8,435 results · Feed
-
UnscoredUSN-8176-1 0 CVEs
dotnet8, dotnet9, dotnet10 vulnerabilities
Ludvig Pedersen discovered that the System.Security.Cryptography.Xml library in .NET incorrectly handled certain XML inputs. An attacker could possibly use this issue to consume excessive resources, resulting in a denial of service. (CVE-2026-33116, CVE-2026-…
first Apr 15, 2026 -
UnscoredUSN-8174-1 0 CVEs
libxml-parser-perl vulnerabilities
It was discovered that XML::Parser incorrectly handled certain multi-byte UTF-8 characters. If a user or automated system were tricked into processing specially crafted XML data, a remote attacker could use this issue to cause XML::Parser to crash, resulting …
first Apr 14, 2026 -
UnscoredUSN-8157-1 0 CVEs
squid vulnerabilities
It was discovered that Squid incorrectly handled certain ICP traffic. In environments where ICP support is enabled, a remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or obtain small amounts of sensitive informat…
first Apr 8, 2026 -
UnscoredUSN-8199-1 0 CVEs
glance vulnerabilities
Martin Kaesberger discovered that OpenStack Glance's image processing could return the contents of arbitrary files. An attacker could possibly use this issue to exfiltrate sensitive data. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-20…
first Apr 22, 2026 -
UnscoredUSN-8146-1 0 CVEs
jpeg-xl vulnerability
Daniel Novomeský discovered that libjxl did not properly manage memory when decoding certain files. An attacker could use this issue to cause libjxl to crash, resulting in denial of service, or possibly execute arbitrary code.
first Apr 2, 2026 -
UnscoredUSN-8136-1 0 CVEs
dovecot vulnerabilities
It was discovered that Dovecot incorrectly handled invalid base64 SASL data. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10. (CVE-2025-59028) It was discovered that Dovecot script decode2text.sh i…
first Mar 31, 2026 -
UnscoredUSN-8133-1 0 CVEs
pyjwt vulnerability
It was discovered that PyJWT did not validate the critical header parameter, contrary to the RFC specification expectations. A remote attacker could possibly use this issue to bypass certain authentication checks and restrictions.
first Mar 30, 2026 -
UnscoredUSN-8131-1 0 CVEs
gst-plugins-good1.0 vulnerabilities
It was discovered that GStreamer Good Plugins incorrectly handled certain X-QDM RTP payloads. A remote attacker could use this issue to cause GStreamer Good Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Mar 30, 2026 -
UnscoredUSN-8130-3 0 CVEs
gst-plugins-base1.0 vulnerability
USN-8130-1 fixed a vulnerability in GStreamer Base Plugins. This update provides the corresponding update for Ubuntu 16.04 LTS. Original advisory details: It was discovered that GStreamer Base Plugins incorrectly handled certain AVI media files. A remote atta…
first Jun 10, 2026 -
UnscoredUSN-8130-2 0 CVEs
gst-plugins-base1.0 vulnerability
USN-8130-1 fixed a vulnerability in GStreamer Base Plugins. This update provides the corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that GStreamer Base Plugins incorrectly handled certain AVI media…
first Jun 2, 2026 -
UnscoredUSN-8124-1 0 CVEs
bind9 vulnerabilities
Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker could possibly use this issue to cause excessive NSEC3 iterations, consuming CPU resources, and leading to a denial of service. (CVE-2026-1519) Vitaly Sim…
first Mar 25, 2026 -
UnscoredUSN-8115-1 0 CVEs
pyopenssl vulnerabilities
It was discovered that pyOpenSSL incorrectly handled exceptions in the tlsext_servername callback. This could result in connections being accepted after an exception, contrary to expectations. (CVE-2026-27448) It was discovered that pyOpenSSL incorrectly hand…
first Mar 23, 2026 -
UnscoredUSN-8090-2 0 CVEs
openssh vulnerabilities
USN-8090-1 fixed vulnerabilities in OpenSSH. This update provides the corresponding updates for Ubuntu 20.04 LTS. Original advisory details: Jeremy Brown discovered that the OpenSSH GSSAPI Key Exchange incorrectly handled disconnecting clients. In non-default…
first Mar 12, 2026 -
UnscoredUSN-8106-1 0 CVEs
valkey vulnerabilities
It was discovered that Valkey incorrectly handled errors for lua scripts. An attacker could possibly use this issue to inject arbitrary information into the response stream for other clients. (CVE-2025-67733) It was discovered that Valkey incorrectly handled …
first Mar 18, 2026 -
UnscoredUSN-8085-1 0 CVEs
dotnet8, dotnet9, dotnet10 vulnerabilities
It was discovered that the .NET Microsoft.Bcl.Memory NuGet package did not properly handle certain malformed Base64Url encoded input. An attacker could possibly use this issue to cause .NET to crash, resulting in a denial of service. This issue only affected …
first Mar 11, 2026 -
UnscoredUSN-8072-1 0 CVEs
postgresql-14, postgresql-16, postgresql-17 vulnerabilities
Altan Birler discovered that PostgreSQL incorrectly validated oidvector types. An attacker could possibly use this issue to obtain a few bytes of sensitive information. (CVE-2026-2003) Daniel Firer discovered that PostgreSQL incorrectly validated input in the…
first Mar 4, 2026 -
UnscoredUSN-8066-1 0 CVEs
ruby-rack vulnerabilities
Minh Pham Quang discovered that Rack did not correctly handle parsing certain paths, which could lead to a path traversal attack. An attacker could possibly use this issue to leak sensitive information. (CVE-2026-22860) Ali Firas discovered that Rack did not …
first Feb 26, 2026 -
UnscoredUSN-8063-2 0 CVEs
protobuf vulnerability
USN-8063-1 fixed a vulnerability in Protocol Buffers. This update provides the corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Protocol Buffers incorrectly handled recursion when the Python goo…
first May 26, 2026 -
UnscoredUSN-8049-1 0 CVEs
nova vulnerability
Dan Smith discovered that Nova incorrectly called qemu-img without a format restriction when resizing disks. An attacker could possibly use this issue to destroy data on the host system.
