CVE-2023-38559

CVE-2023-38559 is a Ghostscript vulnerability: a buffer overflow/ out-of-bounds condition in base/gdevdevn.c:1973 (devn_pcx_write_rle()) could allow a local attacker to cause a denial of service by processing a crafted PDF for a DEVN device with gs. The connected advisories confirm the issue and ...

CVE-2020-18032

CVE-2020-18032 is a buffer overflow in Graphviz (lib/common/shapes.c) that can be triggered by processing a crafted file, potentially allowing code execution or causing a denial of service. Various advisories note patched releases; e.g., graphviz updates are available (examples include Debian fix...

CVE-2025-53799

CVE-2025-53799 affects the Windows Imaging Component. The vulnerability arises from use of an uninitialized resource in Imaging Component code, enabling local attackers to disclose information. The NCSC entry confirms the impact as Access to sensitive data with a CVSS-like rating around 5.5 (Medi...

CVE-2024-3566

Technical details about CVE-2024-3566 are not provided in the connected documents. The initial description notes a command injection risk, but no affected products, versions, impact, or fixes are specified here. Monitor for updated technical disclosures.

CVE-2022-29911

CVE-2022-29911 is an iframe sandbox bypass vulnerability described as an improper implementation of allow-top-navigation-by-user-activation that could permit script execution without allow-scripts. Affected products include Thunderbird (<91.9), Firefox ESR (<91.9), and Firefox (

CVE-2019-9022

CVE-2019-9022 affects PHP 7.x prior to 7.1.26, 7.2.x prior to 7.2.14, and 7.3.x prior to 7.3.2. dns_get_record may misparse a DNS response, enabling a hostile DNS server to cause memcpy misuse and read past the buffer allocated for DNS data in php_parserr (ext/standard/dns.c) for DNS_CAA and DNS_...

CVE-2010-1938

The CVE-2010-1938 issue affects OPIE’s library (libopie) used by OPIE up to version 2.4.1-test1, on FreeBSD 6.4–8.1-PRERELEASE and other platforms. The vulnerability is an off-by-one error in __opiereadrec/readrec.c that can be triggered by a long USER command to FTP servers linked against libopi...

CVE-2025-15599

CVE-2025-15599 affects DOMPurify before and after versions 2.x and 3.x due to a missing textarea rawtext validation in SAFE_FOR_XML that allows bypassing attribute sanitization and executing JavaScript when sanitized output is placed inside rawtext elements. Affected ranges: 3.1.3–3.2.6 and 2.5.3...

CVE-2025-31650

CVE-2025-31650 affects Apache Tomcat and describes a DoS due to DoS via malformed HTTP/2 PRIORITY_UPDATE frames arising from improper input handling. Affects Tomcat 9.0.76–9.0.102, 10.1.10–10.1.39, and 11.0.0-M2–11.0.5 (including older EOL 8.5.x in discussions). Debian/AlmaLinux advisories refere...

CVE-2021-46952

Summary (CVE-2021-46952): In the Linux kernel, NFS with UDP transport was vulnerable to a shift-out-of-bounds due to a garbage UDP retrans timeout being passed to xprt_calc_majortimeo. If retrans is >= 64, the mount fails with an error, preventing exploitation. The fix is a patch to validate U...

CVE-2023-39194

CVE-2023-39194 – The Apollo/CVE entry documents a flaw in the Linux kernel XFRM subsystem: during processing of state filters, an out-of-bounds read past the end of an allocated buffer can be triggered by a local attacker with CAP_NET_ADMIN privileges, potentially leading to information disclosur...

CVE-2022-28285

CVE-2022-28285 describes an incorrect AliasSet used during MLoadTypedArrayElementHole JIT codegen, enabling a potential out-of-bounds read when combined with another vulnerability. Affected products include Thunderbird < 91.8, Firefox < 99, and Firefox ESR

CVE-2022-31737

CVE-2022-31737 describes an out-of-bounds write in WebGL that could cause memory corruption and a potentially exploitable crash. Affected products include Thunderbird < 91.10, Firefox < 101, and Firefox ESR

CVE-2022-21605

CVE-2022-21605 concerns the Oracle MySQL Server, specifically the Server: Data Dictionary component. Affected are MySQL Server versions 8.0.28 and earlier . The vulnerability enables a high-privilege attacker with network access (via multiple protocols) to cause the server to hang or crash, resul...

CVE-2019-20388

CVE-2019-20388 affects libxml2 2.9.10. The Broadcom advisory BSNSA36819 confirms a memory leak in xmlSchemaValidateStream (xmlschemas.c) that can impact availability (memory exhaustion) when processing XML schemas. Affected component: libxml2’s xmlSchemaValidateStream; root cause relates to a lea...

CVE-2017-14492

CVE-2017-14492 is a heap-based buffer overflow in dnsmasq’s IPv6 router advertisement (RA) handling. Affected configurations include enabling RA-related options (enable-ra, ra-only, slaac, ra-names, ra-advrouter, ra-stateless). Impact per the sources: remote code execution or crash on the local n...

