CVE-2023-38600

CVE-2023-38600 is a WebKitGTK/WebKit vulnerability that may allow arbitrary code execution when processing web content. The connected advisories confirm a fix across multiple platforms: Apple OS updates (iOS 16.6, iPadOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6), and Linux distributions...

CVE-2022-22742

CVE-2022-22742 is confirmed in connected records as an out-of-bounds memory access in Firefox/Thunderbird when inserting text in edit mode. Affected products include Firefox ESR < 91.5, Firefox < 96, and Thunderbird

CVE-2022-30065

CVE-2022-30065 concerns a use-after-free in the Busybox 1.35-x awk applet, due to a flaw in the copyvar function that can trigger denial of service and potentially code execution when processing a crafted awk pattern. Public details consistently name Busybox as affected and describe the issue as ...

CVE-2017-17215

CVE-2017-17215 is a Huawei HG532/HG532u series router remote code execution vulnerability. An authenticated attacker can send crafted packets to port 37215 to trigger upnp-related logic and execute arbitrary code. Public discussions and malware analyses (including HG532/ HG532e modifications and ...

CVE-2016-9840

CVE-2016-9840 affects zlib 1.2.8 in inftrees.c where improper pointer arithmetic can lead to out-of-bounds memory handling. Connected advisories show related issues in the same zlib code path (CVE-2016-9841, CVE-2016-9842, CVE-2016-9843) and describe potential crash or arbitrary-code outcomes in ...

CVE-2016-8864

CVE-2016-8864 affects ISC BIND DNS server. A denial-of-service can be triggered by processing responses containing a DNAME answer in db.c/resolver.c during recursive queries, causing an assertion failure and named exit. Affected are BIND 9.x releases listed in the advisory (pre-9.9.9-P4, pre-9.10...

CVE-2023-30582

CVE-2023-30582: In Node.js (version 20) under the experimental permission model, using --allow-fs-read with a non-* argument enables monitoring of files via fs.watchFile, bypassing read restrictions. This is tied to an incomplete permission model. The connected IBM bulletin references Spectrum Co...

CVE-2024-7971

CVE-2024-7971 is a Type Confusion in Google Chrome’s V8 engine that allows remote heap corruption via a crafted HTML page. Affected software is Google Chrome (and Chromium-based browsers) prior to version 128.0.6613.84. The root cause is a V8 type confusion issue, enabling exploitation when proce...

CVE-2024-26590

Summary (CVE-2024-26590) : In the Linux kernel, the EROFS filesystem’s per-file compression format handling could become inconsistent when a crafted image uses an algorithm type not listed in sbi->available_compr_algs. This could trigger a NULL pointer dereference if the corresponding decompre...

CVE-2023-44981

CVE-2023-44981 (Apache ZooKeeper) : Authorization bypass through a user-controlled SASL ID when quorum peer authentication is enabled (quorum.auth.enableSasl=true). If the instance part of the SASL ID is missing (e.g., [email protected]), authorization checks are skipped, allowing an arbitrary endp...

CVE-2023-21704

CVE-2023-21704 is a vulnerability in the Microsoft ODBC Driver for SQL Server that enables remote code execution. Microsoft’s security update KB5021126 addresses CVE-2023-21704 as part of a CU/patch bundle, updating the ODBC driver component used by SQL Server connectivity. The documented impact ...

CVE-2021-4083

CVE-2021-4083 is a read-after-free in Linux kernel Unix domain socket GC triggered by a race between close() and fget(). Affected kernels are prior to 5.16-rc4. Local users could crash the system or escalate privileges. Affected products include upstream kernel and Linux distributions (Astra Linu...

CVE-2021-37714

CVE-2021-37714 affects jsoup (Java HTML parser) versions prior to 1.14.2. When parsing untrusted HTML/XML, the parser may loop, slow down, or throw exceptions, enabling a denial-of-service condition. A fix is available in jsoup 1.14.2. Workarounds include rate-limiting parsing input, capping inpu...

CVE-2020-36242

The CVE refers to the Python cryptography package prior to 3.3.2. The issue arises from certain sequences of update() calls when symmetrically encrypting very large (multi-GB) payloads, which can trigger an integer overflow and buffer overflow, as demonstrated by the Fernet class. This affects cr...

CVE-2019-6978

CVE-2019-6978 concerns the GD Graphics Library (LibGD) 2.2.5, which has a double free vulnerability in the gdImage*Ptr() paths (gd_gif_out.c, gd_jpeg.c, gd_wbmp.c). The description notes that PHP is unaffected. The connected advisories confirm this CVE and tie it to libwmf-related updates in mult...

CVE-2018-14618

CVE-2018-14618 affects curl/libcurl NTLM authentication. The vulnerability arises from an integer overflow in Curl_ntlm_core_mk_nt_hash (32-bit size_t) that overflows when password length > 2 GB, causing heap buffer overflow due to under-allocated temporary storage. Affects curl prior to 7.61....

