8,437 results · Feed
-
Medium max 5.5USN-8311-1 1 CVE
dnsmasq vulnerability
Petr Menšík discovered that Dnsmasq incorrectly handled certain input in the dhcp_release utility. A local attacker could possibly use this issue to cause Dnsmasq to crash, resulting in a denial of service.
first May 26, 2026 -
UnscoredUSN-8287-1 0 CVEs
xdg-desktop-portal vulnerability
It was discovered that XDG Desktop Portal incorrectly handled trashing files. A local attacker could possibly use this issue to delete arbitrary files on the host file system via a symlink attack.
first May 20, 2026 -
UnscoredUSN-8167-2 0 CVEs
xdg-dbus-proxy vulnerability
USN-8167-1 fixed a vulnerability in xdg-dbus-proxy. This update provides the corresponding update for Ubuntu 20.04 LTS. Original advisory details: It was discovered that xdg-dbus-proxy incorrectly handled eavesdropping in policy rules. A local attacker could …
first May 26, 2026 -
Medium max 6.7USN-8319-1 2 CVEs
libgcrypt20 vulnerabilities
It was discovered that Libgcrypt incorrectly handled crafted ECDH ciphertext. An attacker could possibly use this issue to cause Libgcrypt to crash, resulting in a denial of service. (CVE-2026-41989) It was discovered that Libgcrypt incorrectly handled Dilith…
-
High max 7.8USN-8318-1 1 CVE
libcaca vulnerability
It was discovered that libcaca incorrectly handled certain malformed files. An attacker could use this issue to cause libcaca to crash, resulting in a denial of service, or possibly execute arbitrary code.
-
Medium max 4.0USN-8317-1 2 CVEs
gst-plugins-good1.0 vulnerabilities
It was discovered that GStreamer Good Plugins incorrectly handled certain MP4 audio tracks. An attacker could possibly use this issue to cause GStreamer Good Plugins to crash, resulting in a denial of service.
-
Medium max 5.1USN-8315-1 3 CVEs
mediawiki vulnerabilities
It was discovered that MediaWiki incorrectly handled group membership visibility in the OATHAuth extension. An authenticated attacker could use this issue to determine if other users had two-factor authentication enabled. (CVE-2026-34087) It was discovered th…
-
Critical max 9.8USN-8313-1 2 CVEs
xmlrpc-c vulnerabilities
It was discovered that Expat, vendored in XML-RPC, incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.
-
Critical max 9.8USN-8314-1 2 CVEs
ayttm vulnerabilities
It was discovered that Expat, vendored in Ayttm, incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.
-
High max 8.8USN-8303-1 5 CVEs
python-git vulnerabilities
Santos Gallegos discovered that GitPython did not properly validate paths when resolving certain Git references. An attacker could possibly use this issue to cause files outside the .git directory to be accessed, leading to a denial of service. This issue onl…
first May 26, 2026 -
Medium max 5.3USN-7972-2 1 CVE
opencc vulnerability
USN-7972-1 fixed a vulnerability in OpenCC. This update provides the corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenCC incorrectly handled truncated UTF-8 input. An attacker could possibly…
-
High max 8.8USN-8307-1 1 CVE
onnx vulnerability
It was discovered that ONNX did not properly validate paths when extracting tar archives during model downloads. An attacker could possibly use this issue to overwrite arbitrary files on the system.
-
High max 7.5USN-8308-1 1 CVE
dnsmasq vulnerability
It was discovered that Dnsmasq incorrectly handled BOOTREPLY packets when configured with the --dhcp-split-relay option. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a denial of service, or possibly execute arbitrary code.
-
Medium max 6.6USN-8304-1 3 CVEs
vim vulnerabilities
Joshua Rogers discovered that Vim incorrectly handled certain URL schemes in the netrw plugin. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2026-42307) It was discovered that Vim incorrectly handled command-line completion for…
first May 25, 2026 -
Critical max 9.8USN-6457-1 4 CVEs
nodejs vulnerabilities
Tavis Ormandy discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-0778) …
first Oct 30, 2023 -
High max 7.5USN-5328-1 1 CVE
openssl, openssl1.0 vulnerability
Tavis Ormandy discovered that OpenSSL incorrectly parsed certain certificates. A remote attacker could possibly use this issue to cause OpenSSH to stop responding, resulting in a denial of service.
first Mar 15, 2022 -
UnscoredUSN-8269-1 0 CVEs
avahi vulnerabilities
It is discovered that Avahi incorrectly handled crafted input. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 …
first May 12, 2026 -
High max 7.5USN-8292-1 3 CVEs
libarchive vulnerabilities
It was discovered that libarchive incorrectly handled certain RAR archives. An attacker could possibly use this issue to cause an out-of-bounds read via a crafted RAR archive, leading to sensitive memory disclosure. (CVE-2026-4424) It was discovered that liba…
-
High max 7.5USN-8290-1 1 CVE
node-path-to-regexp vulnerability
It was discovered that Path-to-Regexp incorrectly handled route patterns containing multiple named parameters separated by non-delimiter characters such as hyphens. An attacker could possibly use this issue to cause a denial of service via catastrophic backtr…
-
UnscoredUSN-8242-2 0 CVEs
postfixadmin vulnerability
USN-8242-1 fixed a vulnerability in CiviCRM. This update provides the corresponding fix for PostfixAdmin. Original advisory details: Takuya Aramaki discovered that Smarty, vendored in CiviCRM, did not properly escape JavaScript code. An attacker could possibl…
first May 7, 2026 -
UnscoredUSN-8270-1 0 CVEs
exim4 vulnerability
It was discovered that Exim incorrectly handled BDAT body parsing. A remote attacker could use this issue to cause Exim to crash, resulting in a denial of service, or possibly execute arbitrary code.
