vulnix: known vulnerabilities in system closure #5

New Issue

Open

opened 2026-09-12 00:52:58 +00:00 by gitea-actions · 0 comments

gitea-actions bot commented 2026-09-12 00:52:58 +00:00

Copy Link

Copy Source

vulnix scan (2026-10-19): 476 CVEs across 90 packages.

Package	Version	CVE	CVSS	Description
network	3.2.8.0	CVE-2021-35047	9.9	Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attack...
network	3.2.8.0	CVE-2021-35049	9.9	Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web in...
ShellCheck	0.11.0	CVE-2021-28794	9.8	The unofficial ShellCheck extension before 0.13.4 for Visual Studio Code mishandles shellcheck.executablePath.
cargo	1.98.1	CVE-2026-14363	9.8	Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia F...
cargo	1.98.1	CVE-2026-58521	9.8	Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia F...
curl	0.4.49	CVE-2022-32221	9.8	When doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for dat...
gitea	1.27.3	CVE-2026-94205	9.8	Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rathe...
gitea	1.27.3-go-modules	CVE-2026-94205	9.8	Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rathe...
glibc	2.42	CVE-2026-5450	9.8	Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to versi...
glibc	2.42-84	CVE-2026-5450	9.8	Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to versi...
glibc	2.42-84-source-unsecvars	CVE-2026-5450	9.8	Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to versi...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-27143	9.8	Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the c...
libraw	0.22.1	CVE-2026-20911	9.8	A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 an...
libraw	0.22.1	CVE-2026-21413	9.8	A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b5654...
network	3.2.8.0	CVE-2021-35048	9.8	Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web inte...
orc	0.4.42	CVE-2025-47436	9.8	Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decom...
perl	5.42.3	CVE-2026-8376	9.8	Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflo...
perl	5.42.3-env	CVE-2026-8376	9.8	Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflo...
python	2.7.18.12	CVE-2022-48565	9.8	An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts enti...
snappy	1.2.2	CVE-2023-28115	9.8	Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1....
snappy	1.2.2	CVE-2023-41330	9.8	knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. ## Issu...
unbound	1.26.0	CVE-2026-81642	9.8	In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables deni...
unbound	1.26.0	CVE-2026-82717	9.8	In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap me...
zlib	0.7.1.1	CVE-2022-37434	9.8	zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip hea...
zlib	0.7.1.1	CVE-2023-45853	9.8	MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_...
zlib	0.7.1.1	CVE-2026-27820	9.8	zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2....
zlib	1.3.2	CVE-2026-27820	9.8	zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2....
Diff	1.0.2	CVE-2024-13278	9.1	Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 ...
gitea	1.27.3	CVE-2026-101023	9.1	Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refresh_token grant ty...
gitea	1.27.3	CVE-2026-103059	9.1	When Gitea's built-in SSH server is enabled (START_SSH_SERVER = true), the presented public key was looked up with ...
gitea	1.27.3	CVE-2026-95106	9.1	Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject....
gitea	1.27.3-go-modules	CVE-2026-101023	9.1	Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refresh_token grant ty...
gitea	1.27.3-go-modules	CVE-2026-103059	9.1	When Gitea's built-in SSH server is enabled (START_SSH_SERVER = true), the presented public key was looked up with ...
gitea	1.27.3-go-modules	CVE-2026-95106	9.1	Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject....
lapack	3	CVE-2021-4048	9.1	An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3....
perl	5.42.3	CVE-2026-13221	9.1	Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect...
perl	5.42.3-env	CVE-2026-13221	9.1	Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect...
warp	3.4.9	CVE-2022-4428	8.9	support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for pri...
git	2.55.0	CVE-2022-36882	8.8	A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigge...
gitea	1.27.3	CVE-2026-104626	8.8	A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a G...
gitea	1.27.3	CVE-2026-104632	8.8	Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer appr...
gitea	1.27.3-go-modules	CVE-2026-104626	8.8	A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a G...
gitea	1.27.3-go-modules	CVE-2026-104632	8.8	Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer appr...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-27140	8.8	SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution ...
gzip	1.2.4	CVE-2022-1271	8.8	An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's ...
libssh2	1.11.1	CVE-2026-66032	8.8	libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in ...
network	3.2.8.0	CVE-2022-24388	8.8	Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands i...
network	3.2.8.0	CVE-2022-24389	8.8	Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level comm...
network	3.2.8.0	CVE-2022-24390	8.8	Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user leve...
network	3.2.8.0	CVE-2022-24391	8.8	Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an atta...
network	3.2.8.0	CVE-2022-24392	8.8	Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web in...
network	3.2.8.0	CVE-2022-24393	8.8	Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web in...
network	3.2.8.0	CVE-2022-24394	8.8	Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web in...
python	2.7.18.12	CVE-2024-49050	8.8	Visual Studio Code Python Extension Remote Code Execution Vulnerability
python	3.14.6	CVE-2024-49050	8.8	Visual Studio Code Python Extension Remote Code Execution Vulnerability
setuptools	44.0.0-source	CVE-2025-47273	8.8	setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path...
wire	0.7.0	CVE-2021-32665	8.8	wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a ...
wire	0.7.0-go-modules	CVE-2021-32665	8.8	wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a ...
yoke	0.8.1	CVE-2026-26056	8.8	Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists ...
bison	3.8.2	CVE-2026-56389	8.6	GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of g...
libsoup	3.6.6	CVE-2026-102556	8.6	A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::po...
libsoup	3.6.6	CVE-2026-102557	8.6	A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequ...
libsoup	3.6.6	CVE-2026-102558	8.6	A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its ...
glibc	2.42	CVE-2026-0861	8.4	Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GN...
perl	5.42.3	CVE-2026-57432	8.4	Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow i...
perl	5.42.3-env	CVE-2026-57432	8.4	Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow i...
rubygems	3.7.2	CVE-2022-36073	8.3	RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker t...
libsoup	3.6.6	CVE-2026-102555	8.2	A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as ...
openssl	3.6.4	CVE-2026-84782	8.2	Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended pa...
openssl	4.0.2	CVE-2026-84782	8.2	Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended pa...
stringbuilder	0.5.1	CVE-2024-21524	8.2	All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length ca...
gitea	1.27.3	CVE-2026-105267	8.1	The Gitea web route for deleting tags (POST /{owner}/{repo}/tags/delete) requires only write access to the Code uni...
gitea	1.27.3	CVE-2026-89430	8.1	Gitea validated a push mirror's remote address against the [migrations] allow and block lists only when the mirror ...
gitea	1.27.3	CVE-2026-96404	8.1	When Gitea's web installer is reachable against a database that already contains users, such as after INSTALL_LOCK ...
gitea	1.27.3-go-modules	CVE-2026-105267	8.1	The Gitea web route for deleting tags (POST /{owner}/{repo}/tags/delete) requires only write access to the Code uni...
gitea	1.27.3-go-modules	CVE-2026-89430	8.1	Gitea validated a push mirror's remote address against the [migrations] allow and block lists only when the mirror ...
gitea	1.27.3-go-modules	CVE-2026-96404	8.1	When Gitea's web installer is reachable against a database that already contains users, such as after INSTALL_LOCK ...
grafana	13.1.6	CVE-2023-34111	8.1	The Release PR Merged workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerab...
grafana	13.1.6-go-modules	CVE-2023-34111	8.1	The Release PR Merged workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerab...
libraw	0.22.1	CVE-2026-20884	8.1	An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specia...
libraw	0.22.1	CVE-2026-24450	8.1	An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. ...
libssh2	1.11.1	CVE-2026-55200	8.1	libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read(...
vault	0.3.1.6	CVE-2024-2048	8.1	Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when ...
warp	3.4.9	CVE-2022-2225	8.1	By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges t...
async	2.2.6	CVE-2021-43138	7.8	In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka li...
avahi	0.8	CVE-2021-26720	7.8	avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avah...
binutils	2.46	CVE-2026-6846	7.8	A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (...
cjson	1.7.19	CVE-2026-16554	7.8	cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms....
fontforge	20251009	CVE-2025-15276	7.8	FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability ...
fontforge	20251009	CVE-2025-15277	7.8	FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability ...
fontforge	20251009	CVE-2025-15278	7.8	FontForge GUtils XBM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows rem...
gcc	4.6.4	CVE-2021-37322	7.8	GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
go	1.24.13-linux-amd64-bootstrap	CVE-2026-39822	7.8	On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the f...
python	2.7.18.12	CVE-2024-9287	7.8	A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual...
python	2.7.18.12	CVE-2025-49714	7.8	Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code loc...
python	3.14.6	CVE-2025-49714	7.8	Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code loc...
zlib	0.7.1.1	CVE-2026-22184	7.8	zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib...
gitea	1.27.3	CVE-2026-101027	7.7	When [migrations] ALLOWED_DOMAINS was configured, a hostname matching the allow list was accepted without checking ...
gitea	1.27.3-go-modules	CVE-2026-101027	7.7	When [migrations] ALLOWED_DOMAINS was configured, a hostname matching the allow list was accepted without checking ...
binutils	2.46	CVE-2025-69649	7.5	GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary...
binutils	2.46	CVE-2025-69650	7.5	GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malform...
bytes	1.11.0	CVE-2026-25541	7.5	Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to intege...
cjson	1.7.19	CVE-2026-67215	7.5	cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 J...
commonmark	0.2.6.1	CVE-2026-86430	7.5	league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detec...
curl	0.4.49	CVE-2022-27781	7.5	libcurl provides the CURLOPT_CERTINFO option to allow applications torequest details to be returned about a server'...
curl	0.4.49	CVE-2022-27782	7.5	libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should...
curl	0.4.49	CVE-2023-28319	7.5	A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's p...
git	2.55.0	CVE-2022-30947	7.5	Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories...
git	2.55.0	CVE-2022-36883	7.5	A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger build...
gitea	1.27.3	CVE-2026-103670	7.5	When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without...
gitea	1.27.3	CVE-2026-104636	7.5	Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request hea...
gitea	1.27.3	CVE-2026-70357	7.5	Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but th...
gitea	1.27.3	CVE-2026-96399	7.5	A repository's external issue tracker regular expression containing alternating capture groups could produce invalid ...
gitea	1.27.3	CVE-2026-96580	7.5	Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creati...
gitea	1.27.3-go-modules	CVE-2026-103670	7.5	When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without...
gitea	1.27.3-go-modules	CVE-2026-104636	7.5	Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request hea...
gitea	1.27.3-go-modules	CVE-2026-70357	7.5	Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but th...
gitea	1.27.3-go-modules	CVE-2026-96399	7.5	A repository's external issue tracker regular expression containing alternating capture groups could produce invalid ...
gitea	1.27.3-go-modules	CVE-2026-96580	7.5	Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creati...
glibc	2.42	CVE-2025-15281	7.5	Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may ...
glibc	2.42	CVE-2026-0915	7.5	Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for n...
glibc	2.42	CVE-2026-4046	7.5	The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when conver...
glibc	2.42	CVE-2026-4437	7.5	Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in ...
glibc	2.42	CVE-2026-5928	7.5	Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps betwe...
glibc	2.42-84	CVE-2025-15281	7.5	Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may ...
glibc	2.42-84	CVE-2026-4046	7.5	The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when conver...
glibc	2.42-84	CVE-2026-4437	7.5	Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in ...
glibc	2.42-84	CVE-2026-5928	7.5	Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps betwe...
glibc	2.42-84-source-unsecvars	CVE-2025-15281	7.5	Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may ...
glibc	2.42-84-source-unsecvars	CVE-2026-4046	7.5	The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when conver...
glibc	2.42-84-source-unsecvars	CVE-2026-4437	7.5	Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in ...
glibc	2.42-84-source-unsecvars	CVE-2026-5928	7.5	Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps betwe...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-25679	7.5	url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
go	1.24.13-linux-amd64-bootstrap	CVE-2026-32280	7.5	During chain building, the amount of work that is done is not correctly limited when a large number of intermediate c...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-32281	7.5	Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-32283	7.5	If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connectio...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-33811	7.5	When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory an...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-33814	7.5	When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it re...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-39820	7.5	Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaust...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-39836	7.5	The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
go	1.24.13-linux-amd64-bootstrap	CVE-2026-42499	7.5	Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
go	1.24.13-linux-amd64-bootstrap	CVE-2026-42501	7.5	A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum dat...
gzip	1.2.4	CVE-2026-41992	7.5	GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of s...
gzip	1.14	CVE-2026-41992	7.5	GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of s...
libsndfile	1.2.2	CVE-2025-52194	7.5	A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing m...
libsndfile	1.2.2	CVE-2026-37555	7.5	An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t...
libssh2	1.11.1	CVE-2026-66033	7.5	libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the...
libssh2	1.11.1	CVE-2026-66034	7.5	libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a maliciou...
libssh2	1.11.1	CVE-2026-66035	7.5	libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability tha...
openssl	3.6.4	CVE-2026-54873	7.5	Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact sum...
openssl	3.6.4	CVE-2026-72897	7.5	Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way throu...
openssl	3.6.4	CVE-2026-84784	7.5	Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a lim...
openssl	4.0.2	CVE-2026-54873	7.5	Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact sum...
openssl	4.0.2	CVE-2026-72897	7.5	Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way throu...
openssl	4.0.2	CVE-2026-84783	7.5	Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extensi...
openssl	4.0.2	CVE-2026-84784	7.5	Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a lim...
python	2.7.18.12	CVE-2022-0391	7.5	A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Loc...
python	2.7.18.12	CVE-2022-45061	7.5	An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processin...
python	2.7.18.12	CVE-2022-48560	7.5	A use-after-free exists in Python through 3.9 via heappushpop in heapq.
python	2.7.18.12	CVE-2023-24329	7.5	An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by sup...
python	2.7.18.12	CVE-2023-36632	7.5	The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maxim...
python	2.7.18.12	CVE-2024-6232	7.5	There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtrack...
python	2.7.18.12	CVE-2024-7592	7.5	There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. W...
python	2.7.18.12	CVE-2025-13836	7.5	When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Cont...
python	2.7.18.12	CVE-2026-15308	7.5	The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated m...
python	2.7.18.12	CVE-2026-3087	7.5	If shutil.unpack_archive() is given a ZIP archive with an absolute Windows path containing a drive (C:\\...) then...
python	2.7.18.12	CVE-2026-3644	7.5	The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.updat...
