CVE-2026-46333

CVE-2026-46333 concerns a logic bug in the Linux kernel’s ptrace access check (__ptrace_may_access). When a thread lacks an MM pointer, ptrace_may_access uses a cached “last dumpable” flag, which can be bypassed by CAP_SYS_PTRACE to override. This can enable local privilege escalation or informat...

CVE-2016-2147

CVE-2016-2147 affects BusyBox’s DHCP client (udhcpc) prior to 1.25.0. An integer overflow in handling a malformed RFC1035-encoded domain name can trigger an out-of-bounds heap write, allowing remote attackers to cause a denial of service (crash) via the network. The initial description specifies ...

CVE-2018-10906

CVE-2018-10906 affects FUSE’s fusermount when SELinux is active, allowing non-root users to bypass the user_allow_other restriction and mount a FUSE filesystem accessible to other users. Publicly referenced advisories show affected fuse packages across distributions with fixed versions: Red Hat/C...

CVE-2019-19880

CVE-2019-19880 affects SQLite 3.30.1. The issue arises in exprListAppendList in window.c, where constant integer values in ORDER BY clauses of window definitions are mishandled, allowing an attacker to trigger an invalid pointer dereference. This is described in multiple connected sources (Astra ...

CVE-2020-10018

The CVE-2020-10018 entry concerns WebKitGTK and WPE WebKit memory corruption (use-after-free) in versions up to 2.26.4, with fix implemented in 2.28.0. Affected products/components: WebKitGTK and WPE WebKit before 2.28.0; root cause: use-after-free leading to arbitrary code execution on processin...

CVE-2020-36310

CVE-2020-36310 affects the Linux kernel prior to 5.8, specifically arch/x86/kvm/svm/svm.c, where set_memory_region_test can infinite-loop on certain nested page faults (CID-e72436bc3a52). The connected Nessus/OSS documents confirm this exact issue in Unity Linux kernels and Debian/openSUSE adviso...

CVE-2021-28964

CVE-2021-28964: A race condition in get_old_root() in fs/btrfs/ctree.c of the Linux kernel up to 5.11.8 can allow a local attacker to cause a denial of service by cloning an extent buffer without proper locking. Connected documents confirm the Btrfs race condition and DoS impact but do not provid...

CVE-2008-2079

CVE-2008-2079 affects MySQL 4.1.x <4.1.24, 5.0.x <5.0.60, 5.1.x <5.1.24, and 6.0.x

CVE-2016-5771

CVE-2016-5771 affects the PHP SPL extension (spl_array.c) in PHP before 5.5.37 and 5.6.x before 5.6.23. The issue arises from how unserialize interacts with garbage collection, enabling remote attackers to trigger a use-after-free and cause a denial of service or potentially execute arbitrary cod...

CVE-2019-11730

CVE-2019-11730 describes a same-origin policy violation where opening a locally saved HTML file could allow file: URIs to access files in the same directory or subdirectories, enabling the Fetch API to read contents and potentially exfiltrate them. The issue affects Firefox ESR < 60.8, Firefox...

CVE-2019-13301

CVE-2019-13301 affects ImageMagick, specifically 7.0.8-50 Q16, with memory leaks in AcquireMagickMemory caused by an AnnotateImage error. This can lead to memory exhaustion and potential denial of service; mitigation is to update ImageMagick to a newer release per the ALAS advisories (ALAS-2024-1...

CVE-2020-15810

CVE-2020-15810 affects Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling may succeed against HTTP/HTTPS traffic, leading to cache poisoning and the ability for arbitrary content to be served from upstream caches. When relaxed header parsing is enable...

CVE-2020-26935

CVE-2020-26935 affects phpMyAdmin, where a SQL injection vulnerability exists in how the SearchController processes SQL statements in the search feature. Vulnerable when running phpMyAdmin versions prior to 4.9.6 and 5.x prior to 5.0.3. Successful exploitation could allow an attacker to inject ma...

CVE-2021-3800

CVE-2021-3800 (glib2.0) is a flaw in GLib before version 2.63.6 where a random charset alias can cause pkexec to leak content from files owned by privileged users to unprivileged ones under certain conditions. Public references in the connected docs confirm this impact as information disclosure v...

CVE-2021-3903

CVE-2021-3903 is a heap-based memory access vulnerability in vim. Multiple connected advisories confirm a memory access/heap overflow issue in vim that can crash or potentially be exploited when scrolling or handling certain inputs. Affected packages include vim and related vim-* components acros...

CVE-2021-42771

CVE-2021-42771 affects Babel.Locale in the Babel project; versions prior to 2.9.1 are vulnerable. The issue arises from directory traversal that allows loading arbitrary locale .dat files containing serialized Python objects, enabling code execution. Public advisories (e.g., Debian LTS, AlmaLinux...

CVE-2022-0392

CVE-2022-0392 is a heap-based buffer overflow in Vim (GitHub vim repository) prior to 8.2. The vulnerability is associated with Vim’s handling of certain operations and can cause a crash and, per CVE context, may enable code execution in some scenarios. Connected advisories confirm Vim vulnerabil...

