Ecosystem
Wolfi
8,518 known vulnerabilities.
Most affected packages
3,542 results · Clear filters · Feed
-
High 7.1
nodemailer before 9.0.1 File Read and SSRF via raw option
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers ca…
-
High 7.5
MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credential…
-
High 7.5
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, K…
-
High 7.1
NLTK before 3.10.3 Hardlink File Overwrite via downloader
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with …
-
High 7.0
NLTK through 3.10.3 Path Traversal via Model-Artifact APIs
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParse…
-
High 7.5
nltk PorterStemmer before 3.10.3 Quadratic-time DoS
nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _m…
-
High 7.5
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource…
-
High 8.9
amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory c…
-
High 8.8
Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside th…
-
High 8.8
Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to…
-
High 8.8
Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to…
-
High 8.8
Use after free in PDF in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code insid…
-
High 8.8
Integer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arb…
-
High 8.1
Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary cod…
-
High 8.8CVE-2026-79266 Public exploit
Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineer…
-
High 8.8
Improper state validation in Parser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially ex…
-
High 8.8
Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially exe…
-
High 8.8
Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially exe…
-
High 8.8
Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside…
-
High 8.8
Type confusion in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineer…
-
High 8.8
Insufficient control flow management in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leve…
-
High 7.5
Race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside…
-
High 8.1
Use after free in Chromoting in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute a…
-
High 8.8
Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to poten…
-
High 7.7
Use after free in UI in Google Chrome prior to 152.0.7977.65 allowed a local attacker who had compromised the renderer …
-
High 7.5
Improper enforcement of behavioral workflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker …
-
High 8.3
Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the rende…
-
High 8.8
Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineer…
-
High 8.3
Improper input validation in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who ha…
-
High 8.8
Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary cod…
-
High 8.8
Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitr…
-
High 8.1
Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory…
-
High 7.5
Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitr…
-
High 8.3
Improper input validation in Input in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who …
-
High 8.8
Integer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbi…
-
High 8.8
Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacke…
-
High 8.1
Race condition in Start in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging socia…
-
High 8.8
Buffer overflow in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code insid…