2,451 results · Clear filters · Feed
-
High max 7.5USN-8065-1 5 CVEs
python-authlib vulnerabilities
Millie Solem discovered that Authlib did not properly restrict algorithm selection during JWT verification, allowing HMAC verification with asymmetric public keys when no algorithm was specified. A remote attacker could possibly use this issue to bypass signa…
first Feb 25, 2026 -
High max 7.5USN-8046-1 9 CVEs
frr vulnerabilities
It was discovered that FRR incorrectly handled certain malformed OSPF and update packets. A remote attacker could possibly use these issues to cause FRR to crash, resulting in a denial of service.
first Feb 17, 2026 -
High max 7.1USN-8056-1 6 CVEs
u-boot vulnerabilities
Simon Diepold discovered that U-Boot incorrectly handled certain DHCP responses. An attacker on the local network could possibly use this issue to obtain sensitive memory contents. (CVE-2024-42040) It was discovered that U-Boot incorrectly handled symlink siz…
first Feb 23, 2026 -
High max 7.5USN-8041-1 1 CVE
node-dottie vulnerability
Yuhan Gao and Peng Zhou discovered that Dottie was vulnerable to prototype pollution when altering the __proto__ magical attribute. An attacker could possibly use this issue to achieve remote code execution.
first Feb 12, 2026 -
High max 7.8USN-8102-2 1 CVE
snapd regression
USN-8102-1 fixed a vulnerability in snapd. The update caused a regresision for Ubuntu 24.04 LTS while installing the package. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Qualys discovered that snapd incorrectl…
first Mar 17, 2026 -
High max 7.5USN-8025-2 1 CVE
dotnet8, dotnet10 vulnerability
USN 8025-1 fixed a vulnerability in .NET. This update provides the corresponding fix for Ubuntu 24.04 LTS. Original advisory details: Kevin Jones discovered that the System.Security.Cryptography.Cose component in .NET did not properly handle certain missing s…
first Feb 16, 2026 -
High max 7.5USN-8025-1 1 CVE
dotnet8, dotnet9, dotnet10 vulnerability
Kevin Jones discovered that the System.Security.Cryptography.Cose component in .NET did not properly handle certain missing special elements in input data. An attacker could possibly use this issue to bypass security checks and gain unauthorized access or per…
first Feb 11, 2026 -
High max 7.5USN-8024-1 2 CVEs
libwebsockets vulnerabilities
Raffaele Bova discovered that Libwebsockets incorrectly handled memory when the upgrade header is not valid in the WebSocket server. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-11677) Raffaele Bova discovered that Libwebs…
first Feb 11, 2026 -
High max 8.8USN-8011-1 2 CVEs
emacs vulnerabilities
It was discovered that Emacs could trigger unsafe Lisp macro expansion, when a user invoked elisp-completion-at-point on untrusted Emacs Lisp source code. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-53920) It was discovered …
first Feb 4, 2026 -
High max 8.6USN-7977-1 2 CVEs
git-lfs vulnerabilities
Ryota K discovered that Git LFS may leak login credentials in certain instances due to failing to check for URL-encoded characters. An attacker could possibly use this issue to learn sensitive information. (CVE-2024-53263) It was discovered that Git LFS could…
first Jan 26, 2026 -
High max 7.5USN-7966-2 3 CVEs
telegraf vulnerabilities
USN-7966-1 fixed vulnerabilities in Snowflake. This update provides the corresponding updates for Telegraf. Original advisory details: It was discovered that Pion DTLS, vendored in Telegraf, did not impose a limit on the amount of data that was buffered durin…
first Jan 19, 2026 -
High max 8.3USN-7968-1 4 CVEs
apache2 vulnerabilities
It was discovered that the Apache HTTP Server incorrectly handled failed ACME certificate renewals. This could result in renewal attempts to be repeated without delays, possibly leading to a denial of service. (CVE-2025-55753) Anthony Parfenov discovered that…
first Jan 19, 2026 -
High max 7.5USN-7966-1 3 CVEs
snowflake vulnerabilities
It was discovered that Pion DTLS, vendored in Snowflake, did not impose a limit on the amount of data that was buffered during the handshake. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29189) It was discovered that Pion D…
first Jan 19, 2026 -
High max 7.5USN-8037-1 3 CVEs
dnsdist vulnerabilities
It was discovered that HTTP/2, which is used/vendored by DNSdist, did not properly account for resources when handling client-triggered stream resets. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-8671) It was discovered th…
first Feb 12, 2026 -
High max 7.8USN-7896-1 3 CVEs
libxml2 vulnerabilities
It was discovered that the libxml2 Python bindings incorrectly handled certain return values. An attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service. (CVE-2025-32414) It was discovered that libxml2 incorrectly ha…
first Nov 27, 2025 -
High max 8.2USN-7744-1 7 CVEs
qemu vulnerabilities
It was discovered that QEMU incorrectly handled certain virtio devices. A privileged guest attacker could use this issue to cause QEMU to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and …
first Sep 11, 2025 -
High max 7.5USN-7932-1 1 CVE
libsoup3 vulnerability
It was discovered libsoup incorrectly handled memory when handling specific HTTP/2 read and cancel sequences. An attacker could possibly use this issue to cause a denial of service.
