242 results · Clear filters · Feed
-
High max 8.8
linux-oem-5.6 vulnerabilities
It was discovered that the overlayfs implementation in the Linux kernel did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges. (CVE-2021-3493) Vincent…
first Apr 15, 2021 -
High max 8.2
Kernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is…
first Nov 17, 2025 -
High max 7.8
Kernel Live Patch Security Notice
Lonial Con discovered that the netfilter subsystem in the Linux kernel contained a memory leak when handling certain element flush operations. A local attacker could use this to expose sensitive information (kernel memory).(CVE-2023-4569) Xingyuan Mo discover…
first Apr 30, 2024 -
High max 8.6
Kernel Live Patch Security Notice
It was discovered that a race condition existed in the network scheduling subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.…
first Jun 2, 2022 -
High max 7.8
Kernel Live Patch Security Notice
Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges.(CVE-2022-0492) Nick Gregory dis…
first Mar 23, 2022 -
High max 8.4
Kernel Live Patch Security Notice
William Liu and Jamie Hill-Daniel discovered that the file system context functionality in the Linux kernel contained an integer underflow vulnerability, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service (system c…
first Jan 20, 2022 -
High max 8.3
Kernel Live Patch Security Notice
The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. This affects kernel/bpf/core.…
first Jan 6, 2022 -
High max 8.3
Kernel Live Patch Security Notice
Maxim Levitsky discovered that the KVM hypervisor implementation for AMD processors in the Linux kernel did not properly prevent a guest VM from enabling AVIC in nested guest VMs. An attacker in a guest VM could use this to write to portions of the host's phy…
first Sep 13, 2021 -
High max 8.3
Kernel Live Patch Security Notice
Andy Nguyen discovered that the netfilter subsystem in the Linux kernel contained an out-of-bounds write in its setsockopt() implementation. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-20…
first Aug 16, 2021 -
High max 8.8
Kernel Live Patch Security Notice
It was discovered that the overlayfs implementation in the Linux kernel did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges.(CVE-2021-3493) Piotr Kr…
first May 3, 2021 -
High max 7.2
roundcube vulnerabilities
It was discovered that Roundcube Webmail did not properly sanitize the animate tag within SVG documents. An attacker could possibly use this issue to cause a cross-site scripting attack.
first Mar 16, 2026 -
High max 7.5
h2o vulnerability
It was discovered that H2O exhibited poor server resource management in its HTTP/2 protocol. An attacker could possibly use this issue to cause H2O to crash, resulting in a denial of service.
first Nov 26, 2025 -
High max 8.8
webkit2gtk vulnerabilities
Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting a…
first Aug 19, 2025 -
High max 7.5
nodejs vulnerability
USN-7469-1 fixed a vulnerability in Apache Traffic Server. This update provides the corresponding updates for Node.js. Original advisory details: It was discovered that Apache Traffic Server exhibited poor server resource management in its HTTP/2 protocol. An…
first Apr 29, 2025 -
High max 7.5
h2o vulnerability
USN-7469-1 fixed a vulnerability in Apache Traffic Server. This update provides the corresponding updates for H2O. Original advisory details: It was discovered that Apache Traffic Server exhibited poor server resource management in its HTTP/2 protocol. An att…
first Apr 30, 2025 -
High max 7.5
tomcat8 vulnerability
USN-7469-1 fixed a vulnerability in Apache Traffic Server. This update provides the corresponding updates for Apache Tomcat. Original advisory details: It was discovered that Apache Traffic Server exhibited poor server resource management in its HTTP/2 protoc…
first Apr 28, 2025 -
High max 7.5
tomcat9 vulnerability
It was discovered that Tomcat incorrectly handled request cancellation. A remote attacker could possibly use this issue to cause tomcat9 to consume resources, leading to a denial of service.
first Apr 7, 2025 -
High max 7.5
trafficserver vulnerability
It was discovered that Apache Traffic Server exhibited poor server resource management in its HTTP/2 protocol. An attacker could possibly use this issue to cause Apache Traffic Server to crash, resulting in a denial of service.