python	2.7.18.12	CVE-2026-4224	7.5	When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deep...
python	2.7.18.12	CVE-2026-7210	7.5	xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which al...
python	3.14.6	CVE-2026-15308	7.5	The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated m...
sassc	3.6.2	CVE-2022-43357	7.5	Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:...
subversion	1.14.5	CVE-2021-21698	7.5	Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key fi...
unbound	1.26.0	CVE-2026-81634	7.5	In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a hea...
uuid	1.20.0	CVE-2026-41907	7.5	uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output ...
vault	0.3.1.6	CVE-2021-27400	7.5	HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did ...
vault	0.3.1.6	CVE-2023-6337	7.5	HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion...
vault	0.3.1.6	CVE-2026-5807	7.5	Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or can...
wheel	0.37.1-source	CVE-2022-40898	7.5	An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a ...
wire	0.7.0	CVE-2026-45799	7.5	Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteA...
wire	0.7.0-go-modules	CVE-2026-45799	7.5	Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteA...
yaml	0.11.11.2	CVE-2022-3064	7.5	Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
yaml	0.11.11.2-r2.cabal	CVE-2022-3064	7.5	Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
yoke	0.8.1	CVE-2026-26055	7.5	Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists ...
warp	3.4.9	CVE-2023-2754	7.4	The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local ...
wire	0.7.0	CVE-2021-41093	7.4	Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token t...
wire	0.7.0-go-modules	CVE-2021-41093	7.4	Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token t...
glibc	2.42	CVE-2026-5435	7.3	The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enf...
glibc	2.42-84	CVE-2026-5435	7.3	The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enf...
glibc	2.42-84-source-unsecvars	CVE-2026-5435	7.3	The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enf...
libssh2	1.11.1	CVE-2026-7598	7.3	A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_pas...
warp	3.4.9	CVE-2023-1862	7.3	Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.ex...
gitea	1.27.3	CVE-2026-79960	7.1	When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission che...
gitea	1.27.3	CVE-2026-86684	7.1	The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file sy...
gitea	1.27.3-go-modules	CVE-2026-79960	7.1	When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission che...
gitea	1.27.3-go-modules	CVE-2026-86684	7.1	The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file sy...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-27144	7.1	The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion preven...
grafana	13.1.6	CVE-2026-14199	7.1	Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater tha...
grafana	13.1.6-go-modules	CVE-2026-14199	7.1	Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater tha...
warp	3.4.9	CVE-2025-0651	7.1	Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low ...
libssh2	1.11.1	CVE-2026-58050	7.0	libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and us...
python	2.7.18.12	CVE-2022-26488	7.0	In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. ...
warp	3.4.9	CVE-2023-0652	7.0	Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of...
warp	3.4.9	CVE-2023-1412	7.0	An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client f...
vault	0.3.1.6	CVE-2025-6037	6.8	Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when ...
cups	2.4.19	CVE-2022-26691	6.7	A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina,...
warp	3.4.9	CVE-2022-3320	6.7	It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoin...
warp	3.4.9	CVE-2022-3512	6.7	Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch...
gstreamer	1.28.6	CVE-2026-73433	6.6	A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_a...
curl	0.4.49	CVE-2022-27776	6.5	A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie head...
curl	0.4.49	CVE-2022-32206	6.5	curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multipl...
dash	0.5.13.5	CVE-2024-21485	6.5	Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0...
dbus	0.9.10	CVE-2022-42010	6.5	An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authen...
dbus	0.9.10	CVE-2022-42011	6.5	An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authen...
dbus	0.9.10	CVE-2022-42012	6.5	An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authen...
dbus	1	CVE-2022-42010	6.5	An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authen...
dbus	1	CVE-2022-42011	6.5	An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authen...
dbus	1	CVE-2022-42012	6.5	An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authen...
dhcpcd	10.3.2	CVE-2026-56116	6.5	dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement...
git	2.55.0	CVE-2022-38663	6.5	Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build ...
gitea	1.27.3	CVE-2026-104633	6.5	When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API...
gitea	1.27.3	CVE-2026-95112	6.5	When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes...
gitea	1.27.3-go-modules	CVE-2026-104633	6.5	When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API...
gitea	1.27.3-go-modules	CVE-2026-95112	6.5	When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes...
glibc	2.42	CVE-2026-6238	6.5	The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fai...
glibc	2.42-84	CVE-2026-6238	6.5	The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fai...
glibc	2.42-84-source-unsecvars	CVE-2026-6238	6.5	The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fai...
jbig2dec	0.20	CVE-2023-46361	6.5	Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.
jq	1.8.2	CVE-2026-39979	6.5	jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized()...
jq	1.8.2-binlore	CVE-2026-39979	6.5	jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized()...
libmpeg2	0.5.1	CVE-2022-37416	6.5	Ittiam libmpeg2 before 2022-07-27 uses memcpy with overlapping memory blocks in impeg2_mc_fullx_fully_8x8.
libsndfile	1.2.2	CVE-2024-50613	6.5	libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_en...
libssh2	1.11.1	CVE-2025-15661	6.5	libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlin...
libssh2	1.11.1	CVE-2026-58051	6.5	libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before par...
network	3.2.8.0	CVE-2021-35050	6.5	User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that a...
openssh	10.5p1	CVE-2026-106585	6.5	In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during de...
pip	20.3.4-source	CVE-2026-13346	6.5	pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary...
python	2.7.18.12	CVE-2021-3733	6.5	There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an H...
python	2.7.18.12	CVE-2022-48564	6.5	read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion w...
safe	0.3.21	CVE-2022-38164	6.5	A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website cou...
safe	0.3.21-r1.cabal	CVE-2022-38164	6.5	A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website cou...
unbound	1.26.0	CVE-2026-78227	6.5	NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-Q...
vault	0.3.1.6	CVE-2023-0620	6.5	HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when con...
vault	0.3.1.6	CVE-2023-0665	6.5	HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer ...
vault	0.3.1.6	CVE-2025-6014	6.5	Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse with...
wire	0.7.0	CVE-2021-32666	6.5	wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vul...
wire	0.7.0	CVE-2022-23625	6.5	Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malfor...
wire	0.7.0	CVE-2023-22737	6.5	wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 20...
wire	0.7.0-go-modules	CVE-2021-32666	6.5	wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vul...
wire	0.7.0-go-modules	CVE-2022-23625	6.5	Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malfor...
wire	0.7.0-go-modules	CVE-2023-22737	6.5	wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 20...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-32282	6.4	On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can ...
bison	3.8.2	CVE-2026-56390	6.3	GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow speci...
nix	0.29.0	CVE-2024-27297	6.3	Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descript...
nix	0.31.1	CVE-2024-27297	6.3	Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descript...
binutils	2.46	CVE-2025-69652	6.2	GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted EL...
vault	0.3.1.6	CVE-2024-8365	6.2	Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive heade...
cargo	1.98.1	CVE-2026-39839	6.1	Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation M...
cargo	1.98.1	CVE-2026-39840	6.1	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Found...
cargo	1.98.1	CVE-2026-39841	6.1	Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation M...
commonmark	0.2.6.1	CVE-2026-30838	6.1	league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed b...
coreutils	9.11	CVE-2026-56391	6.1	GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (-...
coreutils	9.11	CVE-2026-56392	6.1	GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocat...
git	2.55.0	CVE-2021-21684	6.1	Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notificatio...
gitea	1.27.3	CVE-2026-96594	6.1	The Gitea API endpoint GET /api/v1/repos/{owner}/{repo}/media/{filepath} wrote files of up to 1 KiB that are stored...
gitea	1.27.3-go-modules	CVE-2026-96594	6.1	The Gitea API endpoint GET /api/v1/repos/{owner}/{repo}/media/{filepath} wrote files of up to 1 KiB that are stored...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-27142	6.1	Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the met...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-32289	6.1	Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect esc...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-39823	6.1	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attr...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-39826	6.1	If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute ...
python	2.7.18.12	CVE-2026-6019	6.1	http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. ...
setuptools	44.0.0-source	CVE-2026-59890	6.1	setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior ...
cjson	1.7.19	CVE-2026-67216	5.9	cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, ...
curl	0.4.49	CVE-2022-43552	5.9	A use after free vulnerability exists in curl <7.87.0. Curl can be asked to tunnel virtually all protocols it suppo...
curl	0.4.49	CVE-2023-28320	5.9	A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for r...
curl	0.4.49	CVE-2023-28321	5.9	An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard p...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-39817	5.9	The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not...
libssh2	1.11.1	CVE-2026-55199	5.9	libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the...
python	2.7.18.12	CVE-2021-23336	5.9	The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from ...
python	2.7.18.12	CVE-2022-48566	5.9	An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisatio...
setuptools	44.0.0-source	CVE-2022-40897	5.9	Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via H...
unbound	1.26.0	CVE-2026-82720	5.9	NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HT...
warp	3.4.9	CVE-2022-2145	5.8	Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData fold...
pip	20.3.4-source	CVE-2021-3572	5.7	A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could po...
wire	0.7.0	CVE-2022-31009	5.7	wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication part...
wire	0.7.0-go-modules	CVE-2022-31009	5.7	wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication part...
avahi	0.8	CVE-2025-59529	5.5	Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versi...
binutils	2.46	CVE-2025-69651	5.5	GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a craft...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-32288	5.5	tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large n...
jq	1.8.2	CVE-2026-44777	5.5	jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detec...
libsndfile	1.2.2	CVE-2024-50612	5.5	libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read.
ninja	1.13.2	CVE-2021-4336	5.5	A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by thi...
patch	2.8	CVE-2026-56288	5.5	GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Im...
patch	2.8	CVE-2026-56289	5.5	GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in d...
pip	20.3.4-source	CVE-2023-5752	5.5	When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified...
pip	20.3.4-source	CVE-2026-8643	5.5	pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolu...
python	2.7.18.12	CVE-2025-13837	5.5	When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious f...
python	2.7.18.12	CVE-2025-6075	5.5	If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding ...
python	2.7.18.12	CVE-2026-0864	5.5	When using the "configparser" module to write configuration files containing multi-line text values with carriage ret...
python	3.14.6	CVE-2026-0864	5.5	When using the "configparser" module to write configuration files containing multi-line text values with carriage ret...
unzip	6.0	CVE-2022-0529	5.5	A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that lea...
unzip	6.0	CVE-2022-0530	5.5	A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that lea...
warp	3.4.9	CVE-2022-4457	5.5	Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hi...
yaml	0.11.11.2	CVE-2021-4235	5.5	Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system re...
yaml	0.11.11.2-r2.cabal	CVE-2021-4235	5.5	Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system re...
yasm	1.3.0	CVE-2021-33454	5.5	An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr_get_intnum() in libya...
yasm	1.3.0	CVE-2021-33455	5.5	An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in do_directive() in modules/prepr...
yasm	1.3.0	CVE-2021-33456	5.5	An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in hash() in modules/preprocs/nasm...
yasm	1.3.0	CVE-2021-33457	5.5	An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmac_params() in modules...
yasm	1.3.0	CVE-2021-33458	5.5	An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in find_cc() in modules/preprocs/n...
yasm	1.3.0	CVE-2021-33459	5.5	An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in nasm_parser_directive() in modu...
yasm	1.3.0	CVE-2021-33460	5.5	An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in if_condition() in modules/prepr...
yasm	1.3.0	CVE-2021-33461	5.5	An issue was discovered in yasm version 1.3.0. There is a use-after-free in yasm_intnum_destroy() in libyasm/intnum.c.
yasm	1.3.0	CVE-2021-33462	5.5	An issue was discovered in yasm version 1.3.0. There is a use-after-free in expr_traverse_nodes_post() in libyasm/exp...
yasm	1.3.0	CVE-2021-33463	5.5	An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr__copy_except() in lib...
yasm	1.3.0	CVE-2021-33464	5.5	An issue was discovered in yasm version 1.3.0. There is a heap-buffer-overflow in inc_fopen() in modules/preprocs/nas...
yasm	1.3.0	CVE-2021-33465	5.5	An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmacro() in modules/prep...
yasm	1.3.0	CVE-2021-33466	5.5	An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_smacro() in modules/prep...
yasm	1.3.0	CVE-2021-33467	5.5	An issue was discovered in yasm version 1.3.0. There is a use-after-free in pp_getline() in modules/preprocs/nasm/nas...
yasm	1.3.0	CVE-2021-33468	5.5	An issue was discovered in yasm version 1.3.0. There is a use-after-free in error() in modules/preprocs/nasm/nasm-pp.c.
yasm	1.3.0	CVE-2023-30402	5.5	YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re. Note:...
yasm	1.3.0	CVE-2023-31972	5.5	yasm v1.3.0 was discovered to contain a use after free via the function pp_getline at /nasm/nasm-pp.c. Note: Multiple...
yasm	1.3.0	CVE-2023-31973	5.5	yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c. Note: ...
yasm	1.3.0	CVE-2023-31974	5.5	yasm v1.3.0 was discovered to contain a use after free via the function error at /nasm/nasm-pp.c. Note: Multiple thir...
yasm	1.3.0	CVE-2023-51258	5.5	A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the new_Token...
cargo	1.98.1	CVE-2026-39837	5.4	Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - ...
cargo	1.98.1	CVE-2026-58519	5.4	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia F...
gitea	1.27.3	CVE-2026-103667	5.4	Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed i...
gitea	1.27.3	CVE-2026-89182	5.4	With [repository] FORCE_PRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still ...
gitea	1.27.3-go-modules	CVE-2026-103667	5.4	Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed i...
gitea	1.27.3-go-modules	CVE-2026-89182	5.4	With [repository] FORCE_PRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still ...
glibc	2.42	CVE-2026-4438	5.4	Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in ...
glibc	2.42-84	CVE-2026-4438	5.4	Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in ...
glibc	2.42-84-source-unsecvars	CVE-2026-4438	5.4	Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in ...
safe	0.3.21	CVE-2022-47524	5.4	F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack.
safe	0.3.21-r1.cabal	CVE-2022-47524	5.4	F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack.
subversion	1.14.5	CVE-2022-29046	5.4	Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and mo...
wire	0.7.0	CVE-2021-32755	5.4	Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retrie...
wire	0.7.0-go-modules	CVE-2021-32755	5.4	Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retrie...
