EUVD-2019-6035

Malware in sbrugna...

EUVD-2021-15045

Malware in sbrugna...

EUVD-2025-32016

Malicious code in bioql PyPI...

CVE-2025-57275

Storage Performance Development Kit SPDK 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf...

CVE-2025-57275: Buffer Copy without Checking Size of Input

Storage Performance Development Kit SPDK 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf...

CVE-2025-57275

The Storage Performance Development Kit (SPDK) 25.05 is affected by a Buffer Overflow vulnerability within the NVMe-oF target component located in lib/nvmf. The root cause is a classic buffer overflow resulting from copying data without checking the input size (CWE-120 ). This vulnerability has a...

CVE-2021-28361

An issue was discovered in Storage Performance Development Kit SPDK before 20.01.01. If a PDU is sent to the iSCSI target with a zero length but data is expected, the iSCSI target can crash with a NULL pointer dereference...

CVE-2021-28361

CVE-2021-28361 affects Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with zero length (but data is expected), the iSCSI target can crash due to a NULL pointer dereference, impacting availability (CVSS v3.1: High). The issue is tied to SPDK’s iSCS...

CVE-2021-28361

An issue was discovered in Storage Performance Development Kit SPDK before 20.01.01. If a PDU is sent to the iSCSI target with a zero length but data is expected, the iSCSI target can crash with a NULL pointer dereference...

PT-2021-17848

Name of the Vulnerable Software and Affected Versions: Storage Performance Development Kit SPDK versions prior to 20.01.01 Description: An issue was discovered in the Storage Performance Development Kit SPDK. If a PDU is sent to the iSCSI target with a zero length but data is expected, the iSCSI...

CVE-2021-28361: NULL Pointer Dereference

An issue was discovered in Storage Performance Development Kit SPDK before 20.01.01. If a PDU is sent to the iSCSI target with a zero length but data is expected, the iSCSI target can crash with a NULL pointer dereference...

CVE-2019-14940

In Storage Performance Development Kit SPDK before 19.07, a user of a vhost can cause a crash if the target is sent invalid input...

CVE-2019-14940

In Storage Performance Development Kit SPDK before 19.07, a user of a vhost can cause a crash if the target is sent invalid input...

CVE-2019-14940

CVE-2019-14940 affects SPDK prior to 19.07, where a user of a vhost can cause a crash by sending invalid input to the target. The root cause is an input validation issue in SPDK’s vhost handling, leading to an availability impact (crash) with network-accessible exposure implied by the CVSS data. ...

PT-2019-13880

Name of the Vulnerable Software and Affected Versions Storage Performance Development Kit SPDK versions prior to 19.07 Description A user of a vhost can cause a crash if the target is sent invalid input. Recommendations For versions prior to 19.07, update to version 19.07 or later to resolve the...

CVE-2019-14940: Undefined Security Weakness

In Storage Performance Development Kit SPDK before 19.07, a user of a vhost can cause a crash if the target is sent invalid input...

CVE-2019-9547

CVE-2019-9547 affects Storage Performance Development Kit (SPDK) prior to 19.01. A malicious vhost client (e.g., a VM) could craft a circular descriptor chain that the vhost target fails to detect, leading to a partial denial of service in the SPDK vhost target. The underlying issue is insufficie...

PT-2019-19698

Name of the Vulnerable Software and Affected Versions Storage Performance Development Kit SPDK versions prior to 19.01 Description A malicious vhost client could construct a circular descriptor chain, resulting in a partial denial of service in the SPDK vhost target. This occurs because the vhost...

CVE-2019-9547: Excessive Iteration

In Storage Performance Development Kit SPDK before 19.01, a malicious vhost client i.e., virtual machine could carefully construct a circular descriptor chain that would result in a partial denial of service in the SPDK vhost target, because the vhost target did not properly detect such chains...