8,437 results · Feed
-
High max 8.6USN-7674-1 5 CVEs
openjdk-lts vulnerabilities
It was discovered that the 2D component of OpenJDK 11 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-30749, CVE-2025-50106) VMashroor Hasa…
first Jul 28, 2025 -
High max 8.7USN-7666-1 1 CVE
unbound vulnerabilities
Xiang Li discovered that Unbound incorrectly handled EDNS Client Subnet (ECS) in certain configurations. A remote attacker could possibly use this issue to perform a cache poisoning attack called Rebirthday Attack.
first Jul 22, 2025 -
High max 8.6USN-7661-1 5 CVEs
gobgp vulnerabilities
It was discovered that GoBGP did not properly manage memory under certain circumstances, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 22.04 LTS and Ubunt…
first Jul 22, 2025 -
Medium max 5.9USN-7678-1 1 CVE
perl vulnerability
It was discovered that Perl threads incorrectly handled certain file operations. A local attacker could possibly use this issue to load code or access files from unexpected locations.
first Jul 29, 2025 -
Medium max 6.5USN-7670-1 2 CVEs
iputils vulnerability
It was discovered that the iputils ping utility incorrectly handled certain ICMP Echo Reply packets. A remote attacker could possibly use this issue to cause iputils to consume resources, leading to a denial of service.
first Jul 24, 2025 -
High max 8.1USN-7657-1 3 CVEs
jq vulnerabilities
It was discovered that jq incorrectly handled certain values when parsing JSON data. A remote attacker could possibly use this issue to cause jq to crash, resulting in a denial of service. (CVE-2024-23337) It was discovered that jq incorrectly handled NaN val…
first Jul 21, 2025 -
Medium max 4.8USN-7656-1 2 CVEs
erlang vulnerabilities
It was discovered that Erlang OTP’s SSH module incorrectly enforced strict KEX handshake hardening measures. A remote attacker able to intercept communications could possibly use this issue to insert optional messages into connections during the handshake. (C…
first Jul 21, 2025 -
Medium max 5.9USN-7648-1 3 CVEs
php8.1, php8.3, php8.4 vulnerabilities
It was discovered that PHP incorrectly handled certain hostnames containing null characters. A remote attacker could possibly use this issue to bypass certain hostname validation checks. (CVE-2025-1220) It was discovered that PHP incorrectly handled the pgsql…
first Jul 17, 2025 -
High max 7.5USN-7642-1 7 CVEs
python-aiohttp vulnerabilities
Ben Kallus discovered that AIOHTTP did not correctly parse HTTP headers. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-47627) Ivan Novikov discovered tha…
first Jul 17, 2025 -
Medium max 6.5USN-7635-1 4 CVEs
gnutls28 vulnerabilities
It was discovered that GnuTLS incorrectly handled exporting Subject Alternative Name (SAN) entries containing an otherName. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. …
first Jul 14, 2025 -
Low max 3.6USN-7638-1 3 CVEs
libmobi vulnerabilities
It was discovered that Libmobi did not correctly handle certain memory operations, which could lead to a buffer overflow. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-1907, CVE-2022-1908) It was discovered…
first Jul 16, 2025 -
Critical max 9.3
roundcube vulnerability
It was discovered that Roundcube Webmail incorrectly handled sanitization in the message_body function. A remote attacker could possibly use this issue to send and receive emails as another user.
first Jul 14, 2025 -
Critical max 9.1USN-7632-1 1 CVE
libyaml-libyaml-perl vulnerability
It was discovered that YAML-LibYAML incorrectly handled certain file names. An attacker could possibly use this issue to overwrite arbitrary files.
