 26, 2026 -
Critical 9.2
RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…
KEV Oct 26, 2026 -
Critical 10.0
Integer Overflow or Wraparound in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…
KEV Oct 29, 2026 -
Critical 10.0
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitra…
KEV Sep 11, 2026 -
Critical 9.8
Gitea: Remote Code Execution via diffpatch Git Hook Installation
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
KEV Aug 25, 2026 -
Critical 9.3
LiteLLM: SQL injection in Proxy API key verification
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing i…
KEV May 8, 2026 -
Critical 9.4
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-ba…
KEV Aug 17, 2026 -
Critical 9.3
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directo…
KEV Sep 29, 2025 -
Critical 10.0
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 t…
KEV Apr 1, 2025 -
Critical 9.8
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timel…
KEV Oct 15, 2024 -
Critical 9.8
Argument Injection in PHP-CGI
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32…
KEV Jun 12, 2024 -
Critical 9.6
Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside…
KEV May 20, 2024 -
Critical 9.6CVE-2024-4671 Exploited
Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the re…
KEV May 13, 2024