8,437 results · Feed
-
Medium max 4.3USN-7782-1 4 CVEs
ghostscript vulnerabilities
It was discovered that Ghostscript incorrectly handled opening a file to write. An attacker could possibly use this issue to cause Ghostscript to crash, resulting in a denial of service (CVE-2025-7462) It was discovered that Ghostscript incorrectly handled wr…
first Sep 29, 2025 -
High max 8.2USN-7744-1 7 CVEs
qemu vulnerabilities
It was discovered that QEMU incorrectly handled certain virtio devices. A privileged guest attacker could use this issue to cause QEMU to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and …
first Sep 11, 2025 -
Low max 3.7USN-7971-1 1 CVE
glib2.0 vulnerability
It was discovered that GLib incorrectly handled the buffered input stream API. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Jan 21, 2026 -
Critical max 10.0USN-7962-1 1 CVE
cpp-httplib vulnerability
It was discovered that cpp-httplib did not correctly handle HTTP headers. A remote attacker could possibly use this issue to bypass authorization and impersonate users.
first Jan 14, 2026 -
High max 7.5USN-7932-1 1 CVE
libsoup3 vulnerability
It was discovered libsoup incorrectly handled memory when handling specific HTTP/2 read and cancel sequences. An attacker could possibly use this issue to cause a denial of service.
first Dec 15, 2025 -
Medium max 6.3USN-7951-1 1 CVE
python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, python3.14 vulnerability
It was discovered that Python's http.client did not properly handle the Content-Length header in HTTP responses. A malicious server could exploit this to cause Python to allocate excessive memory, leading to a denial of service.
first Jan 12, 2026 -
Medium max 4.5USN-7949-1 1 CVE
libsodium vulnerability
It was discovered that Sodium incorrectly handled the elliptic curve point validity check in certain atypical use cases. This could result in invalid points being used, contrary to expectations.
first Jan 8, 2026 -
High max 8.9USN-7927-1 2 CVEs
python-urllib3 vulnerabilities
Illia Volochii discovered that urllib3 did not limit the steps in a decompression chain. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. (CVE-2025-66418) Rui Xi discovered that urllib3 incorr…
first Dec 11, 2025 -
High max 8.1USN-4430-1 4 CVEs
pillow vulnerabilities
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted image file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service.
first Jul 22, 2020 -
Medium max 5.7USN-7929-1 1 CVE
usbmuxd vulnerability
It was discovered that usbmuxd incorrectly handled certain paths received with the SavePairRecord command. A local attacker could possibly use this issue to delete and write files named *.plist in arbitrary locations.
first Dec 15, 2025 -
Medium max 6.2USN-7923-1 1 CVE
qtbase-opensource-src vulnerability
It was discovered that Qt did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
first Dec 11, 2025 -
Critical max 9.1USN-7926-1 3 CVEs
keystone vulnerabilities
Kay discovered that OpenStack Keystone incorrectly handled the ec2tokens and s3tokens APIs. A remote attacker could possibly use this issue to obtain unauthorized access and escalate privileges. (CVE-2025-65073) It was discovered that OpenStack Keystone only …
first Dec 11, 2025 -
High max 8.9USN-7927-3 1 CVE
python-urllib3 regression
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471 introduced a regression in urllib3 when decompressing zstd data. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Illia Volochii discovered…
first Jan 13, 2026 -
High max 8.9USN-7927-2 1 CVE
python-urllib3 regression
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471 introduced a regression in the zstd decompression component inside urllib3. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Illia Volochii…
first Jan 12, 2026 -
High max 7.5USN-7917-1 2 CVEs
fonttools vulnerabilities
It was discovered that the subsetting module of fontTools was vulnerable to an XML External Entity (XEE) attack. An unauthenticated remote attacker could possibly use this issue to include arbitrary files from the file system or make web requests from the hos…
first Dec 9, 2025 -
Medium max 5.9USN-7908-1 2 CVEs
postgresql-14, postgresql-16, postgresql-17 vulnerabilities
Jelte Fennema-Nio discovered that the PostgreSQL CREATE STATISTICS command did not correctly check for schema CREATE privileges. An authenticated attacker could possibly use this issue to create a denial of service against other CREATE STATISTICS users. (CVE-…
first Dec 3, 2025 -
High max 8.1USN-7913-1 3 CVEs
mame vulnerabilities
It was discovered that the stb library, included in MAME, had a heap-based buffer overflow. An attacker could possibly use this issue to crash the program or execute arbitrary code. (CVE-2018-16981) It was discovered that the tinyexr library, included in MAME…
first Dec 4, 2025 -
High max 7.5
h2o vulnerability
It was discovered that H2O exhibited poor server resource management in its HTTP/2 protocol. An attacker could possibly use this issue to cause H2O to crash, resulting in a denial of service.