first Feb 17, 2026 -
UnscoredUSN-8063-1 0 CVEs
protobuf vulnerability
It was discovered that Protocol Buffers incorrectly handled recursion when the Python google.protobuf.json_format.ParseDict() function is being used. An attacker could possibly use this issue to cause Protocol Buffers to consume resources, resulting in a deni…
first Feb 25, 2026 -
UnscoredUSN-8171-1 0 CVEs
vim vulnerabilities
Nathan Mills discovered that Vim could crash when parsing certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10 (CVE-2026-32249) It was discovered that V…
first Apr 13, 2026 -
UnscoredUSN-8130-1 0 CVEs
gst-plugins-base1.0 vulnerability
It was discovered that GStreamer Base Plugins incorrectly handled certain AVI media files. A remote attacker could use this issue to cause GStreamer Base Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Mar 30, 2026 -
UnscoredUSN-8057-1 0 CVEs
gimp vulnerabilities
Hanno Böck discovered that GIMP allocated FLI images using only the information present in the file header, which allowed for a maliciously- crafted file to cause out-of-bounds writes. An attacker could possibly use this issue to cause a denial of service or …
first Feb 23, 2026 -
UnscoredUSN-8053-1 0 CVEs
libvpx vulnerability
It was discovered that libvpx did not properly handle certain malformed media files. If an application using libvpx opened a specially crafted file, a remote attacker could cause a denial of service, or possibly execute arbitrary code.
first Feb 19, 2026 -
UnscoredUSN-8090-1 0 CVEs
openssh vulnerabilities
Jeremy Brown discovered that the OpenSSH GSSAPI Key Exchange incorrectly handled disconnecting clients. In non-default configurations where the GSSAPIKeyExchange setting is enabled, a remote attacker could use this issue to cause OpenSSH to crash, resulting i…
first Mar 12, 2026 -
UnscoredUSN-8032-1 0 CVEs
python-aiohttp vulnerabilities
Charles Chan discovered that AIOHTTP incorrectly handled the decompression of compressed requests. A remote attacker could possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 25.10. (CVE-2025-69223) Thomas Rinsma disc…
first Feb 13, 2026 -
UnscoredUSN-8010-1 0 CVEs
python-pip vulnerabilities
Several security issues were discovered in the libraries bundled in pip. An attacker could possibly use these issues to perform a variety of attacks, such as denial of service or arbitrary code execution.
first Feb 4, 2026 -
UnscoredUSN-8009-1 0 CVEs
python-django vulnerabilities
It was discovered that Django exposed timing information when checking passwords. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-13473) Jiyong Yang discovered that Django incorrectly handled malformed requests with duplic…
first Feb 3, 2026 -
UnscoredUSN-8008-1 0 CVEs
python-keystonemiddleware vulnerability
Grzegorz Grasza discovered that the Keystone Middleware incorrectly sanitized authentication headers before processing OAuth 2.0 tokens. An attacker could possibly use this issue to escalate privileges or impersonate other users.
first Feb 3, 2026 -
UnscoredUSN-8003-1 0 CVEs
openjdk-21-crac vulnerabilities
It was discovered that the RMI component of CRaC JDK 21 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive inf…
first Feb 2, 2026 -
UnscoredUSN-8002-1 0 CVEs
openjdk-21 vulnerabilities
It was discovered that the RMI component of OpenJDK 21 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive info…
first Feb 2, 2026 -
UnscoredUSN-8001-1 0 CVEs
openjdk-lts vulnerabilities
It was discovered that the RMI component of OpenJDK 11 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive info…
first Feb 2, 2026 -
UnscoredUSN-8000-1 0 CVEs
openjdk-8 vulnerabilities
It was discovered that the RMI component of OpenJDK 8 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive infor…
first Feb 2, 2026 -
UnscoredUSN-7998-1 0 CVEs
openjdk-17 vulnerabilities
It was discovered that the RMI component of OpenJDK 17 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive info…
first Feb 3, 2026 -
UnscoredUSN-7997-1 0 CVEs
openjdk-17-crac vulnerabilities
It was discovered that the RMI component of CRaC JDK 17 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive inf…
first Feb 2, 2026 -
UnscoredUSN-7995-1 0 CVEs
openjdk-25 vulnerabilities
It was discovered that the RMI component of OpenJDK 25 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive info…
first Feb 2, 2026 -
UnscoredUSN-7991-1 0 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass secu…
first Feb 2, 2026 -
UnscoredUSN-7996-1 0 CVEs
openjdk-25-crac vulnerabilities
It was discovered that the RMI component of CRaC JDK 25 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive inf…
first Feb 2, 2026 -
UnscoredUSN-7975-1 0 CVEs
pyasn1 vulnerability
It was discovered that pyasn1 incorrectly handled malformed RELATIVE-OIDs with excessive continuation octets. An attacker could possibly use this issue to cause pyasn1 to consume memory, leading to a denial of service.
first Jan 22, 2026 -
UnscoredUSN-7955-2 0 CVEs
python-urllib3 regression
USN-7955-1 fixed vulnerabilities in urllib3. The update introduced a regression in response streaming on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered tha…
first Jan 19, 2026