CVE-2018-7536

CVE-2018-7536 affects Django: vulnerable in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The issue is a denial-of-service caused by catastrophic backtracking in two regular expressions used by django.utils.html.urlize() (one regex in 1.8.x). The urlize() function underpins...

CVE-2025-55190

Argo CD vulnerability CVE-2025-55190: In multiple releases of Argo CD, API tokens with project-level permissions can retrieve sensitive repository credentials via the project details API endpoint, even when tokens lack explicit access to secrets. The issue affects versions 2.13.0–2.13.8, 2.14.0–2...

CVE-2024-24989

CVE-2024-24989 affects NGINX Plus and NGINX Open Source when configured with the HTTP/3 QUIC module. The underlying issue is in the HTTP/3 QUIC module, which can cause NGINX worker processes to terminate, yielding a denial-of-service condition. The vulnerability is tied to the HTTP/3 QUIC module ...

CVE-2023-4068

CVE-2023-4068: Type Confusion in V8 affects Chromium/Google Chrome; vulnerable component is V8, leading to remote arbitrary read/write via crafted HTML pages. Root cause: type confusion. Impact per sources: high; exploit details not provided. Remediation: upgrade Chromium/Chrome to 115.0.5790.170...

CVE-2023-37580

CVE-2023-37580 – Zimbra Collaboration Suite (ZCS) XSS : The Nuclei template confirms a Cross-Site Scripting vulnerability in ZCS 8.x before 8.8.15 Patch 41, specifically in the Zimbra Classic Web Client. Impact described in the connected doc: successful exploitation could execute arbitrary script...

CVE-2022-24675

CVE-2022-24675 affects the encoding/pem component in Go, where Decode can overflow the stack when processing very large PEM data (reported for Go before 1.17.9 and 1.18.x before 1.18.1). The vulnerability can lead to a denial of service through a stack overflow, impacting availability. Affected r...

CVE-2022-23648

CVE-2022-23648 affects containerd’s CRI implementation on Linux where specially-crafted image configurations could allow reading read-only copies of arbitrary host files and directories, potentially bypassing policy enforcement. The issue was fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users s...

CVE-2019-5436

CVE-2019-5436 affects curl/libcurl with a heap buffer overflow in the TFTP receiving code (tftp_receive_packet). Exploitation can lead to DoS or arbitrary code execution. Upstream fix released in curl 7.65.0; advisories from CentOS, Arch Linux, Debian, and others document the vulnerability and re...

CVE-2017-14226

CVE-2017-14226 affects libwpd 0.10.1, where WP1/WP5/WP42StylesListener implementations mishandle iterators, causing a heap-based buffer over-read in WPXTable.cpp (WPXTableList) that can enable remote denial of service against LibreOffice apps prior to 5.3.7. Public reports across multiple distrib...

CVE-2023-30587

CVE-2023-30587: Node.js 20 inspector-based bypass allows an attacker to modify the Worker’s isInternal value when an inspector attaches inside the Worker constructor before initializing WorkerImpl, bypassing the experimental permission model. Affected: Node.js users using the permission model mec...

CVE-2024-3651

CVE-2024-3651 affects the kjd/idna Python package (python-idna) and specifically the idna.encode() path in version 3.6. The issue arises when processing crafted input strings, causing quadratic growth in CPU load and resulting in a denial of service. Connected sources (Astra Linux, CIRCL, CBLMari...

CVE-2024-1442

CVE-2024-1442 affects Grafana. A user with permission to create a data source can abuse the Grafana API to create a data source with UID set to *, granting the attacker read, query, edit, and delete rights across all data sources in the organization. This is a privilege escalation/compromise of d...

CVE-2023-50447

Summary: CVE-2023-50447 affects Pillow up to 10.1.0, enabling Arbitrary Code Execution via the environment parameter in PIL.ImageMath.eval. This is a separate issue from CVE-2022-22817 (expression parameter). What’s affected: Pillow library in Python projects (Pillow versions up to 10.1.0). Root ...

CVE-2022-22741

CVE-2022-22741 : A fullscreen-related issue in Firefox/Thunderbird where resizing a popup while requesting fullscreen could trap the popup in fullscreen and prevent exit. Affected: Firefox ESR < 91.5, Firefox < 96, Thunderbird

CVE-2022-22738

The CVE-2022-22738 entry concerns a heap-buffer-overflow caused by applying a CSS filter, potentially exploitable via memory corruption. Affected products are Mozilla Firefox/Thunderbird: Firefox ESR < 91.5, Firefox < 96, and Thunderbird

CVE-2019-14901

CVE-2019-14901 is a heap overflow in the Marvell WiFi driver (mwifiex) of the Linux kernel, affecting all 3.x/4.x prior to 4.18.0. It can allow a remote attacker to crash the system (DoS) or potentially execute code with root privileges, impacting confidentiality and integrity. Public advisories ...

