1,460 results · Clear filters · Feed
-
Critical max 10.0USN-7381-1 311 CVEs
linux-lowlatency-hwe-6.11 vulnerabilities
Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or pos…
first Mar 27, 2025 -
Critical max 9.8USN-7879-1 200 CVEs
linux, linux-aws, linux-gcp, linux-hwe-6.14, linux-oracle, linux-realtime vulnerabilities
It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331) Several security issues were discovered in the Linux…
first Nov 21, 2025 -
Critical max 9.8USN-7021-4 8 CVEs
linux-azure-fde-5.15 vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - GPU drivers; - BTRFS file system; - F2FS file system; - GFS2 file system; - B…
first Oct 3, 2024 -
Critical max 10.0USN-6347-1 24 CVEs
linux-azure-fde-5.15 vulnerabilities
William Zhao discovered that the Traffic Control (TC) subsystem in the Linux kernel did not properly handle network packet retransmission in certain situations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2022-4269) It…
first Sep 6, 2023 -
Critical max 9.8LSN-0115-1 5 CVEs
Kernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fixed overflow check in mi_enum_attr())(CVE-2024-27407). In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put(…
first Oct 8, 2025 -
Critical max 9.8LSN-0113-1 6 CVEs
Kernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. In the Linux kernel, the following vulnerability…
first Jul 10, 2025 -
Critical max 9.8LSN-0108-1 7 CVEs
Kernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the backlog and crypto_aead_decrypt returns -EBUSY, tls_do_decryption will wait until all async decryptio…
first Dec 19, 2024 -
Critical max 9.8LSN-0106-1 3 CVEs
Kernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow timeout for anonymous sets Never used from userspace, disallow these parameters.(CVE-2023-52620) In the Linux kernel, the following vulnerability has been resol…
first Aug 20, 2024 -
Critical max 10.0
Kernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc Any unprivileged user can attach N_GSM0710 ldisc, but it requires CAP_NET_ADMIN to create a GSM network anyway. Require initial nam…
first Mar 26, 2025 -
Critical max 9.4LSN-0105-1 5 CVEs
Kernel Live Patch Security Notice
It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code.(CVE-2023-6270) It …
first Jul 16, 2024 -
Critical max 9.8
Kernel Live Patch Security Notice
It was discovered that the watch_queue event notification system contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service or escalate their privileges.)(CVE-2022-0995) In the Linux kernel, the following vuln…
first Apr 16, 2025 -
Critical max 9.8LSN-0109-1 6 CVEs
Kernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the backlog and crypto_aead_decrypt returns -EBUSY, tls_do_decryption will wait until all async decryptio…
first Feb 20, 2025 -
Critical max 9.3USN-8366-1 2 CVEs
luanti vulnerabilities
It was discovered that Luanti, when using LuaJIT, did not properly enforce Lua sandbox restrictions. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-40959) It was discovered that Luanti did not properly restrict access to insecu…
-
Critical max 9.3USN-8360-1 1 CVE
sslh vulnerability
It was discovered that sslh did not properly handle symbolic links when writing its PID file. A local attacker could possibly use this issue to overwrite arbitrary files.
-
Critical max 9.8USN-3212-1 39 CVEs
tiff vulnerabilities
It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute …
first Feb 27, 2017 -
Critical max 9.8USN-2966-1 4 CVEs
openssh vulnerabilities
Shayan Sadigh discovered that OpenSSH incorrectly handled environment files when the UseLogin feature is enabled. A local attacker could use this issue to gain privileges. (CVE-2015-8325) Ben Hawkes discovered that OpenSSH incorrectly handled certain network …
first May 9, 2016 -
Critical max 9.8USN-7590-1 3 CVEs
apache-log4j1.2 vulnerabilities
It was discovered that several deserialization issues existed within Apache Log4j. An attacker could possibly use these issues to enable the execution of arbitrary code. (CVE-2022-23302, CVE-2022-23305, CVE-2022-23307)
first Jun 23, 2025 -
Critical max 9.8USN-4495-1 1 CVE
Apache Log4j vulnerability
It was discovered that Apache Log4j does not properly deserialize untrusted data. An attacker could possibly use this issue to remotely execute arbitrary code. (CVE-2019-17571)
first Sep 15, 2020 -
Critical max 9.8USN-3947-1 1 CVE
libxslt vulnerability
It was discovered that Libxslt incorrectly handled certain documents. An attacker could possibly use this issue to access sensitive information.
first Apr 15, 2019 -
Critical max 9.8
openjdk-7 vulnerabilities
Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2015-2590, CVE-2015-26…
first Jul 30, 2015 -
Critical max 9.8USN-8338-1 15 CVEs
apache2 vulnerabilities
It was discovered that Apache HTTP Server incorrectly handled certain response headers. An attacker could possibly use this issue to perform HTTP response splitting attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2023-38709) Will Dormann and David Wa…
first May 28, 2026 -
Critical max 9.8USN-8316-1 2 CVEs
cableswig vulnerabilities
It was discovered that Expat, vendored in CableSwig, incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.
first May 27, 2026 -
Critical max 9.8USN-8313-1 2 CVEs
xmlrpc-c vulnerabilities
It was discovered that Expat, vendored in XML-RPC, incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.