Diff	1.0.2	CVE-2026-73478	5.3	Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from...
ada	4.0.0	CVE-2024-9410	5.3	Ada.cx's Sentry configuration allowed for blind server-side request forgeries (SSRF) through the use of a data scrapi...
binutils	2.47	CVE-2026-90801	5.3	A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cach...
binutils	2.47	CVE-2026-90803	5.3	A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x...
binutils	2.47	CVE-2026-90828	5.3	A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatib...
binutils	2.47	CVE-2026-90829	5.3	A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of th...
binutils	2.47	CVE-2026-90830	5.3	A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section o...
binutils	2.47	CVE-2026-90831	5.3	A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the...
cjson	1.7.19	CVE-2026-67217	5.3	cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a r...
dhcpcd	10.3.2	CVE-2026-56113	5.3	dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthentica...
dhcpcd	10.3.2	CVE-2026-56114	5.3	dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_...
git	2.55.0	CVE-2022-36884	5.3	The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-39819	5.3	The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-39825	5.3	ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite fun...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-42505	5.3	Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure...
libsndfile	1.2.2	CVE-2025-56226	5.3	Libsndfile <=1.2.2 contains a memory leak vulnerability in the mpeg_l3_encoder_init() function within the mpeg_l3_enc...
mercurial	7.2.2	CVE-2022-43410	5.3	Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or sch...
mercurial	7.2.2-vendor	CVE-2022-43410	5.3	Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or sch...
mercurial	7.2.2-vendor-staging	CVE-2022-43410	5.3	Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or sch...
openssl	3.6.4	CVE-2026-35189	5.3	Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap g...
openssl	3.6.4	CVE-2026-42772	5.3	Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving ou...
openssl	3.6.4	CVE-2026-75804	5.3	Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send m...
openssl	3.6.4	CVE-2026-75805	5.3	Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL...
openssl	3.6.4	CVE-2026-75806	5.3	Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthent...
openssl	4.0.2	CVE-2026-35189	5.3	Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap g...
openssl	4.0.2	CVE-2026-42772	5.3	Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving ou...
openssl	4.0.2	CVE-2026-75804	5.3	Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send m...
openssl	4.0.2	CVE-2026-75805	5.3	Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL...
openssl	4.0.2	CVE-2026-75806	5.3	Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthent...
python	2.7.18.12	CVE-2023-40217	5.3	An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5...
python	2.7.18.12	CVE-2025-12084	5.3	When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id...
python	2.7.18.12	CVE-2025-12781	5.3	When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module ...
python	2.7.18.12	CVE-2026-4360	5.3	In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected...
unbound	1.26.0	CVE-2026-80225	5.3	In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT rea...
unbound	1.26.0	CVE-2026-85501	5.3	Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'...
vault	0.3.1.6	CVE-2021-3024	5.3	HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some inva...
vault	0.3.1.6	CVE-2021-38554	5.3	HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a si...
vault	0.3.1.6	CVE-2022-41316	5.3	HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured C...
vault	0.3.1.6	CVE-2023-25000	5.0	HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cac...
gitea	1.27.3	CVE-2026-97208	4.9	The Gitea API endpoint for creating push mirrors (POST /api/v1/repos/{owner}/{repo}/push_mirrors) checked only whet...
gitea	1.27.3-go-modules	CVE-2026-97208	4.9	The Gitea API endpoint for creating push mirrors (POST /api/v1/repos/{owner}/{repo}/push_mirrors) checked only whet...
go	1.24.13-linux-amd64-bootstrap	CVE-2023-49292	4.9	ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsu...
go	1.26.7	CVE-2023-49292	4.9	ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsu...
binutils	2.47	CVE-2026-90804	4.8	A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_f...
capstone	5.0.9	CVE-2025-67873	4.8	Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a ...
capstone	5.0.9	CVE-2025-68114	4.8	Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_con...
gcc	4.6.4	CVE-2023-4039	4.8	DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacke...
gcc	10.4.0	CVE-2023-4039	4.8	DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacke...
gcc	15.3.0	CVE-2023-4039	4.8	DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacke...
dhcpcd	10.3.2	CVE-2026-56117	4.7	dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket ha...
gzip	1.2.4	CVE-2026-41991	4.7	GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp u...
gzip	1.14	CVE-2026-41991	4.7	GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp u...
wire	0.7.0	CVE-2022-43673	4.7	Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (f...
wire	0.7.0-go-modules	CVE-2022-43673	4.7	Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (f...
safe	0.3.21	CVE-2021-40835	4.6	An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When user clicks on a specially cra...
safe	0.3.21-r1.cabal	CVE-2021-40835	4.6	An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When user clicks on a specially cra...
vault	0.3.1.6	CVE-2025-4166	4.5	Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information...
binutils	2.47	CVE-2026-90802	4.4	A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of ...
network	3.2.8.0	CVE-2022-0486	4.4	Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Decept...
unbound	1.26.0	CVE-2026-77955	4.4	In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: ye...
vault	0.3.1.6	CVE-2023-24999	4.4	HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle d...
gitea	1.27.3	CVE-2026-101029	4.3	Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DN...
gitea	1.27.3	CVE-2026-105268	4.3	The Gitea API routes for issue attachments (/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}) als...
gitea	1.27.3	CVE-2026-96400	4.3	With [migrations] ALLOWED_DOMAINS set to a matching entry such as * or a hostname wildcard, Gitea's migration URL...
gitea	1.27.3	CVE-2026-96589	4.3	When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read acces...
gitea	1.27.3-go-modules	CVE-2026-101029	4.3	Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DN...
gitea	1.27.3-go-modules	CVE-2026-105268	4.3	The Gitea API routes for issue attachments (/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}) als...
gitea	1.27.3-go-modules	CVE-2026-96400	4.3	With [migrations] ALLOWED_DOMAINS set to a matching entry such as * or a hostname wildcard, Gitea's migration URL...
gitea	1.27.3-go-modules	CVE-2026-96589	4.3	When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read acces...
safe	0.3.21	CVE-2021-40834	4.3	A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a spec...
safe	0.3.21	CVE-2021-44751	4.3	A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code...
safe	0.3.21	CVE-2022-28868	4.3	An Address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially cra...
safe	0.3.21	CVE-2022-28869	4.3	A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing a...
safe	0.3.21	CVE-2022-28870	4.3	A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing a...
safe	0.3.21	CVE-2022-28872	4.3	A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing a...
safe	0.3.21	CVE-2022-28873	4.3	A vulnerability affecting F-Secure SAFE browser was discovered. An attacker can potentially exploit Javascript window...
safe	0.3.21-r1.cabal	CVE-2021-40834	4.3	A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a spec...
safe	0.3.21-r1.cabal	CVE-2021-44751	4.3	A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code...
safe	0.3.21-r1.cabal	CVE-2022-28868	4.3	An Address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially cra...
safe	0.3.21-r1.cabal	CVE-2022-28869	4.3	A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing a...
safe	0.3.21-r1.cabal	CVE-2022-28870	4.3	A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing a...
safe	0.3.21-r1.cabal	CVE-2022-28872	4.3	A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing a...
safe	0.3.21-r1.cabal	CVE-2022-28873	4.3	A vulnerability affecting F-Secure SAFE browser was discovered. An attacker can potentially exploit Javascript window...
subversion	1.14.5	CVE-2022-29048	4.3	A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to...
vault	0.3.1.6	CVE-2023-2121	4.3	Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI th...
yarn	1.22.22	CVE-2025-8262	4.3	A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the funct...
openssh	10.5p1	CVE-2026-106552	4.2	In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended l...
hedgehog	1.5	CVE-2021-4276	4.1	** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Af...
hedgehog	1.5-r2.cabal	CVE-2021-4276	4.1	** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Af...
zlib	0.7.1.1	CVE-2023-6992	4.0	Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation alg...
zlib	1.3.2	CVE-2023-6992	4.0	Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation alg...
imagemagick	7.1.2-31	CVE-2026-105083	3.9	ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently ski...
network	3.2.8.0	CVE-2022-0997	3.9	Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enabl...
warp	3.4.9	CVE-2023-0238	3.9	Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability w...
warp	3.4.9	CVE-2023-0654	3.9	Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the...
curl	0.4.49	CVE-2022-35252	3.7	When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that whe...
curl	0.4.49	CVE-2023-28322	3.7	An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneousl...
imagemagick	7.1.2-31	CVE-2026-102635	3.7	ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's ...
openssh	10.5p1	CVE-2026-106582	3.7	In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by t...
openssl	3.6.4	CVE-2026-35191	3.7	Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count inc...
openssl	3.6.4	CVE-2026-54872	3.7	Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curv...
openssl	3.6.4	CVE-2026-54875	3.7	Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private ke...
openssl	3.6.4	CVE-2026-77696	3.7	Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-cha...
openssl	4.0.2	CVE-2026-35191	3.7	Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count inc...
openssl	4.0.2	CVE-2026-54872	3.7	Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curv...
openssl	4.0.2	CVE-2026-54875	3.7	Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private ke...
openssl	4.0.2	CVE-2026-77696	3.7	Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-cha...
unbound	1.26.0	CVE-2026-77860	3.7	In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a ...
vault	0.3.1.6	CVE-2025-6011	3.7	A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distingui...
openssh	10.5p1	CVE-2026-106587	3.6	In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename bu...
safe	0.3.21	CVE-2021-33594	3.5	An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially cra...
safe	0.3.21	CVE-2021-33595	3.5	A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the addres...
safe	0.3.21	CVE-2021-33596	3.5	Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believ...
safe	0.3.21	CVE-2022-38163	3.5	A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and belo...
safe	0.3.21-r1.cabal	CVE-2021-33594	3.5	An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially cra...
safe	0.3.21-r1.cabal	CVE-2021-33595	3.5	A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the addres...
safe	0.3.21-r1.cabal	CVE-2021-33596	3.5	Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believ...
safe	0.3.21-r1.cabal	CVE-2022-38163	3.5	A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and belo...
binutils	2.47	CVE-2026-91779	3.3	A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset ...
binutils	2.47	CVE-2026-91780	3.3	A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the fil...
binutils	2.47	CVE-2026-91781	3.3	A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_i...
binutils	2.47	CVE-2026-91782	3.3	A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dy...
python	2.7.18.12	CVE-2025-13462	3.3	The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a mu...
python	2.7.18.12	CVE-2026-4519	3.3	The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for ...
unzip	6.0	CVE-2021-4217	3.3	A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a ...
yarn	1.22.22	CVE-2025-9308	3.3	A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/ut...
yasm	1.3.0	CVE-2023-31975	3.3	yasm v1.3.0 was discovered to contain a memory leak via the function yasm_intnum_copy at /libyasm/intnum.c. Note: Mul...
busybox	1.37.0	CVE-2025-46394	3.2	In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal ...
uuid	1.20.0	CVE-2026-41988	3.2	uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or...
vault	0.3.1.6	CVE-2021-41802	2.9	HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ...
wire	0.7.0	CVE-2021-21301	2.6	Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulne...
wire	0.7.0-go-modules	CVE-2021-21301	2.6	Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulne...
go	1.24.13-linux-amd64-bootstrap	CVE-2026-27139	2.5	On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo ...
openssh	10.5p1	CVE-2026-106583	2.5	In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
openssh	10.5p1	CVE-2026-106584	2.5	In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving m...
openssh	10.5p1	CVE-2026-106586	2.5	In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel for...
openssh	10.5p1	CVE-2026-106553	2.2	In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentic...
openssh	10.5p1	CVE-2026-106555	2.2	In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authent...

