8,464 results · Feed
-
UnscoredUSN-8158-1 1 CVE
dogtag-pki vulnerability
Fraser Tweedale and Geetika Kapoor discovered that Dogtag PKI could renew a certificate without proper authentication. An attacker could possibly use this to repeatedly renew a compromised certificate and maintain unauthorized access to a system or resource.
first Apr 8, 2026 -
High max 7.5
mongodb vulnerability
It was discovered that MongoDB incorrectly handled length parameters in zlib-compressed network messages prior to authentication. An unauthenticated remote attacker could possibly use this issue to cause MongoDB to allocate an oversized memory buffer, resulti…
first Apr 9, 2026 -
Medium max 5.6USN-8153-1 2 CVEs
salt vulnerabilities
Zach Malone discovered that Salt did not properly handle permissions to cache data. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2015-8034) Dylan Frese discovered that Salt incorrectly allowed users to specify PAM servi…
first Apr 7, 2026 -
UnscoredUSN-8092-1 0 CVEs
sudo vulnerability
It was discovered that Sudo incorrectly checked return codes when dropping privileges to run the mailer. A local attacker could possibly use this issue to escalate privileges.
first Mar 12, 2026 -
UnscoredUSN-8121-1 0 CVEs
linux-aws-fips vulnerability
Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of se…
first Mar 24, 2026 -
High max 7.5USN-8118-1 5 CVEs
rust-sized-chunks vulnerabilities
Yechan Bae discovered that sized-chunks did not properly validate array size when constructing Chunk. An attacker could possibly use these issues to cause out-of-bounds access, leading to memory corruption or undefined behavior. (CVE-2020-25791, CVE-2020-2579…
first Mar 23, 2026 -
UnscoredUSN-8111-1 0 CVEs
glance vulnerability
It was discovered that OpenStack Glance was incorrectly validating the IP addresses and the redirect destination URL when downloading or importing images from a remote source. An attacker could possibly use this issue to perform server-side request forgery an…
first Mar 19, 2026 -
UnscoredUSN-8097-2 0 CVEs
roundcube regression
USN-8097-1 fixed a vulnerability in roundcube. The update caused a regression affecting the HTML sanitizer, preventing Roundcube from rendering any email message body. This update fixes the problem. We apologize for the inconvenience. Original advisory detail…
first Mar 18, 2026 -
UnscoredUSN-8087-2 0 CVEs
python-cryptography regression
USN-8087-1 fixed a vulnerability in python-cryptography. The update caused a regression when using ECC algorithms with certain software. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that pytho…
first Mar 16, 2026 -
High max 8.6USN-8083-1 1 CVE
python-geopandas vulnerability
It was discovered that GeoPandas incorrectly handled certain input. An attacker could possibly use this issue to perform SQL injection attacks.
first Mar 11, 2026 -
High max 7.8USN-8079-1 1 CVE
less vulnerability
It was discovered that less incorrectly handled certain file names. An attacker could possibly use this issue to cause a denial of service or execute arbitrary commands.
first Mar 5, 2026 -
UnscoredUSN-5376-6 0 CVEs
git regression
USN-5376-4 fixed a regression in Git. This update provides the corresponding update for Ubuntu 18.04 LTS. We apologize for the inconvenience. Original advisory details: 俞晨东 discovered that Git incorrectly handled certain repository paths in platforms with mul…
first Mar 2, 2026 -
UnscoredUSN-5376-5 0 CVEs
git regression
USN-5376-4 fixed a regression in Git. The update introduced a regression when specifying configuration includes due to additional restrictions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: 俞晨东 discovered that G…
first Feb 27, 2026 -
UnscoredUSN-5376-4 0 CVEs
git regression
USN-5376-1 fixed a vulnerability in Git. It was discovered that the safety checks introduced in the update were not able to be set using the command line, contrary to expectations. This update fixes the problem. We apologize for the inconvenience. Original ad…
first Feb 25, 2026 -
Critical max 9.8USN-7984-1 4 CVEs
pagure vulnerabilities
Thomas Chauchefoin discovered that Pagure incorrectly handled symbolic links in Git repositories. A remote attacker could possibly use this issue to cause Pagure to expose files outside the intended repository boundaries. (CVE-2024-4981) Thomas Chauchefoin di…
first Jan 29, 2026 -
Critical max 9.8
inetutils vulnerability
Kyu Neushwaistein discovered that telnetd in Inetutils incorrectly handled certain environment variables. A remote attacker could use this issue to bypass authentication and open a session as an administrator.