CVE-2026-1529

CVE-2026-1529 affects Keycloak. An attacker can craft/modify a legitimate invitation token’s JWT payload to change the organization ID and target email, exploiting a lack of cryptographic signature verification to self-register into an unauthorized organization and gain access. The vulnerability ...

CVE-2025-5064

An inappropriate implementation in the Background Fetch API in Google Chrome prior to version 137.0.7151.55 allows a remote attacker to leak cross-origin data via a crafted HTML page. This vulnerability is rated with Medium severity by Chromium. Remediation includes updating to version 137.0.7151...

CVE-2024-21096

Technical details about CVE-2024-21096 are not publicly provided in the supplied documents. Monitoring for updates is advised; the current sources do not specify affected products, versions, exploitability, or remediation within the given materials.

CVE-2024-23222

Summary (CVE-2024-23222) : A type confusion vulnerability in Apple WebKit leads to arbitrary code execution when processing malicious web content. The issue affects multiple Apple platforms and is fixed in versions listed by the sources: iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, and...

CVE-2023-34414

CVE-2023-34414 describes a click-jacking risk where the error page for TLS certificate errors could be hijacked due to a rendering lag, enabling a user click to override a certificate error under precise timing conditions. Affected products and versions (per provided documents): Firefox ESR < ...

CVE-2023-23916

CVE-2023-23916 involves curl before 7.88.0 where an attacker could abuse the chained HTTP compression chain to create a degenerate decompression path. Although the cap on the number of links is per header, a malicious server can inject many headers to form an effectively unlimited decompression c...

CVE-2021-27877

CVE-2021-27877 affects Veritas Backup Exec before 21.2, where SHA authentication remains supported but not disabled. This allows a remote attacker to gain unauthorized access to a Backup Exec Agent and execute privileged commands. The vulnerability excerpt notes the issue is exploitable over the ...

CVE-2020-12762

CVE-2020-12762 affects json-c up to 0.14, with an integer overflow and an out-of-bounds write in printbuf_memappend when processing large JSON files. Connected advisories reference fixes by upgrading to newer json-c/libfastjson packages (e.g., libfastjson 0.99.9-1+/0.99.9-1+deb11u1 and json-c 0.1...

CVE-2019-2455

CVE-2019-2455 affects the MySQL Server component (subcomponent: Server: Parser) with affected versions 5.6.42 and prior, 5.7.24 and prior, and 8.0.13 and prior. The vulnerability allows a low-privilege attacker with network access via multiple protocols to cause a hang or crash (DoS). Public advi...

CVE-2023-22064

CVE-2023-22064 affects Oracle MySQL Server (Server: Optimizer) with affected versions 8.0.34 and earlier. The vulnerability allows a high-privilege attacker with network access via multiple protocols to cause a hang or repeatable crash (a complete DoS) of MySQL Server; CVSS v3.1 base score 4.9 (A...

CVE-2023-39742

CVE-2023-39742 affects giflib v5.2.1, with a segmentation fault in getarg.c identified as the root cause. Several connected advisories confirm the issue across distributions (Amazon Linux, Fedora, Alpine, Mariner), noting patched/updated packages are available (e.g., giflib and related utilities/...

CVE-2022-29909

CVE-2022-29909 is a Firefox/Thunderbird vulnerability described as privilege escalation via deeply-nested cross-origin browsing contexts that could inherit top-level permissions. Affected products and versions from connected advisories: Thunderbird < 91.9 and Firefox (including ESR)

CVE-2022-32230

CVE-2022-32230 affects Microsoft Windows SMBv3 prior to the April 2022 patch set. A malformed FileNormalizedNameInformation SMBv3 request sent over a named pipe can trigger a null pointer dereference in the Windows kernel, resulting in a Blue Screen of Death (BSOD) and reboot of the SMBv3 server....

CVE-2022-27228

Bitrix Site Manager is vulnerable to a Remote Code Execution (RCE) flaw in the vote (also known as "Polls, Votes") module in versions prior to 21.0.100 . The root cause is identified as improper input validation (CWE-20 ), which allows a remote unauthenticated attacker to execute arbitrary code o...

CVE-2021-43798

Grafana CVE-2021-43798 is a directory traversal vulnerability affecting Grafana 8.0.0-beta1 through 8.3.0 (excluding patched versions). The flaw allows access to local files via the vulnerable URL path /public/plugins/ and related API paths described in the advisories. Upstream fixes were release...

CVE-2019-14889

The CVE-2019-14889 flaw affects libssh where the API function ssh_scp_new() can be misused when the third parameter is user-controlled. Versions before 0.9.3 and before 0.8.8 are vulnerable: during SCP client-server interaction the server may execute a scp command that includes a user-provided pa...

CVE-2019-9456

CVE-2019-9456 stems from the Android kernel Pixel C USB monitor driver. The issue is an out-of-bounds write caused by a missing bounds check in the Pixel C USB monitor driver, enabling local escalation of privilege to System with no user interaction required. This is described in the CVE entry as...

