CVE-2018-1311

CVE-2018-1311 describes a use-after-free in the Apache Xerces-C++ XML parser when scanning external DTDs. Publicly reported ranges indicate impact on Xerces-C versions 3.0.0–3.2.3, with no fixes in those older maintained lines and mitigation limited to disabling DTD processing (via DOM feature or...

CVE-2020-8813

The Cacti network monitoring tool (version 1.2.8 ) is vulnerable to Remote Code Execution (RCE) due to an issue in the graph_realtime.php file. An authenticated guest user with graph real-time privileges can execute arbitrary operating system commands by providing shell metacharacters within a co...

CVE-2021-21347

CVE-2021-21347 affects XStream Java library (pre-1.4.16). The vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream, with high severity when not using a proper security framework. Guidance across sources indicates u...

CVE-2022-23959

CVE-2022-23959 affects Varnish Cache and related variants, where HTTP/1 connections are vulnerable to a request smuggling flaw in versions before 6.6.2 (and 7.x before 7.0.2), 6.0 LTS before 6.0.10, and Varnish Enterprise/Cache Plus before 4.1.11r6 and 6.0.9r4. The root cause is improper handling...

CVE-2023-4048

CVE-2023-4048 involves an out-of-bounds read in DOMParser when parsing HTML in low-memory conditions, affecting Firefox < 116, Firefox ESR < 102.14, and Firefox ESR

CVE-2024-26141

CVE-2024-26141 affects Rack, the modular Ruby web server interface. The issue arises when handling Range headers, allowing a server to respond with an unexpectedly large payload and potentially causing a denial of service in vulnerable Rack-based apps (including Rails) that use Rack::File or Rack...

CVE-2018-0739

The CVE-2018-0739 issue concerns OpenSSL: crafted ASN.1 structures with recursive definitions (e.g., PKCS7) can cause deep recursion and stack overflow, leading to a Denial of Service. Affected versions include OpenSSL 1.1.0-1.1.0g and 1.0.2b-1.0.2n. The vulnerability is fixed in OpenSSL 1.1.0h a...

CVE-2018-3139

CVE-2018-3139 affects Oracle Java SE/Java SE Embedded components (Networking) with affected Java versions (6u201, 7u191, 8u182, 11; Embedded 8u181). Multiple connected advisories (Red Hat/CentOS, Debian, IBM AIX, Amazon Linux 2) describe the vulnerability as an unauthenticated network-access issu...

CVE-2018-7489

CVE-2018-7489 affects FasterXML jackson-databind; an incomplete fix for CVE-2017-7525 allowed unauthenticated remote code execution via JSON input to ObjectMapper.readValue, with a blacklist bypass if c3p0 is present in the classpath. Affected versions per the initial record include 2.7.9.3, 2.8....

CVE-2020-14303

CVE-2020-14303 affects Samba’s AD DC NBT server: an empty UDP packet to port 137 can cause a CPU spin and denial of service in Samba versions before the patched releases. The public documents identify Samba AD DC NBT as the vulnerable component and list fixed versions in downstream advisories: Sa...

CVE-2020-2800

CVE-2020-2800 affects Oracle Java SE/Java SE Embedded, specifically the Lightweight HTTP Server component. Affected versions include Java SE 7u251, 8u241, 11.0.6, 14 and Java SE Embedded 8u241. The vulnerability can be exploited over a network with unauthenticated access via multiple protocols, p...

CVE-2020-2830

CVE-2020-2830 affects Oracle Java SE/Java SE Embedded (Concurrency component) with Java SE versions 7u251, 8u241, 11.0.6 and 14; Java SE Embedded 8u241. The vulnerability allows unauthenticated network-based exploitation via multiple protocols, potentially enabling partial denial of service on Ja...

CVE-2021-3580

CVE-2021-3580 describes a flaw in nettle’s RSA decryption that allows specially crafted ciphertext to cause remote crashes and DoS. The connected advisories confirm affected nettle deployments and provide remediation guidance: upgrading nettle to a fixed version resolves the issue. For Debian, fi...

CVE-2022-24070

CVE-2022-24070 affects Subversion’s mod_dav_svn, where a use-after-free during path-based authorization lookups can lead to memory corruption and likely denial-of-service (HTTPD worker crash). The affected range is Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive); other Subversion...

CVE-2024-28102

Summary: CVE-2024-28102 affects the Python JWCrypto/JWCrypto implementation. Before 1.5.6, processing a malicious JWE token with a high compression ratio can cause a DoS by consuming excessive memory and CPU time; the vulnerability stems from the token deserialization path. Affected component: py...

CVE-2025-6558

CVE-2025-6558 involves insufficient validation of untrusted input in ANGLE and GPU within Google Chrome, enabling a remote attacker to potentially escape the sandbox via a crafted HTML page. Connected sources specify Chrome components ANGLE and GPU as affected, with the patch previously shipped i...

CVE-2018-16884

The CVE-2018-16884 issue affects the Linux kernel NFS4.1+ client: mounting NFS shares across different network namespaces can cause a use-after-free in bc_svc_process() leading to memory corruption and potential host panic. Exploitation details in the provided sources are host/container local, wi...