CVE-2022-3545

CVE-2022-3545: Linux Kernel use-after-free in area_cache_get (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c, IPsec). Affects local attacker within LAN via area_cache_get manipulation; initial description notes a patch exists to fix the issue. Connected Astra Linux bulletin provides con...

CVE-2025-26699

CVE-2025-26699 concerns a potential denial-of-service in Django’s text handling: the wrap() function in django.utils.text and the wordwrap filter can be abused with very long strings. Public sources in the connected documents confirm affected versions: Django 5.1 before 5.1.7, 5.0 before 5.0.13, ...

CVE-2017-14495

CVE-2017-14495 affects dnsmasq: memory exhaustion/DoS in the EDNS0 code when using add-mac, add-cpe-id, or add-subnet. Root cause is a memory leak leading to unbounded memory consumption and possible crash. Upstream fixes exist in dnsmasq 2.78; multiple advisories/applications (ALAS2-2019-1251, C...

CVE-2018-1000120

CVE-2018-1000120 affects curl/libcurl’s FTP URL parsing (CURLOPT_FTP_FILEMETHOD). A crafted FTP URL can trigger a NIL-byte out-of-bounds write, causing a crash or potentially more serious effects. CVE-2018-1000121 is a NULL-pointer dereference in the LDAP handling path, exploitable via LDAP URLs ...

CVE-2018-16396

CVE-2018-16396 is a taint propagation issue in Ruby: certain formats used when unpacking tainted strings do not propagate taint correctly. Affected versions are Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. The root cause is that unpacked strings deri...

CVE-2018-21010

OpenJPEG is affected by CVE-2018-21010: a heap buffer overflow in color_apply_icc_profile (bin/common/color.c) present in OpenJPEG releases before 2.3.1. The CVE is tied to OpenJPEG under multiple advisories and Nessus/OpenVAS feeds reference this issue among OpenJPEG 2.3.x and earlier branches. ...

CVE-2019-15118

CVE-2019-15118 affects the Linux kernel up to version 5.2.9. The vulnerability arises from the function check_input_term in sound/usb/mixer.c , which mishandles recursion and can cause a kernel stack exhaustion leading to a crash. The connected Nessus entries corroborate the issue and reference U...

CVE-2020-12663

CVE-2020-12663 affects Unbound DNS resolver, specifically versions

CVE-2020-13632

SQLite vuln CVE-2020-13632 affects ext/fts3/fts3_snippet.c in SQLite

CVE-2020-27815

CVE-2020-27815 is a vulnerability in the Linux kernel JFS filesystem code allowing a local attacker who can set extended attributes to trigger a system panic, memory corruption, or privilege escalation. Publicly documented impact: confidentiality, integrity, and availability may be affected. The ...

CVE-2020-2816

CVE-2020-2816 affects Oracle Java SE JSSE in Java SE 11.0.6 and 14. The vulnerability allows an unauthenticated attacker with network access via HTTPS to compromise Java SE, potentially enabling unauthorized creation, deletion, or modification of data in Java SE‑accessible data. The description n...

CVE-2021-20257

CVE-2021-20257 concerns QEMU’s e1000 NIC emulator. The issue is an infinite loop in process_tx_desc when tx descriptor fields are invalid, allowing a guest to exhaust host CPU and cause DoS. Connected advisories confirm this affects QEMU and related builds (e.g., Debian LTS, Red Hat/AL2, Astra Li...

CVE-2021-32672

Redis contains CVE-2021-32672, a vulnerability in the Redis Lua Debugger where the protocol parser can read data beyond the actual buffer when handling malformed requests. This affects Redis builds that include Lua debugging support (3.2+). The issue is mitigated by upgrading to patched releases:...

CVE-2022-21499

CVE-2022-21499: KGDB/KDB can read/write kernel memory if lockdown is triggered; attacker with serial-port access could trigger debugger. Connected advisories reiter the risk and note the need to ensure lockdown mode is respected, but do not specify a patched version or remediation beyond that. Th...

CVE-2022-22827

CVE-2022-22827 affects Expat (libexpat) stored in xmlparse.c: storeAtts has an integer overflow in versions before 2.4.3. The vulnerability can be triggered by processing crafted XML content and, as described in the advisories, may lead to crashes or arbitrary code execution in some contexts. Aff...

CVE-2023-4147

CVE-2023-4147 is a local-privilege-escalation use-after-free in the Linux kernel nf_tables/netfilter code. The flaw occurs when adding a rule with NFTA_RULE_CHAIN_ID, where nft_tables_delrule or related NFT rule handling can release objects in a way that leaves a dangling pointer, enabling local ...

CVE-2019-12527

CVE-2019-12527 affects Squid 4.0.23–4.7. The issue arises in Basic Authentication handling: HttpHeader::getAuth decodes the Base64 blob into a fixed-size buffer without confirming decoded length, causing a heap-based buffer overflow with user-controlled data. Some sources note this can lead to re...