vulnix scan (2026-10-19): **476** CVEs across **90** packages. | Package | Version | CVE | CVSS | Description | |---------|---------|-----|------|-------------| | network | 3.2.8.0 | [CVE-2021-35047](https://nvd.nist.gov/vuln/detail/CVE-2021-35047) | 9.9 | Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attack... | | network | 3.2.8.0 | [CVE-2021-35049](https://nvd.nist.gov/vuln/detail/CVE-2021-35049) | 9.9 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web in... | | ShellCheck | 0.11.0 | [CVE-2021-28794](https://nvd.nist.gov/vuln/detail/CVE-2021-28794) | 9.8 | The unofficial ShellCheck extension before 0.13.4 for Visual Studio Code mishandles shellcheck.executablePath. | | cargo | 1.98.1 | [CVE-2026-14363](https://nvd.nist.gov/vuln/detail/CVE-2026-14363) | 9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia F... | | cargo | 1.98.1 | [CVE-2026-58521](https://nvd.nist.gov/vuln/detail/CVE-2026-58521) | 9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia F... | | curl | 0.4.49 | [CVE-2022-32221](https://nvd.nist.gov/vuln/detail/CVE-2022-32221) | 9.8 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for dat... | | gitea | 1.27.3 | [CVE-2026-94205](https://nvd.nist.gov/vuln/detail/CVE-2026-94205) | 9.8 | Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rathe... | | gitea | 1.27.3-go-modules | [CVE-2026-94205](https://nvd.nist.gov/vuln/detail/CVE-2026-94205) | 9.8 | Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rathe... | | glibc | 2.42 | [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) | 9.8 | Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to versi... | | glibc | 2.42-84 | [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) | 9.8 | Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to versi... | | glibc | 2.42-84-source-unsecvars | [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) | 9.8 | Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to versi... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-27143](https://nvd.nist.gov/vuln/detail/CVE-2026-27143) | 9.8 | Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the c... | | libraw | 0.22.1 | [CVE-2026-20911](https://nvd.nist.gov/vuln/detail/CVE-2026-20911) | 9.8 | A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 an... | | libraw | 0.22.1 | [CVE-2026-21413](https://nvd.nist.gov/vuln/detail/CVE-2026-21413) | 9.8 | A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b5654... | | network | 3.2.8.0 | [CVE-2021-35048](https://nvd.nist.gov/vuln/detail/CVE-2021-35048) | 9.8 | Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web inte... | | orc | 0.4.42 | [CVE-2025-47436](https://nvd.nist.gov/vuln/detail/CVE-2025-47436) | 9.8 | Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decom... | | perl | 5.42.3 | [CVE-2026-8376](https://nvd.nist.gov/vuln/detail/CVE-2026-8376) | 9.8 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflo... | | perl | 5.42.3-env | [CVE-2026-8376](https://nvd.nist.gov/vuln/detail/CVE-2026-8376) | 9.8 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflo... | | python | 2.7.18.12 | [CVE-2022-48565](https://nvd.nist.gov/vuln/detail/CVE-2022-48565) | 9.8 | An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts enti... | | snappy | 1.2.2 | [CVE-2023-28115](https://nvd.nist.gov/vuln/detail/CVE-2023-28115) | 9.8 | Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.... | | snappy | 1.2.2 | [CVE-2023-41330](https://nvd.nist.gov/vuln/detail/CVE-2023-41330) | 9.8 | knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. ## Issu... | | unbound | 1.26.0 | [CVE-2026-81642](https://nvd.nist.gov/vuln/detail/CVE-2026-81642) | 9.8 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables deni... | | unbound | 1.26.0 | [CVE-2026-82717](https://nvd.nist.gov/vuln/detail/CVE-2026-82717) | 9.8 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap me... | | zlib | 0.7.1.1 | [CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434) | 9.8 | zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip hea... | | zlib | 0.7.1.1 | [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853) | 9.8 | MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_... | | zlib | 0.7.1.1 | [CVE-2026-27820](https://nvd.nist.gov/vuln/detail/CVE-2026-27820) | 9.8 | zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.... | | zlib | 1.3.2 | [CVE-2026-27820](https://nvd.nist.gov/vuln/detail/CVE-2026-27820) | 9.8 | zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.... | | Diff | 1.0.2 | [CVE-2024-13278](https://nvd.nist.gov/vuln/detail/CVE-2024-13278) | 9.1 | Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 ... | | gitea | 1.27.3 | [CVE-2026-101023](https://nvd.nist.gov/vuln/detail/CVE-2026-101023) | 9.1 | Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant ty... | | gitea | 1.27.3 | [CVE-2026-103059](https://nvd.nist.gov/vuln/detail/CVE-2026-103059) | 9.1 | When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with ... | | gitea | 1.27.3 | [CVE-2026-95106](https://nvd.nist.gov/vuln/detail/CVE-2026-95106) | 9.1 | Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject.... | | gitea | 1.27.3-go-modules | [CVE-2026-101023](https://nvd.nist.gov/vuln/detail/CVE-2026-101023) | 9.1 | Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant ty... | | gitea | 1.27.3-go-modules | [CVE-2026-103059](https://nvd.nist.gov/vuln/detail/CVE-2026-103059) | 9.1 | When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with ... | | gitea | 1.27.3-go-modules | [CVE-2026-95106](https://nvd.nist.gov/vuln/detail/CVE-2026-95106) | 9.1 | Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject.... | | lapack | 3 | [CVE-2021-4048](https://nvd.nist.gov/vuln/detail/CVE-2021-4048) | 9.1 | An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.... | | perl | 5.42.3 | [CVE-2026-13221](https://nvd.nist.gov/vuln/detail/CVE-2026-13221) | 9.1 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect... | | perl | 5.42.3-env | [CVE-2026-13221](https://nvd.nist.gov/vuln/detail/CVE-2026-13221) | 9.1 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect... | | warp | 3.4.9 | [CVE-2022-4428](https://nvd.nist.gov/vuln/detail/CVE-2022-4428) | 8.9 | support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for pri... | | git | 2.55.0 | [CVE-2022-36882](https://nvd.nist.gov/vuln/detail/CVE-2022-36882) | 8.8 | A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigge... | | gitea | 1.27.3 | [CVE-2026-104626](https://nvd.nist.gov/vuln/detail/CVE-2026-104626) | 8.8 | A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a G... | | gitea | 1.27.3 | [CVE-2026-104632](https://nvd.nist.gov/vuln/detail/CVE-2026-104632) | 8.8 | Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer appr... | | gitea | 1.27.3-go-modules | [CVE-2026-104626](https://nvd.nist.gov/vuln/detail/CVE-2026-104626) | 8.8 | A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a G... | | gitea | 1.27.3-go-modules | [CVE-2026-104632](https://nvd.nist.gov/vuln/detail/CVE-2026-104632) | 8.8 | Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer appr... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-27140](https://nvd.nist.gov/vuln/detail/CVE-2026-27140) | 8.8 | SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution ... | | gzip | 1.2.4 | [CVE-2022-1271](https://nvd.nist.gov/vuln/detail/CVE-2022-1271) | 8.8 | An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's ... | | libssh2 | 1.11.1 | [CVE-2026-66032](https://nvd.nist.gov/vuln/detail/CVE-2026-66032) | 8.8 | libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in ... | | network | 3.2.8.0 | [CVE-2022-24388](https://nvd.nist.gov/vuln/detail/CVE-2022-24388) | 8.8 | Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands i... | | network | 3.2.8.0 | [CVE-2022-24389](https://nvd.nist.gov/vuln/detail/CVE-2022-24389) | 8.8 | Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level comm... | | network | 3.2.8.0 | [CVE-2022-24390](https://nvd.nist.gov/vuln/detail/CVE-2022-24390) | 8.8 | Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user leve... | | network | 3.2.8.0 | [CVE-2022-24391](https://nvd.nist.gov/vuln/detail/CVE-2022-24391) | 8.8 | Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an atta... | | network | 3.2.8.0 | [CVE-2022-24392](https://nvd.nist.gov/vuln/detail/CVE-2022-24392) | 8.8 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web in... | | network | 3.2.8.0 | [CVE-2022-24393](https://nvd.nist.gov/vuln/detail/CVE-2022-24393) | 8.8 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web in... | | network | 3.2.8.0 | [CVE-2022-24394](https://nvd.nist.gov/vuln/detail/CVE-2022-24394) | 8.8 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web in... | | python | 2.7.18.12 | [CVE-2024-49050](https://nvd.nist.gov/vuln/detail/CVE-2024-49050) | 8.8 | Visual Studio Code Python Extension Remote Code Execution Vulnerability | | python | 3.14.6 | [CVE-2024-49050](https://nvd.nist.gov/vuln/detail/CVE-2024-49050) | 8.8 | Visual Studio Code Python Extension Remote Code Execution Vulnerability | | setuptools | 44.0.0-source | [CVE-2025-47273](https://nvd.nist.gov/vuln/detail/CVE-2025-47273) | 8.8 | setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path... | | wire | 0.7.0 | [CVE-2021-32665](https://nvd.nist.gov/vuln/detail/CVE-2021-32665) | 8.8 | wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a ... | | wire | 0.7.0-go-modules | [CVE-2021-32665](https://nvd.nist.gov/vuln/detail/CVE-2021-32665) | 8.8 | wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a ... | | yoke | 0.8.1 | [CVE-2026-26056](https://nvd.nist.gov/vuln/detail/CVE-2026-26056) | 8.8 | Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists ... | | bison | 3.8.2 | [CVE-2026-56389](https://nvd.nist.gov/vuln/detail/CVE-2026-56389) | 8.6 | GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of g... | | libsoup | 3.6.6 | [CVE-2026-102556](https://nvd.nist.gov/vuln/detail/CVE-2026-102556) | 8.6 | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::po... | | libsoup | 3.6.6 | [CVE-2026-102557](https://nvd.nist.gov/vuln/detail/CVE-2026-102557) | 8.6 | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequ... | | libsoup | 3.6.6 | [CVE-2026-102558](https://nvd.nist.gov/vuln/detail/CVE-2026-102558) | 8.6 | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its ... | | glibc | 2.42 | [CVE-2026-0861](https://nvd.nist.gov/vuln/detail/CVE-2026-0861) | 8.4 | Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GN... | | perl | 5.42.3 | [CVE-2026-57432](https://nvd.nist.gov/vuln/detail/CVE-2026-57432) | 8.4 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow i... | | perl | 5.42.3-env | [CVE-2026-57432](https://nvd.nist.gov/vuln/detail/CVE-2026-57432) | 8.4 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow i... | | rubygems | 3.7.2 | [CVE-2022-36073](https://nvd.nist.gov/vuln/detail/CVE-2022-36073) | 8.3 | RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker t... | | libsoup | 3.6.6 | [CVE-2026-102555](https://nvd.nist.gov/vuln/detail/CVE-2026-102555) | 8.2 | A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as ... | | openssl | 3.6.4 | [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) | 8.2 | Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended pa... | | openssl | 4.0.2 | [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) | 8.2 | Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended pa... | | stringbuilder | 0.5.1 | [CVE-2024-21524](https://nvd.nist.gov/vuln/detail/CVE-2024-21524) | 8.2 | All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length ca... | | gitea | 1.27.3 | [CVE-2026-105267](https://nvd.nist.gov/vuln/detail/CVE-2026-105267) | 8.1 | The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code uni... | | gitea | 1.27.3 | [CVE-2026-89430](https://nvd.nist.gov/vuln/detail/CVE-2026-89430) | 8.1 | Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror ... | | gitea | 1.27.3 | [CVE-2026-96404](https://nvd.nist.gov/vuln/detail/CVE-2026-96404) | 8.1 | When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` ... | | gitea | 1.27.3-go-modules | [CVE-2026-105267](https://nvd.nist.gov/vuln/detail/CVE-2026-105267) | 8.1 | The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code uni... | | gitea | 1.27.3-go-modules | [CVE-2026-89430](https://nvd.nist.gov/vuln/detail/CVE-2026-89430) | 8.1 | Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror ... | | gitea | 1.27.3-go-modules | [CVE-2026-96404](https://nvd.nist.gov/vuln/detail/CVE-2026-96404) | 8.1 | When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` ... | | grafana | 13.1.6 | [CVE-2023-34111](https://nvd.nist.gov/vuln/detail/CVE-2023-34111) | 8.1 | The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerab... | | grafana | 13.1.6-go-modules | [CVE-2023-34111](https://nvd.nist.gov/vuln/detail/CVE-2023-34111) | 8.1 | The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerab... | | libraw | 0.22.1 | [CVE-2026-20884](https://nvd.nist.gov/vuln/detail/CVE-2026-20884) | 8.1 | An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specia... | | libraw | 0.22.1 | [CVE-2026-24450](https://nvd.nist.gov/vuln/detail/CVE-2026-24450) | 8.1 | An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. ... | | libssh2 | 1.11.1 | [CVE-2026-55200](https://nvd.nist.gov/vuln/detail/CVE-2026-55200) | 8.1 | libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read(... | | vault | 0.3.1.6 | [CVE-2024-2048](https://nvd.nist.gov/vuln/detail/CVE-2024-2048) | 8.1 | Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when ... | | warp | 3.4.9 | [CVE-2022-2225](https://nvd.nist.gov/vuln/detail/CVE-2022-2225) | 8.1 | By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges t... | | async | 2.2.6 | [CVE-2021-43138](https://nvd.nist.gov/vuln/detail/CVE-2021-43138) | 7.8 | In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka li... | | avahi | 0.8 | [CVE-2021-26720](https://nvd.nist.gov/vuln/detail/CVE-2021-26720) | 7.8 | avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avah... | | binutils | 2.46 | [CVE-2026-6846](https://nvd.nist.gov/vuln/detail/CVE-2026-6846) | 7.8 | A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (... | | cjson | 1.7.19 | [CVE-2026-16554](https://nvd.nist.gov/vuln/detail/CVE-2026-16554) | 7.8 | cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms.... | | fontforge | 20251009 | [CVE-2025-15276](https://nvd.nist.gov/vuln/detail/CVE-2025-15276) | 7.8 | FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability ... | | fontforge | 20251009 | [CVE-2025-15277](https://nvd.nist.gov/vuln/detail/CVE-2025-15277) | 7.8 | FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability ... | | fontforge | 20251009 | [CVE-2025-15278](https://nvd.nist.gov/vuln/detail/CVE-2025-15278) | 7.8 | FontForge GUtils XBM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows rem... | | gcc | 4.6.4 | [CVE-2021-37322](https://nvd.nist.gov/vuln/detail/CVE-2021-37322) | 7.8 | GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c. | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) | 7.8 | On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the f... | | python | 2.7.18.12 | [CVE-2024-9287](https://nvd.nist.gov/vuln/detail/CVE-2024-9287) | 