CVE-2023-4068

CVE-2023-4068: Type Confusion in V8 affects Chromium/Google Chrome; vulnerable component is V8, leading to remote arbitrary read/write via crafted HTML pages. Root cause: type confusion. Impact per sources: high; exploit details not provided. Remediation: upgrade Chromium/Chrome to 115.0.5790.170...

CVE-2022-29916

CVE-2022-29916 is an information-disclosure issue where Firefox behaves differently when loading CSS resources with CSS variables, potentially allowing history probing. Affected products in public advisories include Thunderbird and Firefox variants (Thunderbird < 91.9, Firefox/ ESR < 91.9, ...

CVE-2022-41715

CVE-2022-41715 concerns the Go regexp package. When er turning regular expressions from untrusted sources, parsing can exhaust memory and cause DoS, because the parsed representation is linear in input size and, in worst cases, the memory footprint can be very large. The available documents state...

CVE-2022-3358

Summary: CVE-2022-3358 affects OpenSSL 3.0.0–3.0.5 and occurs when legacy custom ciphers are passed via EVP_CIPHER_meth_new() with NID_undef. The initialization functions EVP_EncryptInit_ex2()/EVP_DecryptInit_ex2()/EVP_CipherInit_ex2() may resolve to the NULL cipher from providers, causing plaint...

CVE-2022-35737

CVE-2022-35737 affects SQLite, with vulnerable versions 1.0.12–3.39.x, before 3.39.2. The issue is an array-bounds overflow triggered by very large string arguments to a C API, which can cause a crash and, in some advisories, potentially allow arbitrary code execution. The documented fix is to up...

CVE-2021-3572

The CVE-2021-3572 issue affects python-pip and stems from how it handles Unicode separators in git references, with the potential to cause a different revision to be installed in a repository. The vulnerability affects data integrity and is mitigated by upgrading to python-pip version 21.1, which...

CVE-2020-25097

CVE-2020-25097 affects Squid proxy (versions 4.13 and 5.x up to 5.0.4) due to improper input validation while parsing request URIs, enabling HTTP request smuggling by a trusted client and access to services otherwise restricted. The issue is activated for certain uri_whitespace configurations. Pu...

CVE-2018-12130

CVE-2018-12130 : Microarchitectural Fill Buffer Data Sampling (MFBDS). Some Intel CPUs using speculative execution may leak information via fill buffers to a local attacker. Publicly referenced documents describe mitigations including microcode updates and OS/kernel mitigations (e.g., TSX/related...

CVE-2016-0165

CVE-2016-0165 is a Windows kernel-mode privilege-escalation issue affecting the Win32k subsystem (win32k.sys). The vulnerability allows a local attacker to gain higher privileges by exploiting how memory/objects are handled in the kernel, as described in CNVD-2016-02281. Affected products include...

CVE-2004-2320

Technical details for CVE-2004-2320 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2022-28737

CVE-2022-28737 is confirmed with concrete technical details in connected records. The issue is an out-of-bounds write in the shim loading path, caused by handling of the SizeOfRawData field in EFI sections via handle_image(), leading to memory corruption and potential arbitrary code execution. Af...

CVE-2024-8647

CVE-2024-8647 affects GitLab self-hosted installations, from versions 15.2 through 17.4.6, with 17.5 before 17.5.4 and 17.6 before 17.6.2. The issue enables leaking the anti-CSRF token to an external site when Harbor integration is enabled, indicating a cross-origin exposure vulnerability present...

CVE-2023-6345

CVE-2023-6345 is an integer overflow in the Skia graphics library used by Google Chrome prior to 119.0.6045.199. The vulnerability allows a renderer-compromised attacker to potentially escape the sandbox via a malicious file. Affected product: Google Chrome (Skia component). Root cause: integer o...

CVE-2023-1972

CVE-2023-1972 is a memory corruption issue in GNU Binutils. The initial description confirms a potential heap-based buffer overflow in _bfd_elf_slurp_version_tables() within bfd/elf.c, which may lead to loss of availability. Connected documents specify affected package family as binutils and note...

CVE-2022-22747

Summary: CVE-2022-22747 describes a denial of service caused by incorrect parsing of empty PKCS#7 sequences after accepting an untrusted certificate, leading to a crash. The vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird

CVE-2017-18017

CVE-2017-18017 affects the Linux kernel’s tcpmss_mangle_packet in net/netfilter/xt_TCPMSS.c. When xt_TCPMSS is used in an iptables action, a remote attacker can trigger a use-after-free and memory corruption, leading to a denial of service. Affected versions are Linux kernel before 4.11, and 4.9....

CVE-2005-2258

CVE-2005-2258 describes a remote file inclusion vulnerability in the Squito Gallery 1.33 product, specifically in the photolist.inc.php component. The underlying issue is a vulnerability in the photoroot parameter that allows an attacker to execute arbitrary code on the server. Affected software ...