first Jul 9, 2025 -
Critical max 9.1USN-7633-1 4 CVEs
nix vulnerabilities
Linus Heckemann discovered that Nix did not correctly handle certain binaries. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-38531) Pierre-Etienne Meunier discovered that Nix did not correctly handle TLS certificates. A remote…
first Jul 14, 2025 -
High max 8.4USN-7613-1 3 CVEs
mongo-c-driver vulnerabilities
Karman Liu discovered that mongo-c-driver did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-6381) Karman Liu discovered that mongo-c-driver did not c…
first Jul 2, 2025 -
Medium max 6.5USN-7612-1 5 CVEs
python-flask-cors vulnerabilities
It was discovered that Flask-CORS did not correctly handle certain regular expressions. A remote attacker could possibly use this issue to leak sensitive information or bypass authentication mechanisms. (CVE-2024-6839) It was discovered that Flask-CORS allowe…
first Jul 2, 2025 -
High max 8.8USN-7620-1 1 CVE
File::Find::Rule vulnerability
Kevin Ryde discovered that File::Find::Rule incorrectly handled certain file names. An attacker could possibly use this issue to execute arbitrary code.
first Jul 7, 2025 -
High max 7.5USN-7586-1 5 CVEs
botan vulnerabilities
It was discovered that Botan could have compiler dependent operations induced under certain circumstances. An attacker could possibly use this issue to cause undefined behavior. (CVE-2024-50382, CVE-2024-50383) Bing Shi discovered that Botan did not limit the…
first Jun 23, 2025 -
UnscoredUSN-7576-1 1 CVE
dwarfutils vulnerabilities
It was discovered that dwarfutils did not correctly certain memory operations, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
first Jun 18, 2025 -
Medium max 6.8USN-7574-1 5 CVEs
golang-1.22 vulnerabilities
Kyle Seely discovered that the Go net/http module did not properly handle sensitive headers during repeated redirects. An attacker could possibly use this issue to obtain sensitive information. (CVE-2024-45336) Juho Forsén discovered that the Go crypto/x509 m…
first Jun 18, 2025 -
High max 7.8USN-7573-1 6 CVEs
xorg-server, xwayland vulnerabilities
Nils Emmerich discovered that the X.Org X Server incorrectly handled certain memory operations. An attacker could use these issues to cause the X Server to crash, leading to a denial of service, obtain sensitive information, or possibly execute arbitrary code.
first Jun 17, 2025 -
High max 7.8USN-7580-1 1 CVE
pam vulnerability
Olivier BAL-PETRE discovered that the PAM pam_namespace module incorrectly handled user-controlled paths. In environments where pam_namespace is used, a local attacker could possibly use this issue to escalate their privileges to root.
first Jun 18, 2025 -
UnscoredUSN-7579-1 3 CVEs
godot vulnerabilities
It was discovered that the Godot Engine did not properly handle certain malformed WebM media files. If the Godot Engine opened a specially crafted WebM file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2019-2126…
first Jun 18, 2025 -
Medium max 5.9USN-7570-1 2 CVEs
python3.13, python3.12, python3.11, python3.10, python3.9, python3.8, python3.7, python3.6 vulnerabilities
It was discovered that Python incorrectly handled certain unicode characters during decoding. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-4516) It was discovered that Python incorrectly handled unicode encoding of email h…
first Jun 16, 2025 -
UnscoredUSN-7575-1 3 CVEs
mujs vulnerabilities
It was discovered that MuJS did not correctly handle try/finally statements, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-45005) Han Zheng discovered that Mu…
first Jun 18, 2025 -
Medium max 6.5USN-7572-1 4 CVEs
node-katex vulnerabilities
Juho Forsén discovered that KaTeX did not correctly handle certain inputs, which could lead to an infinite loop. If a user or application were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of servic…
first Jun 17, 2025 -
High max 8.6USN-7562-1 8 CVEs
tomcat vulnerabilities
It was discovered that Tomcat did not include the secure attribute for session cookies when using the RemoteIpFilter with requests from a reverse proxy. An attacker could possibly use this issue to leak sensitive information. This issue was fixed for tomcat8 …
first Jun 9, 2025 -
High max 8.8USN-7558-1 3 CVEs
gst-plugins-bad1.0 vulnerabilities
It was discovered that the AV1 codec plugin in GStreamer could be made to write out of bounds. An attacker could possibly use this issue to cause applications using the plugin to crash, resulting in a denial of service, or possibly execute arbitrary code. Thi…
first Jun 5, 2025 -
Medium max 4.0USN-7555-1 1 CVE
python-django vulnerability
It was discovered that Django incorrectly handled certain unescaped request paths. An attacker could possibly use this issue to perform a log injection.