first Apr 28, 2025 -
High max 7.5
haproxy vulnerability
It was discovered that HAProxy did not properly limit the creation of new HTTP/2 streams. A remote attacker could possibly use this issue to cause HAProxy to consume excessive resources, leading to a denial of service.
first Oct 14, 2024 -
High max 7.5
netty vulnerabilities
It was discovered that Netty did not properly sanitize its input parameters. A remote attacker could possibly use this issue to cause a crash. (CVE-2023-34462) It was discovered that Netty incorrectly handled request cancellation. A remote attacker could poss…
first Sep 5, 2024 -
High max 8.1
Go vulnerabilities
Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a cross site scripting attack. This issue only a…
first Jan 11, 2024 -
High max 8.8
libvpx vulnerabilities
USN-6403-1 fixed several vulnerabilities in libvpx. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: It was discovered that libvpx did not properly handle certain malformed media files. If an application using lib…
first Oct 23, 2023 -
High max 8.8
libvpx vulnerabilities
It was discovered that libvpx did not properly handle certain malformed media files. If an application using libvpx opened a specially crafted file, a remote attacker could cause a denial of service, or possibly execute arbitrary code.
first Oct 2, 2023 -
High max 7.5
nghttp2 vulnerability
It was discovered that nghttp2 incorrectly handled request cancellation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service.
first Nov 22, 2023 -
High max 7.5
dotnet6, dotnet7 vulnerability
It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service.
first Oct 10, 2023 -
High max 7.8
sudo vulnerabilities
It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker could possibly use this issue to obtain unintended access to the administrator account. (CVE-2021-3156) It was discovered that the Sudo sudoedit utility incorr…
first Jan 26, 2021 -
High max 8.1
thunderbird vulnerabilities
It was discovered that Message ID calculation was based on uninitialized data. An attacker could potentially exploit this to obtain sensitive information. (CVE-2020-6792) Mutiple security issues were discovered in Thunderbird. If a user were tricked in to ope…
first Apr 13, 2020 -
High max 8.8
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass sec…
first Apr 21, 2020 -
High max 8.8
webkit2gtk vulnerabilities
Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting a…
first Jan 13, 2026 -
High max 7.8
open-vm-tools vulnerability
It was discovered that Open VM Tools incorrectly handled permissions with version checking. An attacker could possibly use this issue to escalate privileges inside a virtual machine. This update disables the SDMP get-versions.sh script, so version information…
first Sep 29, 2025 -
High max 8.1
freetype vulnerability
It was discovered that FreeType incorrectly handled certain memory operations when parsing font subglyph structures. A remote attacker could use this issue to cause FreeType to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Mar 17, 2025 -
High max 8.8
libvpx vulnerability
It was discovered that libvpx did not properly handle certain malformed media files. If an application using libvpx opened a specially crafted file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. Ubuntu 22.04 LTS, Ubunt…
first Dec 18, 2024 -
High max 8.8
webkit2gtk vulnerabilities
Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting a…
first Feb 12, 2024 -
High max 8.8
webkit2gtk vulnerabilities
Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting a…
first Dec 11, 2023 -
High max 7.8
glibc vulnerabilities
It was discovered that the GNU C Library incorrectly handled the GLIBC_TUNABLES environment variable. An attacker could possibly use this issue to perform a privilege escalation attack. (CVE-2023-4911) It was discovered that the GNU C Library incorrectly hand…
first Oct 3, 2023 -
High max 8.8
libwebp vulnerability
USN-6369-1 fixed a vulnerability in libwebp. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked…
first Sep 28, 2023 -
High max 8.8
libwebp vulnerability
It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue to cause libwebp to crash, resulting in a denial of ser…
first Sep 14, 2023 -
High max 8.8
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass secu…
first Sep 14, 2023 -
High max 8.8
firefox vulnerability
It was discovered that Firefox did not properly manage memory when handling WebP images. If a user were tricked into opening a webpage containing malicious WebP image file, an attacker could potentially exploit these to cause a denial of service or execute ar…
first Sep 14, 2023 -
High max 8.8
webkit2gtk vulnerabilities
Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting a…
first Jul 31, 2023