Ecosystem
Wolfi
8,518 known vulnerabilities.
Most affected packages
8,494 results · Feed
-
High 8.1
Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate t…
-
Critical 9.1
An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets …
-
High 7.3
Integer overflow in chunking helper causes dispatching to miss elements or panic
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic. Any SpiceDB cluster with any schema where a res…
-
High 8.8CVE-2024-1939 Public exploit
Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corr…
-
High 7.1
Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object co…
-
High 7.5
Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service
An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
-
Medium 5.8
Possible DoS Vulnerability with Range Header in Rack
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the …
-
Medium 5.3CVE-2024-25126 EPSS 35%
Rack ReDos in content type parsing (2nd degree polynomial)
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability i…
-
Medium 5.3
Possible Denial of Service Vulnerability in Rack Header Parsing
Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this …
-
High 7.8
Xorg-x11-server: heap buffer overflow in disabledevice
A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments.
-
High 7.8
Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent
A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which ma…
-
Medium 5.3
Apache James Mime4J: Mime4J DOM header injection
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
-
Medium 5.3
Showdownjs Denial of Service
An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.
-
High 7.5
orjson does not limit recursion for deeply nested JSON documents
orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.
-
Medium 6.5CVE-2024-25082 Public exploit
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
-
Medium 4.2CVE-2024-25081 Public exploit
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
-
Medium 5.3
sanitize-html Information Exposure vulnerability
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit t…
-
Medium 4.4
c-ares out of bounds read in ares__read_line()
c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file.…
-
High 7.5
Helm's Missing YAML Content Leads To Panic
Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an `index.yaml` file or a plugins `plugin.yaml` fi…
-
High 7.5
cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did n…
-
High 8.4
The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation d…
-
Critical 9.8CVE-2024-1676 EPSS 18%
Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof s…
-
Medium 6.3
Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass …
-
High 8.8CVE-2024-1675 EPSS 11%
Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass…
-
High 8.8
Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who had compromised t…
-
High 8.8
Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attack…
-
Medium 6.5
Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to byp…
-
High 8.8
Use after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap co…
-
Medium 6.5
Out of bounds memory access in Blink in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to perform out o…
-
Medium 6.1
Unencrypted traffic between pods when using Wireguard and an external kvstore
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. This issue af…
-
Medium 6.1
Cilium has unencrypted ingress/health traffic when using Wireguard transparent encryption
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, traffic to/from the Ingress and health endpo…
-
Medium 5.0
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last chara…
-
High 7.5
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the pr…
-
High 7.5
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encodi…
-
Critical 10.0
pgjdbc SQL Injection via line comment generation
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There mu…
-
High 8.1
Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.
-
Medium 5.5CVE-2024-26308 Public exploit
Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file
Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.
-
Medium 4.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 3.1
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). S…
-
Low 3.1
Vulnerability affecting the org.openjfx:javafx-media maven component of the OpenJFX project
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit v…