first Nov 26, 2025 -
High max 7.5USN-7902-1 3 CVEs
openjdk-25-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 25 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2025-53…
first Dec 1, 2025 -
Critical max 10.0USN-7893-1 5 CVEs
valkey vulnerabilities
Benny Isaacs, Nir Brakha, and Sagi Tzadik discovered that Valkey incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a use-after-free condition, and potentially achieve remote code execution o…
first Nov 26, 2025 -
Medium max 4.7USN-7905-1 1 CVE
kdeconnect vulnerability
It was discovered that KDE Connect incorrectly handled device IDs. An attacker could possibly use this issue to bypass authentication and connect an unpaired device.
first Dec 3, 2025 -
High max 7.5USN-7888-1 6 CVEs
mupdf vulnerabilities
It was discovered that MuPDF could be made to divide by zero. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-51103, CVE-2023-51104, CVE-2023-51105, CVE-2023-51106) It was discovered that MuPDF incorrectly handled memory unde…
first Nov 25, 2025 -
High max 7.5USN-7900-1 2 CVEs
openjdk-17-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 17 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2025-53…
first Dec 1, 2025 -
High max 7.5USN-7901-1 3 CVEs
openjdk-21-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 21 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2025-53…
first Dec 1, 2025 -
High max 7.5USN-7883-1 2 CVEs
openjdk-17 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 17 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2025-530…
first Nov 24, 2025 -
High max 7.5USN-7884-1 3 CVEs
openjdk-25 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 25 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2025-530…
first Nov 24, 2025 -
High max 7.5USN-7952-1 2 CVEs
libheif vulnerabilities
It was discovered that libheif did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-25269) Aldo …
first Jan 12, 2026 -
Medium max 5.3USN-7871-1 1 CVE
ffmpeg vulnerability
It was discovered that FFmpeg incorrectly handled memory allocation in the ALS audio decoder. If a user was tricked into loading a crafted media file, a remote attacker could possibly use this issue to make FFmpeg crash, resulting in a denial of service.
first Nov 16, 2025 -
UnscoredUSN-4494-1 1 CVE
gupnp vulnerability
It was discovered that GUPnP incorrectly handled certain subscription requests. A remote attacker could possibly use this issue to exfiltrate data or use GUPnP to perform DDoS attacks.
first Sep 15, 2020 -
High max 7.5USN-7882-1 2 CVEs
openjdk-lts vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 11 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2025-530…
first Nov 24, 2025 -
Critical max 9.8USN-7872-1 4 CVEs
lasso vulnerabilities
It was discovered that Lasso incorrectly handled certain malformed SAML responses. A remote attacker could possibly use this issue to cause Lasso to crash, resulting in a denial of service. (CVE-2025-46404) It was discovered that Lasso incorrectly handled cer…
first Nov 18, 2025 -
Medium max 5.5USN-7873-1 8 CVEs
mysql-8.0, mysql-8.4 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.44 in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. Ubuntu 25.04 and Ubuntu 25.10 have been updated to MySQL 8.4…
first Nov 19, 2025 -
Medium max 5.7USN-7855-2 1 CVE
unbound regression
USN-7855-1 fixed vulnerabilities in Unbound. It was discovered that the fix for CVE-2025-11411 was incomplete. This update fixes the problem. Original advisory details: Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Unbound incorrectly ha…
first Dec 2, 2025 -
Medium max 4.3USN-7886-2 2 CVEs
python3.13 vulnerabilities
USN-7886-1 fixed vulnerabilities in Python. This update provides the corresponding updates for python3.13 in Ubuntu 25.04 and Ubuntu 25.10. Original advisory details: It was discovered that Python inefficiently handled expanding system environment variables. …
first Nov 26, 2025 -
Medium max 5.5USN-7843-1 1 CVE
netty vulnerability
It was discovered that Netty did not properly handle user input. A remote attacker could possibly use this issue to forge arbitrary emails from a trusted server.
first Oct 28, 2025 -
Medium max 5.5USN-7842-1 1 CVE
radare2 vulnerability
It was discovered that Radare2 conntained a memory leak, resulting in performance degradation. An attacker could possibly use this issue to cause Radare2 to crash, resulting in a denial of service. (CVE-2025-60358)
first Oct 27, 2025 -
High max 8.1USN-7841-1 1 CVE
strongswan vulnerability
Xu Biang discovered that the strongSwan client incorrectly handled EAP-MSCHAPv2 failure requests. If a user or automated system were tricked into connecting to a malicious server, a remote attacker could use this issue to cause strongSwan to crash, resulting …
first Oct 27, 2025 -
High max 7.8USN-7852-1 1 CVE
libxml2 vulnerability
It was discovered that libxslt, used by libxml2, incorrectly handled certain attributes. An attacker could use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. This update adds a fix to libxml2 to mitigate the…
first Oct 30, 2025 -
Medium max 5.7USN-7855-1 1 CVE
unbound vulnerability
Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Unbound incorrectly handled certain promiscuous NS RRSets. A remote attacker could possibly use this issue to perform a domain hijack attack.
first Nov 4, 2025 -
Medium max 5.9USN-7838-1 1 CVE
fetchmail vulnerability
It was discovered that the fetchmail SMTP client incorrectly handled certain status code messages. An attacker controlling a malicious server could possibly use this issue to cause fetchmail to crash, resulting in a denial of service.
first Oct 23, 2025