first Jun 4, 2025 -
High max 8.6USN-7549-1 1 CVE
php-twig vulnerability
It was discovered that Twig did not correctly handle securing user input. An attacker could possibly use this issue to cause Twig to expose sensitive information if it opened a specially crafted file. (CVE-2024-45411)
first Jun 2, 2025 -
High max 7.5USN-7547-1 1 CVE
python-tornado vulnerability
It was discovered that Tornado inefficiently handled requests when parsing certain form data. An attacker could possibly use this issue to increase resource utilization leading to a denial of service. This issue was only addressed in Ubuntu 24.04 LTS and Ubun…
first Jun 2, 2025 -
High max 8.2USN-7444-1 8 CVEs
matrix-synapse vulnerabilities
It was discovered that Synapse network policies could be bypassed via specially crafted URLs. An attacker could possibly use this issue to bypass authentication mechanisms. (CVE-2023-32683) It was discovered that Synapse exposed cached device information. An …
first Apr 22, 2025 -
Medium max 6.5USN-7418-1 8 CVEs
ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerabilities
It was discovered that Ruby incorrectly handled parsing of an XML document that has specific XML characters in an attribute value using REXML gem. An attacker could use this issue to cause Ruby to crash, resulting in a denial of service. This issue only affec…
first Apr 7, 2025 -
High max 7.1USN-7346-3 11 CVEs
opensc vulnerabilities
USN-7346-1 fixed vulnerabilities in OpenSC. The update introduced a regression which broke smartcard based authentication. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenSC did not corr…
first Apr 9, 2025 -
High max 7.5USN-7297-1 3 CVEs
ProFTPD vulnerabilities
Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that the transport protocol implementation in ProFTPD had weak integrity checks. An attacker could use this vulnerability to bypass security features like encryption and integrity checks. (CVE-2023-…
first Feb 25, 2025 -
Medium max 4.3USN-7433-1 1 CVE
graphicsmagick vulnerabilities
It was discovered that GraphicsMagick did not properly limit image dimensions, which could lead to excessive memory consumption. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-27795) It was discovered that GraphicsMagick did…
first Apr 14, 2025 -
High max 7.5USN-7314-1 4 CVEs
krb5 vulnerabilities
It was discovered that Kerberos incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause Kerberos to consume memory,leading to a denial of service. (CVE-2024-26458, CVE-2024-26461) It was discovered that Kerberos…
first Mar 3, 2025 -
High max 8.8USN-7476-1 6 CVEs
python-scrapy vulnerabilities
It was discovered that Scrapy improperly exposed HTTP authentication credentials to request targets, including during redirects. An attacker could use this issue to gain unauthorized access to user accounts. This issue only affected Ubuntu 18.04 LTS and Ubunt…
first May 5, 2025 -
Critical max 9.8USN-7318-1 8 CVEs
spip vulnerabilities
It was discovered that svg-sanitizer, vendored in SPIP, did not properly sanitize SVG/XML content. An attacker could possibly use this issue to perform cross site scripting. This issue only affected Ubuntu 24.10. (CVE-2022-23638) It was discovered that SPIP d…
first Mar 4, 2025 -
Critical max 10.0
Tomcat vulnerability
It was discovered that Apache Tomcat incorrectly implemented partial PUT functionality by replacing path separators with dots in temporary files. A remote attacker could possibly use this issue to access sensitive files, inject malicious content, or execute r…
first May 21, 2025