first Feb 2, 2026 -
High max 8.6USN-7979-1 1 CVE
jaraco.context vulnerability
It was discovered that jaraco.context incorrectly handled certain zip file paths. An attacker could possibly use this issue to extract arbitrary files outside of the intented extraction directory.
first Jan 27, 2026 -
Medium max 4.6USN-7898-1 1 CVE
openvpn vulnerability
Joshua Rogers discovered that OpenVPN incorrectly handled HMAC verification checks. A remote attacker could possibly use this issue to bypass source IP address validation.
first Nov 27, 2025 -
UnscoredUSN-7894-2 0 CVEs
edk2 regression
USN-7894-1 fixed vulnerabilities in EDK II. The update introduced a regression in the UEFI network boot. This update reverts the corresponding fixes for CVE-2023-45236 and CVE-2023-45237 pending further investigation. We apologize for the inconvenience. Origi…
first Nov 28, 2025 -
UnscoredUSN-7867-1 0 CVEs
rust-sudo-rs vulnerabilities
It was discovered that sudo-rs incorrectly handled passwords when timeouts occurred and the pwfeedback default was not set. This could result in a partially typed password being output to standard input, contrary to expectations. It was discovered that sudo-r…
first Nov 10, 2025 -
Critical max 9.1USN-7859-1 1 CVE
python-django vulnerabilities
It was discovered that Django incorrectly handled certain characters in queries. An attacker could possibly use this issue to execute arbitrary SQL commands.
first Nov 5, 2025 -
UnscoredUSN-7857-1 0 CVEs
keystone vulnerability
Kay discovered that OpenStack Keystone incorrectly handled the ec2tokens and s3tokens APIs. A remote attacker could possibly use this issue to obtain unauthorized access and escalate privileges.
first Nov 4, 2025 -
UnscoredUSN-7851-2 0 CVEs
runc-app, runc-stable regression
USN-7851-1 fixed vulnerabilities in runC. The introduction of a new upstream release has caused regressions in runc-app and runc-stable. This update fixes the problem. Original advisory details: Lei Wang and Li Fubang discovered that runC incorrectly handled …
first Nov 24, 2025 -
High max 8.4USN-7851-1 3 CVEs
runc-app, runc-stable vulnerabilities
Lei Wang and Li Fubang discovered that runC incorrectly handled masked paths. An attacker could possibly replace a container's /dev/null with a symlink to some other procfs file and possibly escape a container. (CVE-2025-31133) Lei Wang and Li Fubang discover…
first Nov 4, 2025 -
High max 7.3USN-7806-1 1 CVE
pam-u2f vulnerability
It was discovered that PAM/U2F could allow for authentication bypass in some configurations. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service.
first Oct 6, 2025 -
High max 7.5USN-7805-1 1 CVE
haproxy vulnerability
Oula Kivalo discovered that HAProxy incorrectly handled parsing certain json numbers. A remote attacker could possibly use this issue to cause HAProxy to crash, resulting in a denial of service.
first Oct 6, 2025 -
Medium max 4.0USN-7804-1 1 CVE
squid vulnerability
It was discovered that Squid incorrectly handled certain long SNMP OIDs. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service.
