CVE-2021-46915

The CVE-2021-46915 issue is in the Linux kernel’s netfilter nft_limit code. nft_limit_init attempted to divide a 64-bit value by a 64-bit expectation but used div_u64 (dividing 64-bit by 32-bit), risking a divide error. The fix changes nft_limit_init to use the correct 64-bit division function (d...

CVE-2024-0057

CVE-2024-0057 is a security feature bypass in components used by .NET Framework-based apps when building X.509 chains. The root cause is a logic flaw that can cause the framework to report a failed chain build but return an incorrect reason code, which may lead an application to treat an untruste...

CVE-2023-46218

CVE-2023-46218 affects curl and stems from a mixed-case domain verification flaw against the PSL. This can let a malicious HTTP server set “super cookies” that may be sent to unrelated origins, exploiting domain comparisons such as domain=co.UK with a curl.co.uk URL. The vulnerability is describe...

CVE-2017-18468

CVE-2017-18468 affects cPanel prior to 62.0.17. The vulnerability arises in the Htaccess::setphppreference API (SEC-232), enabling code execution by demo accounts. No exploitation details are provided in the documents. Affected software: cPanel before 62.0.17. Impact: remote code execution by una...

CVE-2025-67896

Exim vulnerability CVE-2025-67896 affects Exim before 4.99.1 with certain non-default rate-limit configurations, enabling a remote heap-based buffer overflow due to unvalidated casting of database records to internal structures. Fedora advisories indicate fixes in exim-4.99.1-1 (FC42/FC43). Impac...

CVE-2021-46936

CVE-2021-46936 affects the Linux kernel (net: fix use-after-free in tw_timer_handler). The flaw allowed use-after-free on net->mib.net_statistics when destroying a net namespace if inflight time-wait timers exist; it is triggered during path of timer handling and ip/mib teardown. The fix reloc...

CVE-2021-33959

Summary: Multiple sources report a DoS/reflection vulnerability in Plex Media Server affecting version 1.21 and earlier (with OpenVAS citing <1.21.3.4014). The Red Hat and CNNVD entries align on “Plex media server … ddos reflection attack via plex service.” The issue is described as an access-...

CVE-2022-28924

The CVE-2022-28924 entry concerns UniverSIS-Students prior to v1.5.0, where a crafted GET request to /api/students/me/courses/ can disclose sensitive information. The vulnerability is an information disclosure flaw in the API endpoint, enabling attackers to access data without proper authorizatio...

CVE-2019-18218

CVE-2019-18218 is a concrete issue affecting the file utility: cdf_read_property_info in cdf.c (up to version 5.37) does not cap the number of CDF_VECTOR elements, enabling a heap-based buffer overflow (4-byte out-of-bounds write). Public advisories (Arch Linux ASA-202001-2, ALAS-2019-1326/1370, ...

CVE-2024-32002

CVE-2024-32002 affects Git when cloning repositories with submodules, where a bug can cause files to be written into a .git directory instead of the submodule worktree. This can lead to a hook being executed during an ongoing clone, potentially enabling remote code execution without user inspecti...

CVE-2023-25173

CVE-2023-25173 affects containerd. A bug allowed improper setup of supplementary groups inside a container, enabling bypass of primary group restrictions and potential access to sensitive data or code execution when an attacker has container access. The issue is fixed in containerd 1.6.18 and 1.5...

CVE-2023-25717

CVE-2023-25717 affects Ruckus Wireless Admin panels (10.4 and earlier) across Ruckus ZoneDirector, SmartZone, and Solo APs where the web services component is enabled. The vulnerability enables unauthenticated remote code execution via an unauthenticated HTTP GET request (example parameterized lo...

CVE-2022-23725

PingID Windows Login prior to 2.8 fails to correctly set permissions on Windows Registry entries used to store sensitive API keys. Affected component is the PingID Windows Login application; root cause is improper registry permissions under certain circumstances, potentially exposing API keys loc...

CVE-2020-14323

Affects Samba Winbind in Samba; root cause is a null pointer/invalid lookupsids path leading to a crash and DoS. Affected versions are prior to 4.11.15, prior to 4.12.9, and prior to 4.13.1. Remediation is to upgrade to a fixed Samba release (e.g., 4.13.x line such as 4.13.3 per AlmaLinux advisor...

CVE-2019-11045

In PHP, DirectoryIterator vulnerability CVE-2019-11045 affects PHP 7.2.x < 7.2.26, 7.3.x

CVE-2018-10237

CVE-2018-10237 affects Google Guava 11.0–24.x before 24.1.1. Unbounded memory allocation occurs during Java serialization of AtomicDoubleArray and GWT serialization of CompoundOrdering, enabling potential denial-of-service via memory exhaustion. Root cause is eager allocation without checks on cl...

CVE-2026-15308

The CVE-2026-15308 issue concerns Python’s incremental HTML parser (html.parser.HTMLParser) where the feed() path can cause CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. The root cause is tied to how unterminated markup declarations are...