first Dec 15, 2025 -
High max 8.9USN-7927-1 2 CVEs
python-urllib3 vulnerabilities
Illia Volochii discovered that urllib3 did not limit the steps in a decompression chain. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. (CVE-2025-66418) Rui Xi discovered that urllib3 incorr…
first Dec 11, 2025 -
High max 8.1USN-4430-1 4 CVEs
pillow vulnerabilities
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted image file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service.
first Jul 22, 2020 -
High max 8.9USN-7927-3 1 CVE
python-urllib3 regression
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471 introduced a regression in urllib3 when decompressing zstd data. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Illia Volochii discovered…
first Jan 13, 2026 -
High max 8.9USN-7927-2 1 CVE
python-urllib3 regression
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471 introduced a regression in the zstd decompression component inside urllib3. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Illia Volochii…
first Jan 12, 2026 -
High max 7.5USN-7917-1 2 CVEs
fonttools vulnerabilities
It was discovered that the subsetting module of fontTools was vulnerable to an XML External Entity (XEE) attack. An unauthenticated remote attacker could possibly use this issue to include arbitrary files from the file system or make web requests from the hos…
first Dec 9, 2025 -
High max 8.1USN-7913-1 3 CVEs
mame vulnerabilities
It was discovered that the stb library, included in MAME, had a heap-based buffer overflow. An attacker could possibly use this issue to crash the program or execute arbitrary code. (CVE-2018-16981) It was discovered that the tinyexr library, included in MAME…
first Dec 4, 2025 -
High max 7.5
h2o vulnerability
It was discovered that H2O exhibited poor server resource management in its HTTP/2 protocol. An attacker could possibly use this issue to cause H2O to crash, resulting in a denial of service.
first Nov 26, 2025 -
High max 7.5USN-7902-1 3 CVEs
openjdk-25-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 25 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2025-53…
first Dec 1, 2025 -
High max 7.5USN-7888-1 6 CVEs
mupdf vulnerabilities
It was discovered that MuPDF could be made to divide by zero. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-51103, CVE-2023-51104, CVE-2023-51105, CVE-2023-51106) It was discovered that MuPDF incorrectly handled memory unde…
first Nov 25, 2025 -
High max 7.5USN-7900-1 2 CVEs
openjdk-17-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 17 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2025-53…
first Dec 1, 2025 -
High max 7.5USN-7901-1 3 CVEs
openjdk-21-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 21 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2025-53…
first Dec 1, 2025 -
High max 7.5USN-7883-1 2 CVEs
openjdk-17 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 17 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2025-530…
first Nov 24, 2025 -
High max 7.5USN-7884-1 3 CVEs
openjdk-25 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 25 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2025-530…
first Nov 24, 2025 -
High max 7.5USN-7952-1 2 CVEs
libheif vulnerabilities
It was discovered that libheif did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-25269) Aldo …
first Jan 12, 2026 -
High max 7.5USN-7882-1 2 CVEs
openjdk-lts vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 11 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2025-530…
first Nov 24, 2025 -
High max 8.1USN-7841-1 1 CVE
strongswan vulnerability
Xu Biang discovered that the strongSwan client incorrectly handled EAP-MSCHAPv2 failure requests. If a user or automated system were tricked into connecting to a malicious server, a remote attacker could use this issue to cause strongSwan to crash, resulting …
first Oct 27, 2025 -
High max 7.8USN-7852-1 1 CVE
libxml2 vulnerability
It was discovered that libxslt, used by libxml2, incorrectly handled certain attributes. An attacker could use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. This update adds a fix to libxml2 to mitigate the…
first Oct 30, 2025 -
High max 7.3USN-7846-1 3 CVEs
xorg-server, xwayland vulnerabilities
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled certain memory operations. An attacker could use these issues to cause the X Server to crash, leading to a denial of service, obtain sensitive information, or possibly execute arbitrary co…
first Oct 29, 2025 -
High max 8.6USN-7836-2 3 CVEs
bind9 vulnerabilities
USN-7836-1 fixed vulnerabilities in Bind. This update provides the corresponding fixes for Ubuntu 20.04 LTS. Original advisory details: Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could po…
first Nov 12, 2025 -
High max 8.6USN-7836-1 3 CVEs
bind9 vulnerabilities
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. (CVE-2025-8677) Yuxiao Wu, Yunyi Zhang, Baoj…
first Oct 22, 2025 -
High max 7.5USN-7830-1 5 CVEs
ffmpeg vulnerabilities
It was discovered that FFmpeg incorrectly handled the return values of functions in its Firequalizer filter and in the HTTP Live Streaming (HLS) implementation, leading to a NULL pointer dereference. If a user was tricked into loading a crafted media file, a …
first Oct 21, 2025 -
High max 8.2USN-7768-1 1 CVE
dpkg vulnerability
It was discovered that dpkg incorrectly handled removing certain temporary directories. An attacker could possibly use this issue to consume disk space, leading to a denial of service.
first Sep 24, 2025 -
High max 8.2USN-7659-1 3 CVEs
ruby-nokogiri vulnerabilities
It was discovered Nokogiri did not correctly parse XML Schemas. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (…
first Jul 21, 2025