first Oct 6, 2025 -
High max 7.5USN-7784-1 1 CVE
ruby-rack vulnerability
It was discovered that Rack incorrectly handled limiting the amount of parameters. An attacker could possibly use this issue to bypass the params_limit value, leading to a denial of service.
first Sep 29, 2025 -
Critical max 9.1USN-7778-1 1 CVE
node-sha.js vulnerability
Nikita Skovoroda discovered that sha.js did not properly handle certain inputs. An attacker could possibly use this issue to manipulate the internal state of hash functions, resulting in hash collisions, denial of service, or other unspecified impact.
first Sep 25, 2025 -
UnscoredUSN-7758-4 0 CVEs
linux-oracle-6.8 vulnerability
It was discovered that the AF_UNIX socket garbage collection implementation in Ubuntu Noble's 6.8 kernel did not properly handle out-of-band (OOB) messages, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service (sy…
first Sep 19, 2025 -
UnscoredUSN-7758-3 0 CVEs
linux-realtime vulnerability
It was discovered that the AF_UNIX socket garbage collection implementation in Ubuntu Noble's 6.8 kernel did not properly handle out-of-band (OOB) messages, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service (sy…
first Sep 19, 2025 -
UnscoredUSN-7758-2 0 CVEs
linux-ibm, linux-ibm-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-raspi vulnerability
It was discovered that the AF_UNIX socket garbage collection implementation in Ubuntu Noble's 6.8 kernel did not properly handle out-of-band (OOB) messages, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service (sy…
first Sep 19, 2025 -
Medium max 4.1USN-7748-1 2 CVEs
vim vulnerabilities
It was discovered that Vim incorrectly handled file extraction when opening maliciously crafted zip or tar archives. An attacker could possibly use this issue to create or overwrite files on the system and execute arbitrary code.
first Sep 15, 2025 -
Critical max 9.1USN-7746-1 1 CVE
node-cipher-base vulnerability
Nikita Skovoroda discovered that cipher-base did not properly manage certain inputs. An attacker could possibly use this issue to manipulate the internal state of hash functions, resulting in hash collisions, denial of service, or other unspecified impact.
first Sep 11, 2025 -
High max 7.1USN-7736-1 1 CVE
python-django vulnerability
It was discovered that Django incorrectly handled certain inputs. An attacker could possibly use this issue to perform a SQL injection.
first Sep 3, 2025 -
UnscoredUSN-7731-1 2 CVEs
kmail vulnerabilities
Damian Poddebniak, Christian Dresen, Jens Müller, Fabian Ising, Sebastian Schinzel, Simon Friedberger, Juraj Somorovsky, and Jörg Schwenk discovered that KMail could be made to leak the plaintext of S/MIME encrypted emails when retrieving external content in …
first Sep 2, 2025 -
High max 7.5USN-7693-1 1 CVE
node-qs vulnerability
Nathanael Braun and Johan Brissaud discovered that qs was vulnerable to prototype pollution. A remote attacker could possibly use this issue to cause a denial of service.
first Aug 14, 2025 -
Low max 3.7USN-7689-1 1 CVE
dnsmasq vulnerability
Xu Mingjie discovered that Dnsmasq did not correctly handle certain memory operations. A remote attacker could possibly use this issue to cause a denial of service.
first Aug 11, 2025 -
Critical max 9.3
sudo vulnerabilities
Rich Mirch discovered that Sudo incorrectly handled the host option. In environments where per-host rules are configured in the sudoers file, a local attacker could use this issue to bypass the host restrictions. (CVE-2025-32462) Rich Mirch discovered that Su…
first Jun 30, 2025 -
Medium max 5.3USN-7599-2 1 CVE
python-pip vulnerability
USN-7599-1 fixed vulnerabilities in python-urllib3. This update provides the corresponding update for python-pip for CVE-2025-50181. Original advisory details: Jacob Sandum discovered that urllib3 handled redirects even when they were explicitly disabled whil…
first Jun 26, 2025