CVE-2022-0566

Mozilla Thunderbird contains a vulnerability CVE-2022-0566: processing a crafted email message can trigger an out-of-bounds write of one byte. Affected product: Thunderbird (client). Root cause: an out-of-bounds write when handling certain messages. Impact as stated: potential compromise via malf...

CVE-2023-21273

CVE-2023-21273 describes an out-of-bounds write in the Android SDP_AddAttribute path (sdp_db.cc), caused by an incorrect bounds check. The issue can enable remote code execution with no extra privileges and no user interaction, as stated in multiple public sources. Public documents consistently i...

CVE-2022-42916

CVE-2022-42916 affects curl’s HSTS check: when hostnames contain IDN characters that map to ASCII (e.g., IDEOGRAPHIC FULL STOP U+3002), curl can bypass HSTS and end up using HTTP instead of HTTPS. This could lead to cleartext transmission if an HTTP URL is provided. The issue is tied to curl vers...

CVE-2020-24656

CVE-2020-24656 affects Maltego prior to version 4.2.12, with the underlying issue described as an XML External Entity (XXE) vulnerability. The connected documents confirm the affected product and the vulnerability class, but do not provide exploitation details or a published patch/version fix in ...

CVE-2017-0781

CVE-2017-0781 is a remote code execution vulnerability in the Android Bluetooth stack (BNEP) that allows crafting packets to overflow a heap buffer and execute code. Connected PoC/Exploit references (BlueBorne) describe Android RCE via the BNEP service and related Bluetooth flaws across Android v...

CVE-2018-9461

The CVE-2018-9461 entry describes a race-condition vulnerability in the ShareIntentActivity.java on Android, enabling an app to read files in the Messages app and leading to local privilege escalation without extra execution privileges or user interaction. Several sources (NVD, Red Hat, CVE lists...

CVE-2024-8179

CVE-2024-8179 affects GitLab CE/EE, specifically versions 17.3 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. The issue is caused by improper output encoding that can lead to cross-site scripting (XSS) if CSP is not enabled. The vulnerability is scoped to the web page generation path ...

CVE-2020-28469

CVE-2020-28469 affects the glob-parent package prior to v5.1.2. The flaw arises from the enclosure-regex used to validate strings ending in an enclosure that contains a path separator. The described effect is a Regular Expression Denial of Service (ReDoS) scenario. Affected software/component: gl...

CVE-2018-20856

CVE-2018-20856 : Linux kernel before 4.18.7 contains a use-after-free in block/blk-core.c__blk_drain_queue() when an error case is mishandled. This could allow a local attacker to cause a denial of service or, potentially, execute arbitrary code. The issue was addressed in the 4.18.7 patch releas...

CVE-2019-8457

CVE-2019-8457 affects SQLite3 prior to 3.28.0, with versions 3.6.0 through 3.27.2 vulnerable to a heap-out-of-bounds read in the rtreenode() function when processing invalid rtree tables. Reported impact includes high to critical severity (CVSSv3.1: 9.8, Network attack, no user interaction). The ...

CVE-2022-36537

CVE-2022-36537 – ZK Framework Information Disclosure . Affected versions of ZK Framework: 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2, 8.6.4.1. An unauthenticated attacker can obtain sensitive data via a crafted POST to the AuUploader component, potentially exposing web-context files and configuration data....

CVE-2022-25227

Thinfinity VNC v4.0.0.1 is affected by a Cross-Origin Resource Sharing (CORS) flaw that can allow an unprivileged remote attacker, tricked into visiting a malicious site, to obtain an ID that can be used to send websocket requests and achieve remote code execution. The CVE description consistentl...

CVE-2022-28651

Vulnerability: JetBrains IntelliJ IDEA prior to 2021.3.3 allowed retrieving passwords from protected fields. Affected product/versions: IntelliJ IDEA before 2021.3.3. Root cause details are not specified in the provided documents. Impact: confidentiality of passwords may be exposed; CVSS data ind...

CVE-2021-43618

CVE-2021-43618 affects GMP up to version 6.2.1. The issue is an integer overflow in mpz/inp_raw.c that can cause a buffer overflow, leading to a segmentation fault on 32‑bit platforms. Public advisories in multiple distributions confirm a patched release is available (e.g., GMP 6.2.1-2 and newer;...

CVE-2019-17666

CVE-2019-17666 affects the Linux kernel Realtek rtlwifi driver (rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c). The root cause is a missing upper-bound check that leads to a buffer overflow. Impact stated in sources includes memory corruption and potential remote code execution, wit...

CVE-2026-35433

CVE-2026-35433 involves improper input validation in .NET Framework that enables local Elevation of Privilege. Public details in connected documents indicate the vulnerability affects multiple .NET Framework versions and is being addressed via May 12, 2026 security updates (e.g., KB5087058/KB5087...

CVE-2024-4317

The CVE-2024-4317 issue affects PostgreSQL built-ins pg_stats_ext and pg_stats_ext_exprs, where missing authorization checks allow an unprivileged user to read statistics (e.g., most common values) from other users’ CREATE STATISTICS data. Affected versions are within major series 14–16, specific...