-
Critical max 9.8USN-8314-1 2 CVEs
ayttm vulnerabilities
It was discovered that Expat, vendored in Ayttm, incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.
-
Critical max 9.8USN-6457-1 4 CVEs
nodejs vulnerabilities
Tavis Ormandy discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-0778) …
first Oct 30, 2023 -
Critical max 9.3USN-8218-1 1 CVE
zulucrypt vulnerability
Aaron Rainbolt discovered that zuluCrypt used insecure PolicyKit settings in zuluPolkit. An attacker could possibly use this issue to cause local privilege escalation to root. (CVE-2025-53391)
first Apr 30, 2026 -
Critical max 9.8USN-5310-1 12 CVEs
glibc vulnerabilities
Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to hang or crash, resulting in a denial of service. Thi…
first Mar 1, 2022 -
Critical max 9.8USN-4639-1 14 CVEs
phpmyadmin vulnerabilities
It was discovered that there was a bug in the way phpMyAdmin handles the phpMyAdmin Configuration Storage tables. An authenticated attacker could use this vulnerability to cause phpmyAdmin to leak sensitive files. (CVE-2018-19968) It was discovered that phpMy…
first Nov 19, 2020 -
Critical max 9.8USN-8154-1 5 CVEs
python-django vulnerabilities
Seokchan Yoon discovered that Django incorrectly handled copying memory when parsing multipart uploads with excessive whitespace. A remote attacker could possibly use this issue to cause Django to use excessive resources, leading to a denial of service. (CVE-…
first Apr 7, 2026 -
Critical max 9.8USN-5051-1 2 CVEs
openssl vulnerabilities
John Ouyang discovered that OpenSSL incorrectly handled decrypting SM2 data. A remote attacker could use this issue to cause applications using OpenSSL to crash, resulting in a denial of service, or possibly change application behaviour. (CVE-2021-3711) Ingo …
first Aug 24, 2021 -
Critical max 9.3USN-8190-1 1 CVE
ruby-rack-session vulnerability
SeungMyung Lee discovered that Rack::Session did not properly reject cookies upon decryption failure. A remote attacker could use this issue to manipulate session contents and possibly gain unauthorized access.
first Apr 20, 2026 -
Critical max 9.8USN-8128-1 3 CVEs
libcryptx-perl vulnerabilities
It was discovered that CryptX did not verify authentication tags while performing GCM and ChaCha20-Poly1305 decryption. An attacker could possibly use this issue to cause CryptX to accept modified ciphertext, leading to data integrity violations or authentica…
first Mar 26, 2026 -
Critical max 9.8USN-8078-1 1 CVE
zutty vulnerability
Carter Sande discovered that Zutty did not correctly echo invalid input to the console on DECRQSS. An attacker could possibly use this issue to execute arbitrary commands.
first Mar 5, 2026 -
Critical max 9.8USN-8088-1 5 CVEs
golang-github-go-git-go-git vulnerabilities
Ionut Lalu discovered that go-git incorrectly handled certain specially crafted Git server responses. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-49568, CVE-2025-21614) Ionut Lalu discovered that go-git incorrectly handle…
first Mar 12, 2026 -
Critical max 9.8USN-7973-1 3 CVEs
cjson vulnerabilities
It was discovered that cJSON incorrectly handled parsing large numbers. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-26819) It was discovered that cJSON may perform out-of-bounds read when processing specially crafted JSON…
first Jan 23, 2026 -
Critical max 9.4USN-7989-1 1 CVE
python-internetarchive vulnerability
Pengo Wray discovered that The Internet Archive Python Library incorrectly handled certain file paths when downloading files. An attacker could possibly use this issue to write files to arbitrary locations on the file system.
first Feb 2, 2026 -
Critical max 10.0USN-7962-1 1 CVE
cpp-httplib vulnerability
It was discovered that cpp-httplib did not correctly handle HTTP headers. A remote attacker could possibly use this issue to bypass authorization and impersonate users.
first Jan 14, 2026 -
Critical max 9.1USN-7926-1 3 CVEs
keystone vulnerabilities
Kay discovered that OpenStack Keystone incorrectly handled the ec2tokens and s3tokens APIs. A remote attacker could possibly use this issue to obtain unauthorized access and escalate privileges. (CVE-2025-65073) It was discovered that OpenStack Keystone only …
first Dec 11, 2025 -
Critical max 10.0USN-7893-1 5 CVEs
valkey vulnerabilities
Benny Isaacs, Nir Brakha, and Sagi Tzadik discovered that Valkey incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a use-after-free condition, and potentially achieve remote code execution o…
first Nov 26, 2025 -
Critical max 9.8USN-7872-1 4 CVEs
lasso vulnerabilities
It was discovered that Lasso incorrectly handled certain malformed SAML responses. A remote attacker could possibly use this issue to cause Lasso to crash, resulting in a denial of service. (CVE-2025-46404) It was discovered that Lasso incorrectly handled cer…
first Nov 18, 2025