CVE-2019-12528

Squid is affected by CVE-2019-12528 (pre-4.10). A crafted FTP server can trigger disclosure of sensitive data from heap memory, including data from other sessions or non-Squid processes. Remediation in affected advisories involves upgrading Squid to a later version (at least 4.10+; many advisorie...

CVE-2021-3516

CVE-2021-3516 affects libxml2’s xmllint prior to 2.9.11. The issue is a use-after-free in xmllint when processing a crafted file, with impact to confidentiality, integrity, and availability. Remediation: update libxml2 to 2.9.11 or later (or apply vendor patch). The connected sources corroborate ...

CVE-2022-1154

CVE-2022-1154 affects Vim (vim/vim) and is caused by a use-after-free in utf_ptr2char prior to 8.2.4646. The issue can crash Vim and, per advisories, may allow code execution. Remediation/vendoring details are not in the Initial Description; connected advisories note fixes/upgrades but do not spe...

CVE-2019-13751

CVE-2019-13751 is a SQLite-related information disclosure in Google Chrome/Chromium. The issue arises from an uninitialized value in the SQLite library, exploited via a crafted HTML page to read potentially sensitive data from the process memory. Publicly documented fixes are included in Chromium...

CVE-2019-19948

CVE-2019-19948 — ImageMagick heap-based buffer overflow in the SGI writer. Root cause: WriteSGIImage in coders/sgi.c overruns the heap when handling SGI images. Affected software: ImageMagick 7.0.8-43 Q16 (and related entries in advisory history). Impact: the vulnerability is described as a heap-...

CVE-2020-13113

The CVE-2020-13113 issue affects libexif up to version 0.6.22. The root cause is use of uninitialized memory in EXIF Makernote handling, which could cause crashes and potential use-after-free conditions. The connected advisories confirm this as a vulnerability in libexif with impacts including cr...

CVE-2022-1184

CVE-2022-1184 affects the Linux kernel ext4 file-system code (fs/ext4/namei.c:dx_insert_block). The flaw is a use-after-free that can be triggered by a local user to cause a denial of service. Astra Linux bulletin also documents this exact issue. The connected documents do not specify a fixed ver...

CVE-2023-20588

CVE-2023-20588 is a division-by-zero vulnerability on some AMD Zen1 CPUs that could cause speculative data leakage and affect confidentiality. The connected Amazon Linux 2 advisory (ALAS2KERNEL-5.4-2025-116) confirms the Linux kernel fix for kernel-5.4 series (e.g., 5.4.254-169.358.amzn2.aarch64/...

CVE-2018-1000204

CVE-2018-1000204 affects Linux kernel versions 3.18–4.16 where an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp can cause the kernel to copy up to 1000 heap pages to userspace. The root cause is improper handling of SG_IO data flow leading to information ...

CVE-2018-12023

The CVE-2018-12023 issue affects FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (globally or per-property) and the Oracle JDBC jar is in the classpath with an LDAP service accessible to an attacker, the service could be coerced into executing a ma...

CVE-2018-14526

CVE-2018-14526 affects wpa_supplicant (rsn_supp/wpa.c) up to 2.6, where under certain conditions the integrity of EAPOL-Key messages is not checked, enabling a decryption oracle. An attacker in range of the AP and client could recover sensitive information. Public advisories across distributions ...

CVE-2008-0226

CVE-2008-0226 describes a buffer overflow in yaSSL 1.7.5 and earlier, used by MySQL and possibly other products. The overflow occurs via crafted client Hello messages in handshake.cpp (ProcessOldClientHello) or operator>> in yassl_imp.cpp, enabling remote code execution. Exploitation histor...

CVE-2017-1000158

CVE-2017-1000158 affects CPython up to 2.7.13, where an integer overflow in PyString_DecodeEscape within stringobject.c can cause a heap-based buffer overflow and may lead to arbitrary code execution. Publicly documented impacts across distributions confirm this vulnerability in older Python 2.7 ...

CVE-2019-16869

Netty (Java) is affected by CVE-2019-16869: HTTP request smuggling due to whitespace before the colon in headers (e.g., Transfer-Encoding : chunked). This can allow a crafted request to poison caches, bypass WAFs, and enable related attacks as described. The core issue is in Netty versions before...

CVE-2019-20446

The CVE concerns librsvg, GNOME's SVG rendering library. In lib/svg processing (specifically xml.rs), a crafted SVG with nested patterns can trigger denial of service by making the number of final rendered objects explode exponentially, consuming CPU/memory. Affected versions are librsvg up to 2....

CVE-2019-2945

CVE-2019-2945 affects Oracle Java SE/Java SE Embedded (Networking) with affected Java SE versions 7u231, 8u221, 11.0.4, 13 and Java SE Embedded 8u221. The vulnerability can be exploited over the network by unauthenticated attackers; some vectors require user interaction and may lead to a partial ...