CVE-2026-21722

Grafana CVE-2026-21722 affects the public dashboards annotations feature. The vulnerability allows a user to read the entire annotation history visible on a dashboard when timerange locking is disabled, exposing history outside the locked timerange. Root cause is that annotation timeranges were n...

CVE-2024-49742

Google Android is affected by a local elevation of privilege vulnerability (CWE-269) caused by a missing permission check in the onCreate method of NotificationAccessConfirmationActivity.java. This flaw could allow an application with notification access to be hidden within the system Settings, p...

CVE-2024-37334

CVE-2024-37334 refers to the Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability. Connected sources confirm an RCE flaw in the OLE DB Driver when a vulnerable client connects to a malicious SQL Server, with the issue arising from a missing security update. The Nessus plugin...

CVE-2024-1442

CVE-2024-1442 affects Grafana. A user with permission to create a data source can abuse the Grafana API to create a data source with UID set to *, granting the attacker read, query, edit, and delete rights across all data sources in the organization. This is a privilege escalation/compromise of d...

CVE-2021-46919

CVE-2021-46919 is a Linux kernel vulnerability in dmaengine/idxd where WQ size could be changed while the device was enabled. The fix changes the state check to ensure the WQ size is only modifiable when the device is disabled, addressing a race between device state and WQ configuration. Connecte...

CVE-2021-46917

CVE-2021-46917 is a Linux kernel vulnerability tied to the dmaengine: idxd subsystem. The issue stems from a pre-release silicon erratum workaround where a wq reset did not clear WQCFG registers, leaking into upstream code and risking clobbering registers on future devices. The documented fix rep...

CVE-2023-24056

CVE-2023-24056 affects pkgconf up to 1.9.3. The issue is a root cause in libpkgconf/tuple.c:pkgconf_tuple_parse where variable duplication can cause unbounded string expansion (e.g., a small .pc expanded to billions of bytes), leading to memory/resource exhaustion. IBM bulletins for Cloud Pak pro...

CVE-2022-24765

CVE-2022-24765 affects Git on multi-user systems where untrusted users can create a C:.git directory; Git would then read and apply configuration from that directory, potentially altering behavior outside the intended repository. The issue arises from Git not checking directory ownership when rea...

CVE-2018-0735

CVE-2018-0735 corresponds to a timing side-channel vulnerability in OpenSSL’s ECDSA signature generation. An attacker could exploit variations in signing to recover the private key. Affected: OpenSSL 1.1.0 (1.1.0-1.1.0i) and OpenSSL 1.1.1 (1.1.1) prior to the fixes. Fixes were released in OpenSSL...

CVE-2025-14087

CVE-2025-14087 describes a buffer-underflow in GLib’s GVariant parser that can cause heap corruption, potentially leading to denial of service or remote code execution when processing crafted input strings. The connected advisories pin the vulnerability to GLib (glib2) across multiple packages an...

CVE-2024-57719

The lunasvg v3.0.0 standalone SVG rendering library contains a segmentation violation caused by the blend_transformed_tiled_argb.isra.0 component. This vulnerability is associated with a NULL Pointer Dereference (CWE-476 ). The impact of the vulnerability is classified as high availability with a...

CVE-2024-31449

CVE-2024-31449 affects Redis with Lua scripting. An authenticated user can trigger a stack overflow in the Lua bit library via a crafted script, potentially enabling remote code execution. The issue affects all Redis versions that support Lua scripting and is fixed in Redis 6.2.16, 7.2.6, and 7.4...

CVE-2023-29405

CVE-2023-29405 affects the Go toolchain when using cgo with the go command. The vulnerability arises from how linker flags are parsed in #cgo LDFLAGS, where flags containing embedded spaces can be smuggled through LDFLAGS sanitization, and this only affects the gccgo workflow. The impact is poten...

CVE-2022-22760

CVE-2022-22760: A cross-origin information disclosure in Firefox/Thunderbird arises when importing resources via Web Workers, where error messages could reveal whether a response is JavaScript (application/javascript) or not. Affected: Firefox < 97, Thunderbird < 91.6, and Firefox ESR

CVE-2021-33159

Intel AMT vulnerability CVE-2021-33159 stems from improper authentication in the AMT subsystem, enabling a privileged user to escalate privileges via local access. Affected firmware versions include AMT before 11.8.93, 11.12.93, 11.22.93, 12.0.92, 14.1.67, 15.0.42, and 16.1.25. Red Hat and other ...

CVE-2021-28169

CVE-2021-28169 affects Eclipse Jetty shipped with multiple versions (<= 9.4.40, <= 10.0.2,

CVE-2021-26271

CVE-2021-26271 affects CKEditor 4 before 4.16. An attacker could trigger a ReDoS-type DoS by persuading a victim to paste crafted text into the Styles input of dialogs (Advanced Tab in the Dialogs plugin). Affected versions are CKEditor 4.x prior to 4.16; remediation is to upgrade to 4.16 or newe...