CVE-2019-2737

CVE-2019-2737 affects the MySQL Server component (subcomponent Pluggable Auth) of Oracle MySQL. Affected versions are 5.6.44 and prior, 5.7.26 and prior, and 8.0.16 and prior. An attacker with network access via multiple protocols and high privileges can cause the server to hang or crash (availab...

CVE-2025-62215

CVE-2025-62215 is a Windows Kernel race condition that enables local privilege escalation to SYSTEM by exploiting a concurrency window over kernel object handles, causing a double-free. A PoC exploit repository demonstrates a multithreaded trigger and heap spraying to achieve token elevation. Pub...

CVE-2025-27231

CVE-2025-27231 involves leakage of the LDAP Bind password in Zabbix deployments. According to connected advisories, the issue allows a Super Admin to exfiltrate the Bind password by altering the LDAP Host to a rogue server, even though the password cannot be read after saving under normal conditi...

CVE-2024-40711

CVE-2024-40711 is a deserialization vulnerability in Veeam Backup & Replication that allows unauthenticated remote code execution. The CVE is supported by multiple sources and exploit activity: PoCs and reported in the wild (AVLEONOV) with references to ransomware groups; CISA KEV and CISA Known ...

CVE-2023-43785

CVE-2023-43785 affects libX11 with a boundary condition in _XkbReadKeySyms(), allowing a local user to trigger an out-of-bounds read of memory. The issue is documented across multiple advisories (Red Hat, AlmaLinux, Ubuntu Cloud Foundry USN) with related fixes in libX11; exploitation details are ...

CVE-2022-22754

CVE-2022-22754: Affects Firefox <97, Thunderbird <91.6, and Firefox ESR

CVE-2022-22760

CVE-2022-22760: A cross-origin information disclosure in Firefox/Thunderbird arises when importing resources via Web Workers, where error messages could reveal whether a response is JavaScript (application/javascript) or not. Affected: Firefox < 97, Thunderbird < 91.6, and Firefox ESR

CVE-2021-33064

CVE-2021-33064 affects Intel® System Studio. A vulnerability in the installer causes an uncontrolled search path, potentially enabling privilege escalation by an authenticated user with local access. Impact is local with high confidentiality/integrity/availability concerns per CVSS. Affected prod...

CVE-2022-32964

CVE-2022-32964 involves OMICARD EDM where the API function has insufficient input validation, enabling an unauthenticated remote attacker to inject arbitrary SQL commands. The impact, as stated, includes access, modification, deletion of database data, or disruption of service, with confidentiali...

CVE-2021-45463

GEGL load_cache in GEGL before 0.4.34 allows shell expansion via a crafted path in a constructed command, caused by using the system() execution path in magick-load. This can lead to arbitrary command execution or impact availability/integrity depending on the environment; reports reference vulne...

CVE-2021-32760

CVE-2021-32760 affects containerd prior to 1.4.8 and 1.5.4. A crafted container image could cause Unix file permission changes on host files when pulling/extracting, potentially denying access, widening permissions, or setting bits like setuid/setgid/sticky. The flaw does not directly unlock read...

CVE-2021-25217

CVE-2021-25217 affects ISC DHCP (DHCP client/server) across multiple branches (notably 4.1-ESV-R16, 4.4.0–4.4.2; other 4.0/4.3 may be affected but untested). The vulnerability is a stack-based buffer overrun in parsing statements with colon-separated hex digits in config or lease files, potential...

CVE-2021-27365

CVE-2021-27365 affects the Linux kernel iSCSI subsystem. The issue is a heap overflow in iSCSI data handling where certain iSCSI data structures lack proper length checks and can exceed PAGE_SIZE; an unprivileged, local user can send a Netlink message (up to the maximum Netlink message length) an...

CVE-2018-1000828

CVE-2018-1000828 affects FrostWire desktop, version

CVE-2024-21893

Technical details about CVE-2024-21893 are not provided in the connected documents. The initial description notes an SSRF vulnerability in Ivanti products, but there are no product/version specifics or remediation details here. Monitor for updates.

CVE-2024-0517

CVE-2024-0517 refers to an out-of-bounds write in Google's V8 JavaScript engine used by Chrome/Chromium. The vulnerability affects Chrome/Chromium prior to version 120.0.6099.224 and can allow a remote attacker to potentially cause heap corruption through a crafted HTML page. The public documents...

CVE-2023-36730

CVE-2023-36730 affects the Microsoft SQL Server ODBC Driver. The vulnerability is described as a Remote Code Execution issue in the ODBC Driver component; root cause details are not explicitly provided in the documents beyond the vulnerability family. Microsoft’s October 2023 security updates (KB...

CVE-2023-43786

CVE-2023-43786 affects libX11 with an infinite loop in PutSubImage(), enabling local denial of service via resource exhaustion. Public advisories show fixes across libX11 packages (e.g., newer libX11 1.6.7-era releases in AL/AlmaLinux advisories). No explicit exploit details are provided in the c...