CVE-2020-25284

The CVE-2020-25284 issue concerns the Rados Block Device (rbd) driver in the Linux kernel. Affected code path is in the rbd subsystem (drivers/block/rbd.c) where permission checks to access rbd devices were incomplete, enabling a local attacker to map or unmap rbd block devices. Multiple connecte...

CVE-2020-2773

CVE-2020-2773 is a vulnerability in Oracle Java SE and Java SE Embedded (component: Security) that can be exploited remotely by unauthenticated attackers to cause a partial denial of service on affected Java runtimes. Affected versions include Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedde...

CVE-2021-29447

CVE-2021-29447 is an XXE vulnerability in WordPress media handling (getID3 parsing WAV iXML chunks) that affects WordPress 5.6–5.7 on PHP 8+. Authenticated authors can upload a malicious WAV to trigger XML External Entity substitution (LIBXML_NOENT), enabling access to internal files. The issue i...

CVE-2022-21282

CVE-2022-21282 is a combined Java/Oracle Java SE/GraalVM issue reported across multiple advisories. The connected documents identify assorted affected components and versions, notably: Serialization , JAXP , Libraries , Hotspot , and ImageIO within Oracle Java SE and GraalVM Enterprise Edition. A...

CVE-2021-23968

CVE-2021-23968 describes a disclosure risk where, if a Content Security Policy blocked frame navigation, the violation report could reveal the destination of a redirect instead of the original frame URI. This could leak sensitive information contained in those URIs. Affected products include Fire...

CVE-2021-35586

CVE-2021-35586 is a vulnerability in Oracle Java SE (Java SE component: ImageIO) and Oracle GraalVM Enterprise Edition (affected versions: Java SE 7u311, 8u301, 11.0.12, 17; GraalVM EE: 20.3.3, 21.2.0) that enables an unauthenticated attacker with network access via multiple protocols to cause a ...

CVE-2019-12420

In Apache SpamAssassin, versions prior to 3.4.3 are affected by CVE-2019-12420: a specially crafted message can cause excessive resource consumption, resulting in a denial of service. The recommended remediation is to upgrade to SpamAssassin 3.4.3 as soon as possible. Some advisories also note th...

CVE-2019-2769

CVE-2019-2769 affects Oracle Java SE/Java SE Embedded, with affected components in Utilities and related subsystems. The initial description identifies Java SE versions 7u221, 8u212, 11.0.3 and 12.0.1 and Java SE Embedded 8u211 as impacted, enabling network-based, unauthenticated exploitation tha...

CVE-2020-2604

CVE-2020-2604 affects Oracle Java SE/Java SE Embedded Serialization. Affected: Java SE 7u241, 8u231, 11.0.5, 13.0.1; Java SE Embedded 8u231. Described impact: unauthenticated, network-based attacker can take over the Java environment; high confidentiality, integrity, and availability impact (CVSS...

CVE-2020-27223

CVE-2020-27223 affects Eclipse Jetty 9.4.6.v20170531–9.4.36.v20210114, 10.0.0, and 11.0.0, where handling requests with multiple Accept headers and many quality (q) values can cause high CPU usage and a DoS. Public sources consistently describe CPU exhaustion as the impact. Remediation is to upgr...

CVE-2022-21125

Public documentation in the provided sources does not disclose detailed technical information (affected products, root cause, or fixes) for CVE-2022-21125 beyond the general description. Monitor for updates from vendors and advisories.

CVE-2022-30123

Rack contains a sequence injection vulnerability (CVE-2022-30123) affecting Rack <2.0.9.1, <2.1.4.1, and

CVE-2015-1421

CVE-2015-1421 is a use-after-free in the Linux kernel SCTP path (sctp_assoc_update in net/sctp/associola.c) that allows a remote attacker to trigger an INIT collision, leading to slab corruption and a kernel panic (DoS) with potentially other impact. Affected condition: kernel versions prior to 3...

CVE-2018-15688

CVE-2018-15688 is a buffer/heap overwrite in the dhcpv6 option handling of systemd-networkd (systemd up to 239). A malicious DHCPv6 server on the same network could trigger an out-of-bounds write, potentially causing a Denial of Service or code execution. Affected products include systemd with ve...

CVE-2019-16943

CVE-2019-16943 affects FasterXML jackson-databind (versions 2.0.0–2.9.10) via a polymorphic typing flaw that, when Default Typing is enabled for an exposed JSON endpoint and a p6spy P6DataSource is present in the classpath with an accessible RMI endpoint, can lead to remote code execution. The ro...

CVE-2019-19604

Git before 2.24.1 is vulnerable to arbitrary command execution via recursive submodule updates because a malicious .gitmodules can cause commands to be run. Affected ranges include 2.20.2, 2.21.x, 2.22.x, 2.23.x, and 2.24.x prior to 2.24.1. Remediation: upgrade to Git 2.24.1 or later (UPC/ALAS re...

CVE-2020-27170

The CVE-2020-27170 flaw affects the Linux kernel prior to 5.11.8, where in kernel/bpf/verifier.c there is undesirable out-of-bounds speculation on pointer arithmetic. This can enable a side-channel attack that defeats Spectre mitigations and may allow an attacker to obtain sensitive information f...