CVE-2021-46927

CVE-2021-46927 concerns Linux kernel Nitro Enclaves memory mapping. After commit 5b78ed24e8ec, a call to get_user_pages() can trigger an mmap assertion when setting enclave memory regions. The fix switches to get_user_pages_unlocked() for enclave memory region setup, mirroring patterns like mmap_...

CVE-2022-35252

CVE-2022-35252 affects curl’s handling of cookies containing control codes; when such cookies are echoed back to a server, the server may return 400 responses, effectively enabling a “sister site” to deny service to other siblings. Public advisories confirm this is fixed in curl updates across se...

CVE-2021-20305

CVE-2021-20305 affects Nettle prior to 3.7.2 where signature verification (GOST DSA, EDDSA, ECDSA) calls ECC multiply with out-of-range scalars, potentially producing incorrect results and allowing an attacker to force an invalid signature (leading to assertion failure or validation issues). Docu...

CVE-2021-27876

CVE-2021-27876 affects Veritas Backup Exec (BE) Remote Agent/BE Agent prior to 21.2. The SHA-authentication vulnerability allows an attacker to bypass authentication, issue data-management commands on an authenticated channel, and access arbitrary files on the BE Agent system with SYSTEM/root pri...

CVE-2019-12828

CVE-2019-12828 affects Electronic Arts Origin prior to 10.5.39. The issue arises from improper sanitization of origin:// and origin2:// URI schemes, allowing injection of additional arguments into the Origin process and enabling remote code execution by loading a backdoored Qt plugin via the plat...

CVE-2019-12735

CVE-2019-12735 affects Vim and the Neovim fork, where the ":source!" command was not filtered inside a sandbox, enabling shell command execution via a crafted file opened in Vim/Neovim. Connected documents confirm affected products include vim (and Neovim) across multiple distributions (Debian, C...

CVE-2025-53020

CVE-2025-53020 affects Apache HTTP Server versions 2.4.17 through 2.4.63. The issue is described as a Late Release of Memory after Effective Lifetime vulnerability. The recommended remediation is to upgrade to version 2.4.64, which fixes the issue. Public references from Debian, Amazon Linux advi...

CVE-2020-36777

CVE-2020-36777 is a Linux kernel issue where media: dvbdev had a memory leak in dvb_media_device_free(), documented as freeing dvbdev->adapter->conn before NULL-ing it. The connected MiracleLinux advisory (AXSA-2024-8481:17) lists this CVE among others and confirms a fix/vendor advisory. Th...

CVE-2017-20005

CVE-2017-20005 affects NGINX before 1.13.6. It is a buffer overflow in the autoindex module triggered by modification dates with years exceeding four digits (e.g., 1969 or far-future dates), caused by integer overflow. The CVSSv3.1 vector and score indicate CRITICAL severity. Remediation per sour...

CVE-2019-14540

CVE-2019-14540 affects jackson-databind up to version 2.9.10 with serialization gadget risk involving the HikariCP classes (com.zaxxer.hikari.HikariConfig). The authoritative initial doc notes a polymorphic typing issue in jackson-databind related to HikariConfig. Connected-material references (A...

CVE-2018-17456

CVE-2018-17456 is a remote code execution in Git triggered when processing a recursive clone of a superproject if a .gitmodules URL starts with a dash. Affected Git versions include 2.14.5 and later 2.15.x/2.16.x/2.17.x/2.18.x/2.19.x before the fixed releases listed (e.g., 2.14.5 and subsequent u...

CVE-2014-2532

OpenSSH CVE-2014-2532 affects sshd prior to 6.6, where AcceptEnv lines with wildcards can be bypassed by using a substring before the wildcard, allowing remote attackers to bypass environment restrictions. Affected component: sshd in OpenSSH. Impact cited: potential info disclosure and environmen...

CVE-2013-3163

Microsoft Internet Explorer 8–10 contains a memory corruption vulnerability (CVE-2013-3163) that allows remote code execution or a denial of service when a user visits a crafted web site. Affected component: IE’s memory handling in versions 8–10; root cause described as memory corruption via craf...

CVE-2025-30401

CVE-2025-30401 affects WhatsApp for Windows prior to version 2.2450.6. The issue is a spoofing vulnerability where attachments are displayed by MIME type but opened using a handler chosen from the attachment’s filename extension, enabling a malicious file to execute arbitrary code when a user man...

CVE-2024-7592

CVE-2024-7592 affects CPython's http.cookies module. The cookie value parser can enter a quadratic-time path when backslashes are used for quoted characters, causing increased CPU usage. Connected advisories confirm CPython-level impact across multiple distributions and reference fixes in CPython...

CVE-2024-5274

CVE-2024-5274 is a type confusion flaw in Google Chrome’s V8 engine (Chromium-based) that could allow a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. The vulnerability affects Chrome versions prior to 125.0.6422.112 (Windows, macOS, Linux) and is cla...