CVE-2020-15257

The CVE describes a privilege-escalation issue in containerd where access controls on the shim API socket allowed a container in the same network namespace to run new processes with elevated privileges. Affected releases are containerd before 1.3.9 and before 1.4.3; the vulnerability stems from e...

CVE-2026-61211

Oracle Database Server’s RDBMS component contains CVE-2026-61211 affecting 19.3–19.31 and 23.4.0–23.26.2. A low-privileged attacker with Execute DBMS_CLOUD and network access via Oracle Net can compromise the RDBMS, potentially taking over the system. Patching guidance is included in the Oracle J...

CVE-2026-41722

CVE-2026-41722 is a stored cross-site scripting vulnerability affecting VMware Cloud Foundation Operations and related products. The NVD/Broadcom advisory describes that a malicious actor with privileges to create policies, views, or text-widgets can inject scripts to perform administrative actio...

CVE-2024-38200

CVE-2024-38200 affects Microsoft Office (e.g., Office 2019 MSO Build 1808; Microsoft 365 MSO 2403/16.0.17425.20176) where Office URI schemes (eg, ms-word:ofe|u|http://…) trigger automatic NTLM authentication. The underlying issue is the Office URI handling that can fetch remote documents and caus...

CVE-2024-26130

CVE-2024-26130 — cryptography (Python) : A NULL pointer dereference occurs when calling pkcs12.serialize_key_and_certificates with a certificate public key that does not match the provided private key and an encryption_algorithm with hmac_hash. Versions 38.0.0–42.0.3 are affected; the issue crash...

CVE-2023-6378

CVE-2023-6378 involves a serialization vulnerability in the logback receiver component of logback version 1.4.11 that allows an attacker to mount a Denial-of-Service by sending poisoned data. The published entries consistently describe a DoS impact without other confidentiality or integrity effec...

CVE-2023-33009

CVE-2023-33009 is a buffer-overflow vulnerability in the notification function across Zyxel firewall/NGFW families (ATP, USG FLEX, VPN, ZyWALL/USG) with affected firmware ranges roughly 4.60–5.36 Patch 1 (and ZyWALL/USG 4.60–4.73 Patch 1). An unauthenticated attacker could trigger denial-of-servi...

CVE-2022-22743

CVE-2022-22743 affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird

CVE-2022-22741

CVE-2022-22741 : A fullscreen-related issue in Firefox/Thunderbird where resizing a popup while requesting fullscreen could trap the popup in fullscreen and prevent exit. Affected: Firefox ESR < 91.5, Firefox < 96, Thunderbird

CVE-2022-28948

CVE-2022-28948 affects Go-Yaml v3 Unmarshal; a crash can occur when deserializing invalid input. Connected sources corroborate a Go-Yaml Unmarshal issue across advisories (e.g., Astra Linux, Debian, GHSA), with no explicit patch version in the provided documents. Exploitation status is not stated...

CVE-2021-29956

CVE-2021-29956 affects Thunderbird prior to 78.10.2. OpenPGP secret keys imported with Thunderbird 78.8.1–78.10.1 were stored unencrypted on the local disk, with master password protection inactive for those keys. Version 78.10.2 restores the master-password protection for newly imported keys and...

CVE-2019-10211

CVE-2019-10211 affects PostgreSQL Windows installers prior to 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24. Root cause: bundled OpenSSL (libeay32.dll) loads configuration from a hardcoded directory during SSL initialization, enabling a local attacker to execute arbitrary code with the calling process’s pr...

CVE-2019-12616

phpMyAdmin before 4.9.0 is affected by a CSRF vulnerability (CVE-2019-12616). An attacker can entice an authenticated user to visit a crafted page (for example via a broken tag) and potentially perform payloads such as INSERT or DELETE against the victim’s database. This vulnerability is describ...

CVE-2019-4259

CVE-2019-4259 affects IBM Spectrum Scale with CES stack enabled (versions 4.1.1–5.0.0). Affected component: CES stack, where sensitive data could be included with service snaps. The IBM bulletin identifies affected releases and provides fixes: upgrade to V4.1.1.23 (for 4.1.1 branch), V4.2.3.14 (f...

CVE-2017-17215

CVE-2017-17215 is a Huawei HG532/HG532u series router remote code execution vulnerability. An authenticated attacker can send crafted packets to port 37215 to trigger upnp-related logic and execute arbitrary code. Public discussions and malware analyses (including HG532/ HG532e modifications and ...

CVE-2025-53791

CVE-2025-53791 affects Microsoft Edge (Chromium-based). The provided data indicate an improper access control vulnerability that allows an unauthorized network attacker to bypass a security feature. The description and connected sources confirm the affected product family but do not specify affec...