CVE-2019-13753

CVE-2019-13753 is an out-of-bounds read in the SQLite component used by Google Chrome/Chromium, fixed in Chrome/Chromium after version 79.0.3945.79. Exploitation via a crafted HTML page could allow a remote attacker to read potentially sensitive data from process memory. Public details in linked ...

CVE-2020-9383

CVE-2020-9383 affects the Linux kernel floppy driver (set_fdc in drivers/block/floppy.c) where the FDC index is not checked for errors before assignment, causing a wait_til_ready out-of-bounds read. Impact per the CVE description: local attacker could cause a denial of service or privilege escala...

CVE-2021-3527

CVE-2021-3527 affects the QEMU USB redirector (usb-redir). A flaw lets the guest influence the length of a dynamically allocated VLA on the stack by combining small USB packets into a large bulk transfer, with no bounded total size, causing a denial of service on the QEMU process. Public advisori...

CVE-2022-21831

CVE-2022-21831 affects Ruby on Rails’ Active Storage (Rails >= 5.2.0). The vulnerability arises from a code-injection in the image_processing backend (mini_magick), allowing remote code execution via crafted image_processing arguments. Impact is High (CVE describes RCE; CVSSv3.1 base score 9.8...

CVE-2023-23559

CVE-2023-23559 affects the Linux kernel rndis_wlan.c (rndis_query_oid) up to version 6.1.5. The vulnerability arises from an integer overflow in an addition, which may lead to a buffer overflow. Connected sources corroborate the issue and reference updates/mitigations in related advisories (e.g.,...

CVE-2017-2619

CVE-2017-2619 affects Samba before versions 4.6.1, 4.5.7 and 4.4.11. The issue is a race condition in the Samba server’s handling of symbolic links (symlinks) that a malicious client can trigger to access files and directories outside the share-export boundaries. This permits access to areas of t...

CVE-2019-11287

CVE-2019-11287 affects Pivotal RabbitMQ and RabbitMQ for Pivotal Platform web management plugin. Versions 3.7.x before 3.7.21, 3.8.x before 3.8.1, and 1.16.x before 1.16.7 and 1.17.x before 1.17.4 are vulnerable. The vulnerability allows a crafted X-Reason HTTP header to inject a malicious Erlang...

CVE-2020-13754

CVE-2020-13754 affects QEMU 4.2.0, where hw/pci/msix.c allows an out-of-bounds access via a crafted address in an msi-x MMIO operation. The connected documents confirm the exact vulnerable component and condition but do not provide a specific, universally applicable patched version within the CVE...

CVE-2020-6455

CVE-2020-6455 is an out-of-bounds read in Chromium/Google Chrome’s WebSQL implementation. The issue could allow a remote attacker to potentially cause heap corruption via a crafted page. Affected software is Chrome/Chromium before version 81.0.4044.92. The Debian Arch Linux security advisory and ...

CVE-2021-22191

CVE-2021-22191 affects Wireshark up to versions 3.4.3 and 3.2.11 (pre-release fix), with vulnerability described as improper URL handling that can enable remote code execution via crafted packets or capture files. The root cause, as reported in connected sources, involves how certain URL fields i...

CVE-2022-0413

CVE-2022-0413 is described in connected advisories as a vulnerability in vim where memory previously freed could be re-used, enabling a crafted file to crash vim or potentially execute code. The affected product is vim (GitHub vim/vim source base) and prior to version 8.2. The issue is framed as ...

CVE-2023-5479

CVE-2023-5479 corresponds to an insufficiently secure Extensions API in Google Chrome/Chromium before 118.0.5993.70, enabling a user-assisted bypass of enterprise policy via a crafted HTML page if a malicious extension is installed. Public details across connected documents confirm the affected c...

CVE-2015-7871

CVE-2015-7871 is an authentication-bypass vulnerability in ntpd caused by handling of crypto-NAK packets. A remote, unauthenticated attacker could force ntpd to peer with attacker-controlled time sources, bypassing authentication and potentially tampering time data. Affected series include NTP 4....

CVE-2017-10355

CVE-2017-10355 is documented across multiple openJDK/OpenJDK-derived advisories (CentOS, Debian, Amazon, IBM, etc.) as a networking vulnerability in the FtpClient component of OpenJDK’s Java SE/Java SE Embedded. Technical details in connected sources specify that the FtpClient did not set default...

CVE-2017-10661

CVE-2017-10661 is a race condition in Linux kernel timerfd (fs/timerfd.c) that affects versions before 4.10.15. The flaw arises from improper protection of the might_cancel queue during concurrent timerfd operations, enabling local attackers to cause a denial of service or gain privileges via lis...

CVE-2019-20367

CVE-2019-20367 is a vulnerability in libbsd where the symbol-table handling in nlist.c can read beyond bounds when comparing a symbol name from the string table. Affected: libbsd before 0.10.0 (older releases). Root cause: out-of-bounds read (CWE-125) in nlist.c. Impact: potential crash or crash-...