CVE-2019-9947

CVE-2019-9947 is a CRLF injection vulnerability in urllib/urllib2. The issue affects Python 2.x up to 2.7.16 and Python 3.x up to 3.7.3, where an attacker controlling a URL parameter can insert CRLF sequences in the path (or query) component passed to urlopen/urlopen-like calls, potentially leadi...

CVE-2025-21877

CVE-2025-21877 (Linux kernel, usbnet gl620a) affects the usbnet implementation in the kernel where GenelInK_bind() fails to verify that the device actually provides the endpoints it requests. This can lead to a mismatch when an artificially manufactured endpoint is encountered, as Syzbot observed...

CVE-2023-22114

CVE-2023-22114 affects Oracle MySQL (InnoDB) with versions 8.0.34 and earlier and 8.1.0. An attacker with network access via multiple protocols and high privileges could trigger a hang or crash (DoS). Public materials identify the vulnerability and impact but do not provide exploitation details i...

CVE-2023-29400

CVE-2023-29400 corresponds to a Go/golang vulnerability in html/template: improper handling of empty HTML attributes (e.g., attr={{.}}). The connected advisories confirm the issue affects Go toolchain templates and is being tracked across multiple Linux distributions (e.g., Mariner golang package...

CVE-2022-26669

ASUS Control Center is affected by CVE-2022-26669: an authenticated remote attacker with general user privilege can inject SQL commands into specific API parameters to obtain database schema or access data. The vulnerability is documented in NVD/CNVD/CNNVD entries and related lists; exploitation ...

CVE-2017-18368

CVE-2017-18368 describes a command injection in the ZyXEL P660HN-T1A router family (v1/v2; and Billion 5200W-T per Nessus) via the Remote System Log forwarding ViewLog.asp page, exploitable by an unauthenticated user through the remote_host parameter. Affected firmware exists on ZyXEL TCLinux dev...

CVE-2019-10906

CVE-2019-10906 affects Pallets Jinja2 before 2.10.1. The vulnerability arises from str.format_map allowing a sandbox escape, enabling potentially untrusted template code to escape sandbox restrictions. The issue is blocked to Jinja2’s sandboxed evaluation and affects environments using Pallets Ji...

CVE-2025-67642

The Jenkins HashiCorp Vault Plugin (version 371.v884a_4dd60fb_6 and earlier) is vulnerable to Improper Ownership Management due to a failure to set the correct context during Vault credential lookups. An attacker with Item/Configure permissions can exploit this deficiency to access and potentiall...

CVE-2022-40982

CVE-2022-40982 is an information-leak via microarchitectural state after transient execution in certain Intel vector execution units. The connected docs consistently describe local information disclosure by an authenticated user on affected Intel processors, with mitigations centered on firmware/...

CVE-2022-41854

CVE-2022-41854: Denial of Service in Snakeyaml when parsing untrusted YAML, potentially via stack overflow causing availability impact. Affected component: Snakeyaml (Java); exact affected versions not clearly specified in the provided documents, but references discuss Snakeyaml usage and updates...

CVE-2021-30465

CVE-2021-30465 affects runc and enables a Container Filesystem Breakout via Directory Traversal through a symlink-exchange attack with a race condition. Affected products shown in connected docs include runc before certain patched builds; Debian LTS and various Linux distributors list fixes and u...

CVE-2018-21028

CVE-2018-21028 affects Boa up to 0.94.14rc21; memory leak caused by missing calls to free. Descriptions from NVD/UBU/etc. indicate remote attackers could trigger the leak, but there is no explicit exploit/wild status provided in the connected documents. Remediation/fixes are not detailed in the s...

CVE-2026-10795

UpdraftPlus (WordPress plugin)

CVE-2024-12356

CVE-2024-12356 describes a critical, unauthenticated command injection vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS). The issue allows an attacker to inject commands that execute with the site user’s privileges, potentially impacting confidentiality, integrit...

CVE-2021-33990

Liferay Portal 6.2.5 is reported vulnerable to an insecure permissions issue that allows a Command=FileUpload&Type=File&CurrentFolder=/ request when frmfolders.html exists. The CVE-2021-33990 entries (NVD/Red Hat/CVE List) describe this as an improper privilege/permission scenario, with high risk...

CVE-2022-26387

The CVE-2022-26387 issue is a Mozilla add-on verification weakness. A time-of-check/time-of-use (TOCTOU) bug could allow the add-on file to be altered after Firefox/Thunderbird signatures were checked but before user confirmation, leaving the user exposed. Affected products and versions per conne...

CVE-2022-24999

CVE-2022-24999 affects the qs library prior to 6.10.3 used by Express before 4.17.3, enabling prototype poisoning via a[proto ] in query strings that can hang a Node process. An unauthenticated remote attacker can place the payload in the URL query. The advisory notes backported fixes to qs versi...