first May 12, 2026 -
UnscoredUSN-8252-1 0 CVEs
openjpeg2 vulnerability
It was discovered that OpenJPEG did not properly handle memory when encoding image files. An attacker could use this issue to cause OpenJPEG to crash, resulting in a denial of service, or possibly execute arbitrary code.
first May 7, 2026 -
UnscoredUSN-8251-1 0 CVEs
libpng1.6 vulnerabilities
It was discovered that libpng incorrectly handled memory when processing certain PNG files. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial …
first May 7, 2026 -
UnscoredUSN-8250-1 0 CVEs
lcms2 vulnerability
It was discovered that Little CMS incorrectly handled certain malformed ICC profiles. An attacker could possibly use this issue to cause Little CMS to crash, resulting in a denial of service.
first May 7, 2026 -
UnscoredUSN-8246-1 0 CVEs
vim vulnerabilities
Michał Majchrowicz discovered that Vim’s zip plugin could overwrite arbitrary files. An attacker could possibly use this issue to delete sensitive data or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-35177) It was discovered th…
first May 7, 2026 -
UnscoredUSN-8238-1 0 CVEs
editorconfig-core vulnerability
It was discovered that EditorConfig incorrectly handled specially crafted configuration files. A local attacker could possibly use this issue to cause EditorConfig to crash, resulting in a denial of service.
first May 6, 2026 -
UnscoredUSN-8232-1 0 CVEs
python-django vulnerabilities
It was discovered that Django did not vary cached response headers on cookies when sessions were not modified while SESSION_SAVE_EVERY_REQUEST was enabled. A remote attacker could possibly use this issue to steal a user's session. (CVE-2026-35192) Kyle Agroni…
first May 5, 2026 -
UnscoredUSN-8230-1 0 CVEs
docker.io-app vulnerabilities
It was discovered that BuildKit, contained within Docker, incorrectly handled file path validation when processing frontend API messages. An attacker could possibly use this issue to write files outside of the intended state directory. (CVE-2026-33747) It was…
first May 6, 2026 -
UnscoredUSN-8229-1 0 CVEs
sed vulnerability
Michał Majchrowicz and Marcin Wyczechowski discovered that sed incorrectly handled symbolic links when performing in-place edits. A local attacker could possibly use this issue to overwrite arbitrary files.
first May 4, 2026 -
UnscoredUSN-8227-1 0 CVEs
curl vulnerabilities
It was discovered that curl incorrectly reused non-TLS connections when TLS was required in some STARTTLS configurations. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-4873) It was discovered that curl incorrectly …
first May 4, 2026 -
UnscoredUSN-8228-1 0 CVEs
exim4 vulnerabilities
It was discovered that Exim incorrectly handled parsing malformed JSON in message headers. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-40685) It was discovered that Exim incorrectly handled processing of UTF-8 trailing…
first May 4, 2026 -
UnscoredUSN-8212-1 0 CVEs
authd vulnerability
It was discovered that authd incorrectly assigned the primary group ID to users under certain conditions. A local attacker could possibly use this issue to achieve privilege escalation, or gain unauthorized access to files belonging to other users.
first Apr 27, 2026 -
UnscoredUSN-8209-1 0 CVEs
lcms2 vulnerability
It was discovered that Little CMS incorrectly handled certain malformed ICC profiles. An attacker could use this issue to cause Little CMS to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Apr 27, 2026 -
UnscoredUSN-8207-1 0 CVEs
clamav vulnerability
It was discovered that ClamAV incorrectly handled certain HTML files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service.
first Apr 27, 2026 -
UnscoredUSN-8198-2 0 CVEs
python-tornado vulnerabilities
USN-8198-1 fixed vulnerabilities in Tornado. This update provides the corresponding updates for Ubuntu 26.04 LTS. Original advisory details: It was discovered that Tornado incorrectly handled parsing of large multipart request bodies. An attacker could possib…
first Apr 28, 2026 -
UnscoredUSN-8196-2 0 CVEs
strongswan vulnerabilities
USN-8196-1 fixed vulnerabilities in strongSwan. This update provides the corresponding update to Ubuntu 26.04 LTS. Original advisory details: Haruto Kimura discovered that strongSwan incorrectly handled the supported_versions extension in TLS. A remote attack…
first Apr 27, 2026 -
UnscoredUSN-8195-2 0 CVEs
packagekit vulnerability
USN-8195-1 fixed a vulnerability in PackageKit. This update provides the corresponding update to Ubuntu 26.04 LTS. Original advisory details: It was discovered that PackageKit incorrectly handled certain transactions. A local attacker could use this issue to …
first Apr 27, 2026 -
UnscoredUSN-8192-2 0 CVEs
ntfs-3g vulnerabilities
USN-8192-1 fixed vulnerabilities in NTFS-3G. This update provides the corresponding update to Ubuntu 26.04 LTS. Original advisory details: Jeffrey Bencteux discovered that NTFS-3G incorrectly handled certain UTF-8 sequences. An attacker could use this issue t…
first Apr 27, 2026 -
UnscoredUSN-8155-1 0 CVEs
openssl vulnerabilities
Viktor Dukhovni discovered that OpenSSL incorrectly negotiated the expected preferred key exchange group when used as a TLS 1.3 server. This could result in a less preferred key exchange being used, contrary to expectations. This issue only affected Ubuntu 25…
first Apr 8, 2026 -
UnscoredUSN-8190-2 0 CVEs
ruby-rack-session vulnerability
USN-8190-1 fixed a vulnerability in Rack::Session. This update provides the corresponding update for Ubuntu 26.04 LTS. Original advisory details: SeungMyung Lee discovered that Rack::Session did not properly reject cookies upon decryption failure. A remote at…
first Apr 28, 2026