7.8 | A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual... | | python | 2.7.18.12 | [CVE-2025-49714](https://nvd.nist.gov/vuln/detail/CVE-2025-49714) | 7.8 | Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code loc... | | python | 3.14.6 | [CVE-2025-49714](https://nvd.nist.gov/vuln/detail/CVE-2025-49714) | 7.8 | Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code loc... | | zlib | 0.7.1.1 | [CVE-2026-22184](https://nvd.nist.gov/vuln/detail/CVE-2026-22184) | 7.8 | zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib... | | gitea | 1.27.3 | [CVE-2026-101027](https://nvd.nist.gov/vuln/detail/CVE-2026-101027) | 7.7 | When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking ... | | gitea | 1.27.3-go-modules | [CVE-2026-101027](https://nvd.nist.gov/vuln/detail/CVE-2026-101027) | 7.7 | When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking ... | | binutils | 2.46 | [CVE-2025-69649](https://nvd.nist.gov/vuln/detail/CVE-2025-69649) | 7.5 | GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary... | | binutils | 2.46 | [CVE-2025-69650](https://nvd.nist.gov/vuln/detail/CVE-2025-69650) | 7.5 | GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malform... | | bytes | 1.11.0 | [CVE-2026-25541](https://nvd.nist.gov/vuln/detail/CVE-2026-25541) | 7.5 | Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to intege... | | cjson | 1.7.19 | [CVE-2026-67215](https://nvd.nist.gov/vuln/detail/CVE-2026-67215) | 7.5 | cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 J... | | commonmark | 0.2.6.1 | [CVE-2026-86430](https://nvd.nist.gov/vuln/detail/CVE-2026-86430) | 7.5 | league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detec... | | curl | 0.4.49 | [CVE-2022-27781](https://nvd.nist.gov/vuln/detail/CVE-2022-27781) | 7.5 | libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server'... | | curl | 0.4.49 | [CVE-2022-27782](https://nvd.nist.gov/vuln/detail/CVE-2022-27782) | 7.5 | libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should... | | curl | 0.4.49 | [CVE-2023-28319](https://nvd.nist.gov/vuln/detail/CVE-2023-28319) | 7.5 | A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's p... | | git | 2.55.0 | [CVE-2022-30947](https://nvd.nist.gov/vuln/detail/CVE-2022-30947) | 7.5 | Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories... | | git | 2.55.0 | [CVE-2022-36883](https://nvd.nist.gov/vuln/detail/CVE-2022-36883) | 7.5 | A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger build... | | gitea | 1.27.3 | [CVE-2026-103670](https://nvd.nist.gov/vuln/detail/CVE-2026-103670) | 7.5 | When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without... | | gitea | 1.27.3 | [CVE-2026-104636](https://nvd.nist.gov/vuln/detail/CVE-2026-104636) | 7.5 | Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request hea... | | gitea | 1.27.3 | [CVE-2026-70357](https://nvd.nist.gov/vuln/detail/CVE-2026-70357) | 7.5 | Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but th... | | gitea | 1.27.3 | [CVE-2026-96399](https://nvd.nist.gov/vuln/detail/CVE-2026-96399) | 7.5 | A repository's external issue tracker regular expression containing alternating capture groups could produce invalid ... | | gitea | 1.27.3 | [CVE-2026-96580](https://nvd.nist.gov/vuln/detail/CVE-2026-96580) | 7.5 | Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creati... | | gitea | 1.27.3-go-modules | [CVE-2026-103670](https://nvd.nist.gov/vuln/detail/CVE-2026-103670) | 7.5 | When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without... | | gitea | 1.27.3-go-modules | [CVE-2026-104636](https://nvd.nist.gov/vuln/detail/CVE-2026-104636) | 7.5 | Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request hea... | | gitea | 1.27.3-go-modules | [CVE-2026-70357](https://nvd.nist.gov/vuln/detail/CVE-2026-70357) | 7.5 | Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but th... | | gitea | 1.27.3-go-modules | [CVE-2026-96399](https://nvd.nist.gov/vuln/detail/CVE-2026-96399) | 7.5 | A repository's external issue tracker regular expression containing alternating capture groups could produce invalid ... | | gitea | 1.27.3-go-modules | [CVE-2026-96580](https://nvd.nist.gov/vuln/detail/CVE-2026-96580) | 7.5 | Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creati... | | glibc | 2.42 | [CVE-2025-15281](https://nvd.nist.gov/vuln/detail/CVE-2025-15281) | 7.5 | Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may ... | | glibc | 2.42 | [CVE-2026-0915](https://nvd.nist.gov/vuln/detail/CVE-2026-0915) | 7.5 | Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for n... | | glibc | 2.42 | [CVE-2026-4046](https://nvd.nist.gov/vuln/detail/CVE-2026-4046) | 7.5 | The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when conver... | | glibc | 2.42 | [CVE-2026-4437](https://nvd.nist.gov/vuln/detail/CVE-2026-4437) | 7.5 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in ... | | glibc | 2.42 | [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | 7.5 | Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps betwe... | | glibc | 2.42-84 | [CVE-2025-15281](https://nvd.nist.gov/vuln/detail/CVE-2025-15281) | 7.5 | Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may ... | | glibc | 2.42-84 | [CVE-2026-4046](https://nvd.nist.gov/vuln/detail/CVE-2026-4046) | 7.5 | The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when conver... | | glibc | 2.42-84 | [CVE-2026-4437](https://nvd.nist.gov/vuln/detail/CVE-2026-4437) | 7.5 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in ... | | glibc | 2.42-84 | [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | 7.5 | Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps betwe... | | glibc | 2.42-84-source-unsecvars | [CVE-2025-15281](https://nvd.nist.gov/vuln/detail/CVE-2025-15281) | 7.5 | Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may ... | | glibc | 2.42-84-source-unsecvars | [CVE-2026-4046](https://nvd.nist.gov/vuln/detail/CVE-2026-4046) | 7.5 | The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when conver... | | glibc | 2.42-84-source-unsecvars | [CVE-2026-4437](https://nvd.nist.gov/vuln/detail/CVE-2026-4437) | 7.5 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in ... | | glibc | 2.42-84-source-unsecvars | [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | 7.5 | Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps betwe... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) | 7.5 | url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280) | 7.5 | During chain building, the amount of work that is done is not correctly limited when a large number of intermediate c... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) | 7.5 | Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283) | 7.5 | If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connectio... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-33811](https://nvd.nist.gov/vuln/detail/CVE-2026-33811) | 7.5 | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory an... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-33814](https://nvd.nist.gov/vuln/detail/CVE-2026-33814) | 7.5 | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it re... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-39820](https://nvd.nist.gov/vuln/detail/CVE-2026-39820) | 7.5 | Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaust... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-39836](https://nvd.nist.gov/vuln/detail/CVE-2026-39836) | 7.5 | The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-42499](https://nvd.nist.gov/vuln/detail/CVE-2026-42499) | 7.5 | Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-42501](https://nvd.nist.gov/vuln/detail/CVE-2026-42501) | 7.5 | A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum dat... | | gzip | 1.2.4 | [CVE-2026-41992](https://nvd.nist.gov/vuln/detail/CVE-2026-41992) | 7.5 | GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of s... | | gzip | 1.14 | [CVE-2026-41992](https://nvd.nist.gov/vuln/detail/CVE-2026-41992) | 7.5 | GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of s... | | libsndfile | 1.2.2 | [CVE-2025-52194](https://nvd.nist.gov/vuln/detail/CVE-2025-52194) | 7.5 | A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing m... | | libsndfile | 1.2.2 | [CVE-2026-37555](https://nvd.nist.gov/vuln/detail/CVE-2026-37555) | 7.5 | An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t... | | libssh2 | 1.11.1 | [CVE-2026-66033](https://nvd.nist.gov/vuln/detail/CVE-2026-66033) | 7.5 | libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the... | | libssh2 | 1.11.1 | [CVE-2026-66034](https://nvd.nist.gov/vuln/detail/CVE-2026-66034) | 7.5 | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a maliciou... | | libssh2 | 1.11.1 | [CVE-2026-66035](https://nvd.nist.gov/vuln/detail/CVE-2026-66035) | 7.5 | libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability tha... | | openssl | 3.6.4 | [CVE-2026-54873](https://nvd.nist.gov/vuln/detail/CVE-2026-54873) | 7.5 | Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact sum... | | openssl | 3.6.4 | [CVE-2026-72897](https://nvd.nist.gov/vuln/detail/CVE-2026-72897) | 7.5 | Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way throu... | | openssl | 3.6.4 | [CVE-2026-84784](https://nvd.nist.gov/vuln/detail/CVE-2026-84784) | 7.5 | Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a lim... | | openssl | 4.0.2 | [CVE-2026-54873](https://nvd.nist.gov/vuln/detail/CVE-2026-54873) | 7.5 | Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact sum... | | openssl | 4.0.2 | [CVE-2026-72897](https://nvd.nist.gov/vuln/detail/CVE-2026-72897) | 7.5 | Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way throu... | | openssl | 4.0.2 | [CVE-2026-84783](https://nvd.nist.gov/vuln/detail/CVE-2026-84783) | 7.5 | Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extensi... | | openssl | 4.0.2 | [CVE-2026-84784](https://nvd.nist.gov/vuln/detail/CVE-2026-84784) | 7.5 | Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a lim... | | python | 2.7.18.12 | [CVE-2022-0391](https://nvd.nist.gov/vuln/detail/CVE-2022-0391) | 7.5 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Loc... | | python | 2.7.18.12 | [CVE-2022-45061](https://nvd.nist.gov/vuln/detail/CVE-2022-45061) | 7.5 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processin... | | python | 2.7.18.12 | [CVE-2022-48560](https://nvd.nist.gov/vuln/detail/CVE-2022-48560) | 7.5 | A use-after-free exists in Python through 3.9 via heappushpop in heapq. | | python | 2.7.18.12 | [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329) | 7.5 | An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by sup... | | python | 2.7.18.12 | [CVE-2023-36632](https://nvd.nist.gov/vuln/detail/CVE-2023-36632) | 7.5 | The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maxim... | | python | 2.7.18.12 | [CVE-2024-6232](https://nvd.nist.gov/vuln/detail/CVE-2024-6232) | 7.5 | There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtrack... | | python | 2.7.18.12 | [CVE-2024-7592](https://nvd.nist.gov/vuln/detail/CVE-2024-7592) | 7.5 | There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. W... | | python | 2.7.18.12 | [CVE-2025-13836](https://nvd.nist.gov/vuln/detail/CVE-2025-13836) | 7.5 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Cont... | | python | 2.7.18.12 | [CVE-2026-15308](https://nvd.nist.gov/vuln/detail/CVE-2026-15308) | 7.5 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated m... | | python | 2.7.18.12 | [CVE-2026-3087](https://nvd.nist.gov/vuln/detail/CVE-2026-3087) | 7.5 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then... | | python | 2.7.18.12 | [CVE-2026-3644](https://nvd.nist.gov/vuln/detail/CVE-2026-3644) | 7.5 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.updat... | | python | 2.7.18.12 | [CVE-2026-4224](https://nvd.nist.gov/vuln/detail/CVE-2026-4224) | 7.5 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deep... | | python | 2.7.18.12 | [CVE-2026-7210](https://nvd.nist.gov/vuln/detail/CVE-2026-7210) | 7.5 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which al... | | python | 3.14.6 | [CVE-2026-15308](https://nvd.nist.gov/vuln/detail/CVE-2026-15308) | 7.5 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated m... | | sassc | 3.6.2 | [CVE-2022-43357](https://nvd.nist.gov/vuln/detail/CVE-2022-43357) | 7.5 | Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:... | | subversion | 1.14.5 | [CVE-2021-21698](https://nvd.nist.gov/vuln/detail/CVE-2021-21698) | 7.5 | Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key fi... | | unbound | 1.26.0 | [CVE-2026-81634](https://nvd.nist.gov/vuln/detail/CVE-2026-81634) | 7.5 | In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a hea... | | uuid | 1.20.0 | [CVE-2026-41907](https://nvd.nist.gov/vuln/detail/CVE-2026-41907) | 7.5 | uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output ... | | vault | 0.3.1.6 | [CVE-2021-27400](https://nvd.nist.gov/vuln/detail/CVE-2021-27400) | 7.5 | HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did ... | | vault | 0.3.1.6 | [CVE-2023-6337](https://nvd.nist.gov/vuln/detail/CVE-2023-6337) | 7.5 | HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion... | | vault | 0.3.1.6 | [CVE-2026-5807](https://nvd.nist.gov/vuln/detail/CVE-2026-5807) | 7.5 | Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or can... | | wheel | 0.37.1-source | [CVE-2022-40898](https://nvd.nist.gov/vuln/detail/CVE-2022-40898) | 7.5 | An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a ... | | wire | 0.7.0 | [CVE-2026-45799](https://nvd.nist.gov/vuln/detail/CVE-2026-45799) | 7.5 | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteA... | | wire | 0.7.0-go-modules | [CVE-2026-45799](https://nvd.nist.gov/vuln/detail/CVE-2026-45799) | 7.5 | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteA... | | yaml | 0.11.11.2 | [CVE-2022-3064](https://nvd.nist.gov/vuln/detail/CVE-2022-3064) | 7.5 | Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. | | yaml | 0.11.11.2-r2.cabal | [CVE-2022-3064](https://nvd.nist.gov/vuln/detail/CVE-2022-3064) | 7.5 | Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. | | yoke | 0.8.1 | [CVE-2026-26055](https://nvd.nist.gov/vuln/detail/CVE-2026-26055) | 7.5 | Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists ... | | warp | 3.4.9 | [CVE-2023-2754](https://nvd.nist.gov/vuln/detail/CVE-2023-2754) | 7.4 | The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local ... | | wire | 0.7.0 | [CVE-2021-41093](https://nvd.nist.gov/vuln/detail/CVE-2021-41093) | 7.4 | Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token t... | | wire | 0.7.0-go-modules | [CVE-2021-41093](https://nvd.nist.gov/vuln/detail/CVE-2021-41093) | 7.4 | Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token t... | | glibc | 2.42 | [CVE-2026-5435](https://nvd.nist.gov/vuln/detail/CVE-2026-5435) | 7.3 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enf... | | glibc | 2.42-84 | [CVE-2026-5435](https://nvd.nist.gov/vuln/detail/CVE-2026-5435) | 7.3 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enf... | | glibc | 2.42-84-source-unsecvars | [CVE-2026-5435](https://nvd.nist.gov/vuln/detail/CVE-2026-5435) | 7.3 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enf... | | libssh2 | 1.11.1 | [CVE-2026-7598](https://nvd.nist.gov/vuln/detail/CVE-2026-7598) | 7.3 | A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_pas... | | warp | 3.4.9 | [CVE-2023-1862](https://nvd.nist.gov/vuln/detail/CVE-2023-1862) | 7.3 | Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.ex... | | gitea | 1.27.3 | [CVE-2026-79960](https://nvd.nist.gov/vuln/detail/CVE-2026-79960) | 7.1 | When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission che... | | gitea | 1.27.3 | [CVE-2026-86684](https://nvd.nist.gov/vuln/detail/CVE-2026-86684) | 7.1 | The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file sy... | | gitea | 1.27.3-go-modules | [CVE-2026-79960](https://nvd.nist.gov/vuln/detail/CVE-2026-79960) | 7.1 | When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission che... | | gitea | 1.27.3-go-modules | [CVE-2026-86684](https://nvd.nist.gov/vuln/detail/CVE-2026-86684) | 7.1 | The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file sy... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) | 7.1 | The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion preven... | | grafana | 13.1.6 | [CVE-2026-14199](https://nvd.nist.gov/vuln/detail/CVE-2026-14199) | 7.1 | Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater tha... | | grafana | 13.1.6-go-modules | [CVE-2026-14199](https://nvd.nist.gov/vuln/detail/CVE-2026-14199) | 7.1 | Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater tha... | | warp | 3.4.9 | [CVE-2025-0651](https://nvd.nist.gov/vuln/detail/CVE-2025-0651) | 7.1 | Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low ... | | libssh2 | 1.11.1 | [CVE-2026-58050](https://nvd.nist.gov/vuln/detail/CVE-2026-58050) | 7.0 | libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and us... | | python | 2.7.18.12 | [CVE-2022-26488](https://nvd.nist.gov/vuln/detail/CVE-2022-26488) | 7.0 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. ... | | warp | 3.4.9 | [CVE-2023-0652](https://nvd.nist.gov/vuln/detail/CVE-2023-0652) | 7.0 | Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of... | | warp | 3.4.9 | [CVE-2023-1412](https://nvd.nist.gov/vuln/detail/CVE-2023-1412) | 7.0 | An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client f... | | vault | 0.3.1.6 | [CVE-2025-6037](https://nvd.nist.gov/vuln/detail/CVE-2025-6037) | 6.8 | Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when ... | | cups | 2.4.19 | [CVE-2022-26691](https://nvd.nist.gov/vuln/detail/CVE-2022-26691) | 6.7 | A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina,... | | warp | 3.4.9 | [CVE-2022-3320](https://nvd.nist.gov/vuln/detail/CVE-2022-3320) | 6.7 | It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoin... | | warp | 3.4.9 | [CVE-2022-3512](https://nvd.nist.gov/vuln/detail/CVE-2022-3512) | 6.7 | Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch... | | gstreamer | 1.28.6 | [CVE-2026-73433](https://nvd.nist.gov/vuln/detail/CVE-2026-73433) | 6.6 | A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_a... | | curl | 0.4.49 | [CVE-2022-27776](https://nvd.nist.gov/vuln/detail/CVE-2022-27776) | 6.5 | A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie head... | | curl | 0.4.49 | [CVE-2022-32206](https://nvd.nist.gov/vuln/detail/CVE-2022-32206) | 6.5 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multipl... | | dash | 0.5.13.5 | [CVE-2024-21485](https://nvd.nist.gov/vuln/detail/CVE-2024-21485) | 6.5 | Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0... | | dbus | 0.9.10 | [CVE-2022-42010](https://nvd.nist.gov/vuln/detail/CVE-2022-42010) | 6.5 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authen... | | dbus | 0.9.10 | [CVE-2022-42011](https://nvd.nist.gov/vuln/detail/CVE-2022-42011) | 6.5 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authen... | | dbus | 0.9.10 | [CVE-2022-42012](https://nvd.nist.gov/vuln/detail/CVE-2022-42012) | 6.5 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authen... | | dbus | 1 | [CVE-2022-42010](https://nvd.nist.gov/vuln/detail/CVE-2022-42010) | 6.5 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authen... | | dbus | 1 | [CVE-2022-42011](https://nvd.nist.gov/vuln/detail/CVE-2022-42011) | 6.5 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authen... | | dbus | 1 | [CVE-2022-42012](https://nvd.nist.gov/vuln/detail/CVE-2022-42012) | 6.5 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authen... | | dhcpcd | 10.3.2 | [CVE-2026-56116](https://nvd.nist.gov/vuln/detail/CVE-2026-56116) | 6.5 | dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement... | | git | 2.55.0 | [CVE-2022-38663](https://nvd.nist.gov/vuln/detail/CVE-2022-38663) | 6.5 | Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build ... | | gitea | 1.27.3 | [CVE-2026-104633](https://nvd.nist.gov/vuln/detail/CVE-2026-104633) | 6.5 | When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API... | | gitea | 1.27.3 | [CVE-2026-95112](https://nvd.nist.gov/vuln/detail/CVE-2026-95112) | 6.5 | When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes... | | gitea | 1.27.3-go-modules | [CVE-2026-104633](https://nvd.nist.gov/vuln/detail/CVE-2026-104633) | 6.5 | When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API... | | gitea | 1.27.3-go-modules | [CVE-2026-95112](https://nvd.nist.gov/vuln/detail/CVE-2026-95112) | 6.5 | When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes... | | glibc | 2.42 | [CVE-2026-6238](https://nvd.nist.gov/vuln/detail/CVE-2026-6238) | 6.5 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fai... | | glibc | 2.42-84 | [CVE-2026-6238](https://nvd.nist.gov/vuln/detail/CVE-2026-6238) | 6.5 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fai... | | glibc | 2.42-84-source-unsecvars | [CVE-2026-6238](https://nvd.nist.gov/vuln/detail/CVE-2026-6238) | 6.5 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fai... | | jbig2dec | 0.20 | [CVE-2023-46361](https://nvd.nist.gov/vuln/detail/CVE-2023-46361) | 6.5 | Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c. | | jq | 1.8.2 | [CVE-2026-39979](https://nvd.nist.gov/vuln/detail/CVE-2026-39979) | 6.5 | jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized()... | | jq | 1.8.2-binlore | [CVE-2026-39979](https://nvd.nist.gov/vuln/detail/CVE-2026-39979) | 6.5 | jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized()... | | libmpeg2 | 0.5.1 | [CVE-2022-37416](https://nvd.nist.gov/vuln/detail/CVE-2022-37416) | 6.5 | Ittiam libmpeg2 before 2022-07-27 uses memcpy with overlapping memory blocks in impeg2_mc_fullx_fully_8x8. | | libsndfile | 1.2.2 | [CVE-2024-50613](https://nvd.nist.gov/vuln/detail/CVE-2024-50613) | 6.5 | libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_en... | | libssh2 | 1.11.1 | [CVE-2025-15661](https://nvd.nist.gov/vuln/detail/CVE-2025-15661) | 6.5 | libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlin... | | libssh2 | 1.11.1 | [CVE-2026-58051](https://nvd.nist.gov/vuln/detail/CVE-2026-58051) | 6.5 | libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before par... | | network | 3.2.8.0 | [CVE-2021-35050](https://nvd.nist.gov/vuln/detail/CVE-2021-35050) | 6.5 | User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that a... | | openssh | 10.5p1 | [CVE-2026-106585](https://nvd.nist.gov/vuln/detail/CVE-2026-106585) | 6.5 | In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during de... | | pip | 20.3.4-source | [CVE-2026-13346](https://nvd.nist.gov/vuln/detail/CVE-2026-13346) | 6.5 | pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary... | | python | 2.7.18.12 | [CVE-2021-3733](https://nvd.nist.gov/vuln/detail/CVE-2021-3733) | 6.5 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an H... | | python | 2.7.18.12 | [CVE-2022-48564](https://nvd.nist.gov/vuln/detail/CVE-2022-48564) | 6.5 | read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion w... | | safe | 0.3.21 | [CVE-2022-38164](https://nvd.nist.gov/vuln/detail/CVE-2022-38164) | 6.5 | A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website cou... | | safe | 0.3.21-r1.cabal | [CVE-2022-38164](https://nvd.nist.gov/vuln/detail/CVE-2022-38164) | 6.5 | A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website cou... | | unbound | 1.26.0 | [CVE-2026-78227](https://nvd.nist.gov/vuln/detail/CVE-2026-78227) | 6.5 | NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-Q... | | vault | 0.3.1.6 | [CVE-2023-0620](https://nvd.nist.gov/vuln/detail/CVE-2023-0620) | 6.5 | HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when con... | | vault | 0.3.1.6 | [CVE-2023-0665](https://nvd.nist.gov/vuln/detail/CVE-2023-0665) | 6.5 | HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer ... | | vault | 0.3.1.6 | [CVE-2025-6014](https://nvd.nist.gov/vuln/detail/CVE-2025-6014) | 6.5 | Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse with... | | wire | 0.7.0 | [CVE-2021-32666](https://nvd.nist.gov/vuln/detail/CVE-2021-32666) | 6.5 | wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vul... | | wire | 0.7.0 | [CVE-2022-23625](https://nvd.nist.gov/vuln/detail/CVE-2022-23625) | 6.5 | Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malfor... | | wire | 0.7.0 | [CVE-2023-22737](https://nvd.nist.gov/vuln/detail/CVE-2023-22737) | 6.5 | wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 20... | | wire | 0.7.0-go-modules | [CVE-2021-32666](https://nvd.nist.gov/vuln/detail/CVE-2021-32666) | 6.5 | wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vul... | | wire | 0.7.0-go-modules | [CVE-2022-23625](https://nvd.nist.gov/vuln/detail/CVE-2022-23625) | 6.5 | Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malfor... | | wire | 0.7.0-go-modules | [CVE-2023-22737](https://nvd.nist.gov/vuln/detail/CVE-2023-22737) | 6.5 | wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 20... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-32282](https://nvd.nist.gov/vuln/detail/CVE-2026-32282) | 6.4 | On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can ... | | bison | 3.8.2 | [CVE-2026-56390](https://nvd.nist.gov/vuln/detail/CVE-2026-56390) | 6.3 | GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow speci... | | nix | 0.29.0 | [CVE-2024-27297](https://nvd.nist.gov/vuln/detail/CVE-2024-27297) | 6.3 | Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descript... | | nix | 0.31.1 | [CVE-2024-27297](https://nvd.nist.gov/vuln/detail/CVE-2024-27297) | 6.3 | Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descript... | | binutils | 2.46 | [CVE-2025-69652](https://nvd.nist.gov/vuln/detail/CVE-2025-69652) | 6.2 | GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted EL... | | vault | 0.3.1.6 | [CVE-2024-8365](https://nvd.nist.gov/vuln/detail/CVE-2024-8365) | 6.2 | Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive heade... | | cargo | 1.98.1 | [CVE-2026-39839](https://nvd.nist.gov/vuln/detail/CVE-2026-39839) | 6.1 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation M... | | cargo | 1.98.1 | [CVE-2026-39840](https://nvd.nist.gov/vuln/detail/CVE-2026-39840) | 6.1 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Found... | | cargo | 1.98.1 | [CVE-2026-39841](https://nvd.nist.gov/vuln/detail/CVE-2026-39841) | 6.1 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation M... | | commonmark | 0.2.6.1 | [CVE-2026-30838](https://nvd.nist.gov/vuln/detail/CVE-2026-30838) | 6.1 | league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed b... | | coreutils | 9.11 | [CVE-2026-56391](https://nvd.nist.gov/vuln/detail/CVE-2026-56391) | 6.1 | GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (-... | | coreutils | 9.11 | [CVE-2026-56392](https://nvd.nist.gov/vuln/detail/CVE-2026-56392) | 6.1 | GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocat... | | git | 2.55.0 | [CVE-2021-21684](https://nvd.nist.gov/vuln/detail/CVE-2021-21684) | 6.1 | Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notificatio... | | gitea | 1.27.3 | [CVE-2026-96594](https://nvd.nist.gov/vuln/detail/CVE-2026-96594) | 6.1 | The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored... | | gitea | 1.27.3-go-modules | [CVE-2026-96594](https://nvd.nist.gov/vuln/detail/CVE-2026-96594) | 6.1 | The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-27142](https://nvd.nist.gov/vuln/detail/CVE-2026-27142) | 6.1 | Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the met... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-32289](https://nvd.nist.gov/vuln/detail/CVE-2026-32289) | 6.1 | Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect esc... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-39823](https://nvd.nist.gov/vuln/detail/CVE-2026-39823) | 6.1 | CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attr... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-39826](https://nvd.nist.gov/vuln/detail/CVE-2026-39826) | 6.1 | If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute ... | | python | 2.7.18.12 | [CVE-2026-6019](https://nvd.nist.gov/vuln/detail/CVE-2026-6019) | 6.1 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. ... | | setuptools | 44.0.0-source | [CVE-2026-59890](https://nvd.nist.gov/vuln/detail/CVE-2026-59890) | 6.1 | setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior ... | | cjson | 1.7.19 | [CVE-2026-67216](https://nvd.nist.gov/vuln/detail/CVE-2026-67216) | 5.9 | cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, ... | | curl | 0.4.49 | [CVE-2022-43552](https://nvd.nist.gov/vuln/detail/CVE-2022-43552) | 5.9 | A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it suppo... | | curl | 0.4.49 | [CVE-2023-28320](https://nvd.nist.gov/vuln/detail/CVE-2023-28320) | 5.9 | A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for r... | | curl | 0.4.49 | [CVE-2023-28321](https://nvd.nist.gov/vuln/detail/CVE-2023-28321) | 5.9 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard p... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-39817](https://nvd.nist.gov/vuln/detail/CVE-2026-39817) | 5.9 | The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not... | | libssh2 | 1.11.1 | [CVE-2026-55199](https://nvd.nist.gov/vuln/detail/CVE-2026-55199) | 5.9 | libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the... | | python | 2.7.18.12 | [CVE-2021-23336](https://nvd.nist.gov/vuln/detail/CVE-2021-23336) | 5.9 | The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from ... | | python | 2.7.18.12 | [CVE-2022-48566](https://nvd.nist.gov/vuln/detail/CVE-2022-48566) | 5.9 | An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisatio... | | setuptools | 44.0.0-source | [CVE-2022-40897](https://nvd.nist.gov/vuln/detail/CVE-2022-40897) | 5.9 | Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via H... | | unbound | 1.26.0 | [CVE-2026-82720](https://nvd.nist.gov/vuln/detail/CVE-2026-82720) | 5.9 | NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HT... | | warp | 3.4.9 | [CVE-2022-2145](https://nvd.nist.gov/vuln/detail/CVE-2022-2145) | 5.8 | Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData fold... | | pip | 20.3.4-source | [CVE-2021-3572](https://nvd.nist.gov/vuln/detail/CVE-2021-3572) | 5.7 | A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could po... | | wire | 0.7.0 | [CVE-2022-31009](https://nvd.nist.gov/vuln/detail/CVE-2022-31009) | 5.7 | wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication part... | | wire | 0.7.0-go-modules | [CVE-2022-31009](https://nvd.nist.gov/vuln/detail/CVE-2022-31009) | 5.7 | wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication part... | | avahi | 0.8 | [CVE-2025-59529](https://nvd.nist.gov/vuln/detail/CVE-2025-59529) | 5.5 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versi... | | binutils | 2.46 | [CVE-2025-69651](https://nvd.nist.gov/vuln/detail/CVE-2025-69651) | 5.5 | GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a craft... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-32288](https://nvd.nist.gov/vuln/detail/CVE-2026-32288) | 5.5 | tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large n... | | jq | 1.8.2 | [CVE-2026-44777](https://nvd.nist.gov/vuln/detail/CVE-2026-44777) | 5.5 | jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detec... | | libsndfile | 1.2.2 | [CVE-2024-50612](https://nvd.nist.gov/vuln/detail/CVE-2024-50612) | 5.5 | libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read. | | ninja | 1.13.2 | [CVE-2021-4336](https://nvd.nist.gov/vuln/detail/CVE-2021-4336) | 5.5 | A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by thi... | | patch | 2.8 | [CVE-2026-56288](https://nvd.nist.gov/vuln/detail/CVE-2026-56288) | 5.5 | GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Im... | | patch | 2.8 | [CVE-2026-56289](https://nvd.nist.gov/vuln/detail/CVE-2026-56289) | 5.5 | GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in d... | | pip | 20.3.4-source | [CVE-2023-5752](https://nvd.nist.gov/vuln/detail/CVE-2023-5752) | 5.5 | When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified... | | pip | 20.3.4-source | [CVE-2026-8643](https://nvd.nist.gov/vuln/detail/CVE-2026-8643) | 5.5 | pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolu... | | python | 2.7.18.12 | [CVE-2025-13837](https://nvd.nist.gov/vuln/detail/CVE-2025-13837) | 5.5 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious f... | | python | 2.7.18.12 | [CVE-2025-6075](https://nvd.nist.gov/vuln/detail/CVE-2025-6075) | 5.5 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding ... | | python | 2.7.18.12 | [CVE-2026-0864](https://nvd.nist.gov/vuln/detail/CVE-2026-0864) | 5.5 | When using the "configparser" module to write configuration files containing multi-line text values with carriage ret... | | python | 3.14.6 | [CVE-2026-0864](https://nvd.nist.gov/vuln/detail/CVE-2026-0864) | 5.5 | When using the "configparser" module to write configuration files containing multi-line text values with carriage ret... | | unzip | 6.0 | [CVE-2022-0529](https://nvd.nist.gov/vuln/detail/CVE-2022-0529) | 5.5 | A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that lea... | | unzip | 6.0 | [CVE-2022-0530](https://nvd.nist.gov/vuln/detail/CVE-2022-0530) | 5.5 | A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that lea... | | warp | 3.4.9 | [CVE-2022-4457](https://nvd.nist.gov/vuln/detail/CVE-2022-4457) | 5.5 | Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hi... | | yaml | 0.11.11.2 | [CVE-2021-4235](https://nvd.nist.gov/vuln/detail/CVE-2021-4235) | 5.5 | Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system re... | | yaml | 0.11.11.2-r2.cabal | [CVE-2021-4235](https://nvd.nist.gov/vuln/detail/CVE-2021-4235) | 5.5 | Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system re... | | yasm | 1.3.0 | [CVE-2021-33454](https://nvd.nist.gov/vuln/detail/CVE-2021-33454) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr_get_intnum() in libya... | | yasm | 1.3.0 | [CVE-2021-33455](https://nvd.nist.gov/vuln/detail/CVE-2021-33455) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in do_directive() in modules/prepr... | | yasm | 1.3.0 | [CVE-2021-33456](https://nvd.nist.gov/vuln/detail/CVE-2021-33456) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in hash() in modules/preprocs/nasm... | | yasm | 1.3.0 | [CVE-2021-33457](https://nvd.nist.gov/vuln/detail/CVE-2021-33457) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmac_params() in modules... | | yasm | 1.3.0 | [CVE-2021-33458](https://nvd.nist.gov/vuln/detail/CVE-2021-33458) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in find_cc() in modules/preprocs/n... | | yasm | 1.3.0 | [CVE-2021-33459](https://nvd.nist.gov/vuln/detail/CVE-2021-33459) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in nasm_parser_directive() in modu... | | yasm | 1.3.0 | [CVE-2021-33460](https://nvd.nist.gov/vuln/detail/CVE-2021-33460) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in if_condition() in modules/prepr... | | yasm | 1.3.0 | [CVE-2021-33461](https://nvd.nist.gov/vuln/detail/CVE-2021-33461) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a use-after-free in yasm_intnum_destroy() in libyasm/intnum.c. | | yasm | 1.3.0 | [CVE-2021-33462](https://nvd.nist.gov/vuln/detail/CVE-2021-33462) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a use-after-free in expr_traverse_nodes_post() in libyasm/exp... | | yasm | 1.3.0 | [CVE-2021-33463](https://nvd.nist.gov/vuln/detail/CVE-2021-33463) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr__copy_except() in lib... | | yasm | 1.3.0 | [CVE-2021-33464](https://nvd.nist.gov/vuln/detail/CVE-2021-33464) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a heap-buffer-overflow in inc_fopen() in modules/preprocs/nas... | | yasm | 1.3.0 | [CVE-2021-33465](https://nvd.nist.gov/vuln/detail/CVE-2021-33465) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmacro() in modules/prep... | | yasm | 1.3.0 | [CVE-2021-33466](https://nvd.nist.gov/vuln/detail/CVE-2021-33466) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_smacro() in modules/prep... | | yasm | 1.3.0 | [CVE-2021-33467](https://nvd.nist.gov/vuln/detail/CVE-2021-33467) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a use-after-free in pp_getline() in modules/preprocs/nasm/nas... | | yasm | 1.3.0 | [CVE-2021-33468](https://nvd.nist.gov/vuln/detail/CVE-2021-33468) | 5.5 | An issue was discovered in yasm version 1.3.0. There is a use-after-free in error() in modules/preprocs/nasm/nasm-pp.c. | | yasm | 1.3.0 | [CVE-2023-30402](https://nvd.nist.gov/vuln/detail/CVE-2023-30402) | 5.5 | YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re. Note:... | | yasm | 1.3.0 | [CVE-2023-31972](https://nvd.nist.gov/vuln/detail/CVE-2023-31972) | 5.5 | yasm v1.3.0 was discovered to contain a use after free via the function pp_getline at /nasm/nasm-pp.c. Note: Multiple... | | yasm | 1.3.0 | [CVE-2023-31973](https://nvd.nist.gov/vuln/detail/CVE-2023-31973) | 5.5 | yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c. Note: ... | | yasm | 1.3.0 | [CVE-2023-31974](https://nvd.nist.gov/vuln/detail/CVE-2023-31974) | 5.5 | yasm v1.3.0 was discovered to contain a use after free via the function error at /nasm/nasm-pp.c. Note: Multiple thir... | | yasm | 1.3.0 | [CVE-2023-51258](https://nvd.nist.gov/vuln/detail/CVE-2023-51258) | 5.5 | A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the new_Token... | | cargo | 1.98.1 | [CVE-2026-39837](https://nvd.nist.gov/vuln/detail/CVE-2026-39837) | 5.4 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - ... | | cargo | 1.98.1 | [CVE-2026-58519](https://nvd.nist.gov/vuln/detail/CVE-2026-58519) | 5.4 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia F... | | gitea | 1.27.3 | [CVE-2026-103667](https://nvd.nist.gov/vuln/detail/CVE-2026-103667) | 5.4 | Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed i... | | gitea | 1.27.3 | [CVE-2026-89182](https://nvd.nist.gov/vuln/detail/CVE-2026-89182) | 5.4 | With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still ... | | gitea | 1.27.3-go-modules | [CVE-2026-103667](https://nvd.nist.gov/vuln/detail/CVE-2026-103667) | 5.4 | Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed i... | | gitea | 1.27.3-go-modules | [CVE-2026-89182](https://nvd.nist.gov/vuln/detail/CVE-2026-89182) | 5.4 | With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still ... | | glibc | 2.42 | [CVE-2026-4438](https://nvd.nist.gov/vuln/detail/CVE-2026-4438) | 5.4 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in ... | | glibc | 2.42-84 | [CVE-2026-4438](https://nvd.nist.gov/vuln/detail/CVE-2026-4438) | 5.4 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in ... | | glibc | 2.42-84-source-unsecvars | [CVE-2026-4438](https://nvd.nist.gov/vuln/detail/CVE-2026-4438) | 5.4 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in ... | | safe | 0.3.21 | [CVE-2022-47524](https://nvd.nist.gov/vuln/detail/CVE-2022-47524) | 5.4 | F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack. | | safe | 0.3.21-r1.cabal | [CVE-2022-47524](https://nvd.nist.gov/vuln/detail/CVE-2022-47524) | 5.4 | F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack. | | subversion | 1.14.5 | [CVE-2022-29046](https://nvd.nist.gov/vuln/detail/CVE-2022-29046) | 5.4 | Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and mo... | | wire | 0.7.0 | [CVE-2021-32755](https://nvd.nist.gov/vuln/detail/CVE-2021-32755) | 5.4 | Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retrie... | | wire | 0.7.0-go-modules | [CVE-2021-32755](https://nvd.nist.gov/vuln/detail/CVE-2021-32755) | 5.4 | Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retrie... | | Diff | 1.0.2 | [CVE-2026-73478](https://nvd.nist.gov/vuln/detail/CVE-2026-73478) | 5.3 | Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from... | | ada | 4.0.0 | [CVE-2024-9410](https://nvd.nist.gov/vuln/detail/CVE-2024-9410) | 5.3 | Ada.cx's Sentry configuration allowed for blind server-side request forgeries (SSRF) through the use of a data scrapi... | | binutils | 2.47 | [CVE-2026-90801](https://nvd.nist.gov/vuln/detail/CVE-2026-90801) | 5.3 | A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cach... | | binutils | 2.47 | [CVE-2026-90803](https://nvd.nist.gov/vuln/detail/CVE-2026-90803) | 5.3 | A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x... | | binutils | 2.47 | [CVE-2026-90828](https://nvd.nist.gov/vuln/detail/CVE-2026-90828) | 5.3 | A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatib... | | binutils | 2.47 | [CVE-2026-90829](https://nvd.nist.gov/vuln/detail/CVE-2026-90829) | 5.3 | A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of th... | | binutils | 2.47 | [CVE-2026-90830](https://nvd.nist.gov/vuln/detail/CVE-2026-90830) | 5.3 | A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section o... | | binutils | 2.47 | [CVE-2026-90831](https://nvd.nist.gov/vuln/detail/CVE-2026-90831) | 5.3 | A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the... | | cjson | 1.7.19 | [CVE-2026-67217](https://nvd.nist.gov/vuln/detail/CVE-2026-67217) | 5.3 | cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a r... | | dhcpcd | 10.3.2 | [CVE-2026-56113](https://nvd.nist.gov/vuln/detail/CVE-2026-56113) | 5.3 | dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthentica... | | dhcpcd | 10.3.2 | [CVE-2026-56114](https://nvd.nist.gov/vuln/detail/CVE-2026-56114) | 5.3 | dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_... | | git | 2.55.0 | [CVE-2022-36884](https://nvd.nist.gov/vuln/detail/CVE-2022-36884) | 5.3 | The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-39819](https://nvd.nist.gov/vuln/detail/CVE-2026-39819) | 5.3 | The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-39825](https://nvd.nist.gov/vuln/detail/CVE-2026-39825) | 5.3 | ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite fun... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) | 5.3 | Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure... | | libsndfile | 1.2.2 | [CVE-2025-56226](https://nvd.nist.gov/vuln/detail/CVE-2025-56226) | 5.3 | Libsndfile <=1.2.2 contains a memory leak vulnerability in the mpeg_l3_encoder_init() function within the mpeg_l3_enc... | | mercurial | 7.2.2 | [CVE-2022-43410](https://nvd.nist.gov/vuln/detail/CVE-2022-43410) | 5.3 | Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or sch... | | mercurial | 7.2.2-vendor | [CVE-2022-43410](https://nvd.nist.gov/vuln/detail/CVE-2022-43410) | 5.3 | Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or sch... | | mercurial | 7.2.2-vendor-staging | [CVE-2022-43410](https://nvd.nist.gov/vuln/detail/CVE-2022-43410) | 5.3 | Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or sch... | | openssl | 3.6.4 | [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) | 5.3 | Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap g... | | openssl | 3.6.4 | [CVE-2026-42772](https://nvd.nist.gov/vuln/detail/CVE-2026-42772) | 5.3 | Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving ou... | | openssl | 3.6.4 | [CVE-2026-75804](https://nvd.nist.gov/vuln/detail/CVE-2026-75804) | 5.3 | Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send m... | | openssl | 3.6.4 | [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) | 5.3 | Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL... | | openssl | 3.6.4 | [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) | 5.3 | Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthent... | | openssl | 4.0.2 | [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) | 5.3 | Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap g... | | openssl | 4.0.2 | [CVE-2026-42772](https://nvd.nist.gov/vuln/detail/CVE-2026-42772) | 5.3 | Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving ou... | | openssl | 4.0.2 | [CVE-2026-75804](https://nvd.nist.gov/vuln/detail/CVE-2026-75804) | 5.3 | Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send m... | | openssl | 4.0.2 | [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) | 5.3 | Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL... | | openssl | 4.0.2 | [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) | 5.3 | Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthent... | | python | 2.7.18.12 | [CVE-2023-40217](https://nvd.nist.gov/vuln/detail/CVE-2023-40217) | 5.3 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5... | | python | 2.7.18.12 | [CVE-2025-12084](https://nvd.nist.gov/vuln/detail/CVE-2025-12084) | 5.3 | When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id... | | python | 2.7.18.12 | [CVE-2025-12781](https://nvd.nist.gov/vuln/detail/CVE-2025-12781) | 5.3 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module ... | | python | 2.7.18.12 | [CVE-2026-4360](https://nvd.nist.gov/vuln/detail/CVE-2026-4360) | 5.3 | In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected... | | unbound | 1.26.0 | [CVE-2026-80225](https://nvd.nist.gov/vuln/detail/CVE-2026-80225) | 5.3 | In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT rea... | | unbound | 1.26.0 | [CVE-2026-85501](https://nvd.nist.gov/vuln/detail/CVE-2026-85501) | 5.3 | Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'... | | vault | 0.3.1.6 | [CVE-2021-3024](https://nvd.nist.gov/vuln/detail/CVE-2021-3024) | 5.3 | HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some inva... | | vault | 0.3.1.6 | [CVE-2021-38554](https://nvd.nist.gov/vuln/detail/CVE-2021-38554) | 5.3 | HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a si... | | vault | 0.3.1.6 | [CVE-2022-41316](https://nvd.nist.gov/vuln/detail/CVE-2022-41316) | 5.3 | HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured C... | | vault | 0.3.1.6 | [CVE-2023-25000](https://nvd.nist.gov/vuln/detail/CVE-2023-25000) | 5.0 | HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cac... | | gitea | 1.27.3 | [CVE-2026-97208](https://nvd.nist.gov/vuln/detail/CVE-2026-97208) | 4.9 | The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whet... | | gitea | 1.27.3-go-modules | [CVE-2026-97208](https://nvd.nist.gov/vuln/detail/CVE-2026-97208) | 4.9 | The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whet... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2023-49292](https://nvd.nist.gov/vuln/detail/CVE-2023-49292) | 4.9 | ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsu... | | go | 1.26.7 | [CVE-2023-49292](https://nvd.nist.gov/vuln/detail/CVE-2023-49292) | 4.9 | ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsu... | | binutils | 2.47 | [CVE-2026-90804](https://nvd.nist.gov/vuln/detail/CVE-2026-90804) | 4.8 | A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_f... | | capstone | 5.0.9 | [CVE-2025-67873](https://nvd.nist.gov/vuln/detail/CVE-2025-67873) | 4.8 | Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a ... | | capstone | 5.0.9 | [CVE-2025-68114](https://nvd.nist.gov/vuln/detail/CVE-2025-68114) | 4.8 | Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_con... | | gcc | 4.6.4 | [CVE-2023-4039](https://nvd.nist.gov/vuln/detail/CVE-2023-4039) | 4.8 | **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacke... | | gcc | 10.4.0 | [CVE-2023-4039](https://nvd.nist.gov/vuln/detail/CVE-2023-4039) | 4.8 | **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacke... | | gcc | 15.3.0 | [CVE-2023-4039](https://nvd.nist.gov/vuln/detail/CVE-2023-4039) | 4.8 | **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacke... | | dhcpcd | 10.3.2 | [CVE-2026-56117](https://nvd.nist.gov/vuln/detail/CVE-2026-56117) | 4.7 | dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket ha... | | gzip | 1.2.4 | [CVE-2026-41991](https://nvd.nist.gov/vuln/detail/CVE-2026-41991) | 4.7 | GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp u... | | gzip | 1.14 | [CVE-2026-41991](https://nvd.nist.gov/vuln/detail/CVE-2026-41991) | 4.7 | GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp u... | | wire | 0.7.0 | [CVE-2022-43673](https://nvd.nist.gov/vuln/detail/CVE-2022-43673) | 4.7 | Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (f... | | wire | 0.7.0-go-modules | [CVE-2022-43673](https://nvd.nist.gov/vuln/detail/CVE-2022-43673) | 4.7 | Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (f... | | safe | 0.3.21 | [CVE-2021-40835](https://nvd.nist.gov/vuln/detail/CVE-2021-40835) | 4.6 | An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When user clicks on a specially cra... | | safe | 0.3.21-r1.cabal | [CVE-2021-40835](https://nvd.nist.gov/vuln/detail/CVE-2021-40835) | 4.6 | An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When user clicks on a specially cra... | | vault | 0.3.1.6 | [CVE-2025-4166](https://nvd.nist.gov/vuln/detail/CVE-2025-4166) | 4.5 | Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information... | | binutils | 2.47 | [CVE-2026-90802](https://nvd.nist.gov/vuln/detail/CVE-2026-90802) | 4.4 | A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of ... | | network | 3.2.8.0 | [CVE-2022-0486](https://nvd.nist.gov/vuln/detail/CVE-2022-0486) | 4.4 | Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Decept... | | unbound | 1.26.0 | [CVE-2026-77955](https://nvd.nist.gov/vuln/detail/CVE-2026-77955) | 4.4 | In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: ye... | | vault | 0.3.1.6 | [CVE-2023-24999](https://nvd.nist.gov/vuln/detail/CVE-2023-24999) | 4.4 | HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle d... | | gitea | 1.27.3 | [CVE-2026-101029](https://nvd.nist.gov/vuln/detail/CVE-2026-101029) | 4.3 | Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DN... | | gitea | 1.27.3 | [CVE-2026-105268](https://nvd.nist.gov/vuln/detail/CVE-2026-105268) | 4.3 | The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) als... | | gitea | 1.27.3 | [CVE-2026-96400](https://nvd.nist.gov/vuln/detail/CVE-2026-96400) | 4.3 | With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL... | | gitea | 1.27.3 | [CVE-2026-96589](https://nvd.nist.gov/vuln/detail/CVE-2026-96589) | 4.3 | When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read acces... | | gitea | 1.27.3-go-modules | [CVE-2026-101029](https://nvd.nist.gov/vuln/detail/CVE-2026-101029) | 4.3 | Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DN... | | gitea | 1.27.3-go-modules | [CVE-2026-105268](https://nvd.nist.gov/vuln/detail/CVE-2026-105268) | 4.3 | The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) als... | | gitea | 1.27.3-go-modules | [CVE-2026-96400](https://nvd.nist.gov/vuln/detail/CVE-2026-96400) | 4.3 | With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL... | | gitea | 1.27.3-go-modules | [CVE-2026-96589](https://nvd.nist.gov/vuln/detail/CVE-2026-96589) | 4.3 | When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read acces... | | safe | 0.3.21 | [CVE-2021-40834](https://nvd.nist.gov/vuln/detail/CVE-2021-40834) | 4.3 | A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a spec... | | safe | 0.3.21 | [CVE-2021-44751](https://nvd.nist.gov/vuln/detail/CVE-2021-44751) | 4.3 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code... | | safe | 0.3.21 | [CVE-2022-28868](https://nvd.nist.gov/vuln/detail/CVE-2022-28868) | 4.3 | An Address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially cra... | | safe | 0.3.21 | [CVE-2022-28869](https://nvd.nist.gov/vuln/detail/CVE-2022-28869) | 4.3 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing a... | | safe | 0.3.21 | [CVE-2022-28870](https://nvd.nist.gov/vuln/detail/CVE-2022-28870) | 4.3 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing a... | | safe | 0.3.21 | [CVE-2022-28872](https://nvd.nist.gov/vuln/detail/CVE-2022-28872) | 4.3 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing a... | | safe | 0.3.21 | [CVE-2022-28873](https://nvd.nist.gov/vuln/detail/CVE-2022-28873) | 4.3 | A vulnerability affecting F-Secure SAFE browser was discovered. An attacker can potentially exploit Javascript window... | | safe | 0.3.21-r1.cabal | [CVE-2021-40834](https://nvd.nist.gov/vuln/detail/CVE-2021-40834) | 4.3 | A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a spec... | | safe | 0.3.21-r1.cabal | [CVE-2021-44751](https://nvd.nist.gov/vuln/detail/CVE-2021-44751) | 4.3 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code... | | safe | 0.3.21-r1.cabal | [CVE-2022-28868](https://nvd.nist.gov/vuln/detail/CVE-2022-28868) | 4.3 | An Address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially cra... | | safe | 0.3.21-r1.cabal | [CVE-2022-28869](https://nvd.nist.gov/vuln/detail/CVE-2022-28869) | 4.3 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing a... | | safe | 0.3.21-r1.cabal | [CVE-2022-28870](https://nvd.nist.gov/vuln/detail/CVE-2022-28870) | 4.3 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing a... | | safe | 0.3.21-r1.cabal | [CVE-2022-28872](https://nvd.nist.gov/vuln/detail/CVE-2022-28872) | 4.3 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing a... | | safe | 0.3.21-r1.cabal | [CVE-2022-28873](https://nvd.nist.gov/vuln/detail/CVE-2022-28873) | 4.3 | A vulnerability affecting F-Secure SAFE browser was discovered. An attacker can potentially exploit Javascript window... | | subversion | 1.14.5 | [CVE-2022-29048](https://nvd.nist.gov/vuln/detail/CVE-2022-29048) | 4.3 | A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to... | | vault | 0.3.1.6 | [CVE-2023-2121](https://nvd.nist.gov/vuln/detail/CVE-2023-2121) | 4.3 | Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI th... | | yarn | 1.22.22 | [CVE-2025-8262](https://nvd.nist.gov/vuln/detail/CVE-2025-8262) | 4.3 | A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the funct... | | openssh | 10.5p1 | [CVE-2026-106552](https://nvd.nist.gov/vuln/detail/CVE-2026-106552) | 4.2 | In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended l... | | hedgehog | 1.5 | [CVE-2021-4276](https://nvd.nist.gov/vuln/detail/CVE-2021-4276) | 4.1 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Af... | | hedgehog | 1.5-r2.cabal | [CVE-2021-4276](https://nvd.nist.gov/vuln/detail/CVE-2021-4276) | 4.1 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Af... | | zlib | 0.7.1.1 | [CVE-2023-6992](https://nvd.nist.gov/vuln/detail/CVE-2023-6992) | 4.0 | Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation alg... | | zlib | 1.3.2 | [CVE-2023-6992](https://nvd.nist.gov/vuln/detail/CVE-2023-6992) | 4.0 | Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation alg... | | imagemagick | 7.1.2-31 | [CVE-2026-105083](https://nvd.nist.gov/vuln/detail/CVE-2026-105083) | 3.9 | ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently ski... | | network | 3.2.8.0 | [CVE-2022-0997](https://nvd.nist.gov/vuln/detail/CVE-2022-0997) | 3.9 | Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enabl... | | warp | 3.4.9 | [CVE-2023-0238](https://nvd.nist.gov/vuln/detail/CVE-2023-0238) | 3.9 | Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability w... | | warp | 3.4.9 | [CVE-2023-0654](https://nvd.nist.gov/vuln/detail/CVE-2023-0654) | 3.9 | Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the... | | curl | 0.4.49 | [CVE-2022-35252](https://nvd.nist.gov/vuln/detail/CVE-2022-35252) | 3.7 | When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that whe... | | curl | 0.4.49 | [CVE-2023-28322](https://nvd.nist.gov/vuln/detail/CVE-2023-28322) | 3.7 | An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneousl... | | imagemagick | 7.1.2-31 | [CVE-2026-102635](https://nvd.nist.gov/vuln/detail/CVE-2026-102635) | 3.7 | ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's ... | | openssh | 10.5p1 | [CVE-2026-106582](https://nvd.nist.gov/vuln/detail/CVE-2026-106582) | 3.7 | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by t... | | openssl | 3.6.4 | [CVE-2026-35191](https://nvd.nist.gov/vuln/detail/CVE-2026-35191) | 3.7 | Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count inc... | | openssl | 3.6.4 | [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) | 3.7 | Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curv... | | openssl | 3.6.4 | [CVE-2026-54875](https://nvd.nist.gov/vuln/detail/CVE-2026-54875) | 3.7 | Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private ke... | | openssl | 3.6.4 | [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) | 3.7 | Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-cha... | | openssl | 4.0.2 | [CVE-2026-35191](https://nvd.nist.gov/vuln/detail/CVE-2026-35191) | 3.7 | Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count inc... | | openssl | 4.0.2 | [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) | 3.7 | Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curv... | | openssl | 4.0.2 | [CVE-2026-54875](https://nvd.nist.gov/vuln/detail/CVE-2026-54875) | 3.7 | Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private ke... | | openssl | 4.0.2 | [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) | 3.7 | Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-cha... | | unbound | 1.26.0 | [CVE-2026-77860](https://nvd.nist.gov/vuln/detail/CVE-2026-77860) | 3.7 | In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a ... | | vault | 0.3.1.6 | [CVE-2025-6011](https://nvd.nist.gov/vuln/detail/CVE-2025-6011) | 3.7 | A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distingui... | | openssh | 10.5p1 | [CVE-2026-106587](https://nvd.nist.gov/vuln/detail/CVE-2026-106587) | 3.6 | In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename bu... | | safe | 0.3.21 | [CVE-2021-33594](https://nvd.nist.gov/vuln/detail/CVE-2021-33594) | 3.5 | An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially cra... | | safe | 0.3.21 | [CVE-2021-33595](https://nvd.nist.gov/vuln/detail/CVE-2021-33595) | 3.5 | A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the addres... | | safe | 0.3.21 | [CVE-2021-33596](https://nvd.nist.gov/vuln/detail/CVE-2021-33596) | 3.5 | Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believ... | | safe | 0.3.21 | [CVE-2022-38163](https://nvd.nist.gov/vuln/detail/CVE-2022-38163) | 3.5 | A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and belo... | | safe | 0.3.21-r1.cabal | [CVE-2021-33594](https://nvd.nist.gov/vuln/detail/CVE-2021-33594) | 3.5 | An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially cra... | | safe | 0.3.21-r1.cabal | [CVE-2021-33595](https://nvd.nist.gov/vuln/detail/CVE-2021-33595) | 3.5 | A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the addres... | | safe | 0.3.21-r1.cabal | [CVE-2021-33596](https://nvd.nist.gov/vuln/detail/CVE-2021-33596) | 3.5 | Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believ... | | safe | 0.3.21-r1.cabal | [CVE-2022-38163](https://nvd.nist.gov/vuln/detail/CVE-2022-38163) | 3.5 | A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and belo... | | binutils | 2.47 | [CVE-2026-91779](https://nvd.nist.gov/vuln/detail/CVE-2026-91779) | 3.3 | A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset ... | | binutils | 2.47 | [CVE-2026-91780](https://nvd.nist.gov/vuln/detail/CVE-2026-91780) | 3.3 | A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the fil... | | binutils | 2.47 | [CVE-2026-91781](https://nvd.nist.gov/vuln/detail/CVE-2026-91781) | 3.3 | A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_i... | | binutils | 2.47 | [CVE-2026-91782](https://nvd.nist.gov/vuln/detail/CVE-2026-91782) | 3.3 | A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dy... | | python | 2.7.18.12 | [CVE-2025-13462](https://nvd.nist.gov/vuln/detail/CVE-2025-13462) | 3.3 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a mu... | | python | 2.7.18.12 | [CVE-2026-4519](https://nvd.nist.gov/vuln/detail/CVE-2026-4519) | 3.3 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for ... | | unzip | 6.0 | [CVE-2021-4217](https://nvd.nist.gov/vuln/detail/CVE-2021-4217) | 3.3 | A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a ... | | yarn | 1.22.22 | [CVE-2025-9308](https://nvd.nist.gov/vuln/detail/CVE-2025-9308) | 3.3 | A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/ut... | | yasm | 1.3.0 | [CVE-2023-31975](https://nvd.nist.gov/vuln/detail/CVE-2023-31975) | 3.3 | yasm v1.3.0 was discovered to contain a memory leak via the function yasm_intnum_copy at /libyasm/intnum.c. Note: Mul... | | busybox | 1.37.0 | [CVE-2025-46394](https://nvd.nist.gov/vuln/detail/CVE-2025-46394) | 3.2 | In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal ... | | uuid | 1.20.0 | [CVE-2026-41988](https://nvd.nist.gov/vuln/detail/CVE-2026-41988) | 3.2 | uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or... | | vault | 0.3.1.6 | [CVE-2021-41802](https://nvd.nist.gov/vuln/detail/CVE-2021-41802) | 2.9 | HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ... | | wire | 0.7.0 | [CVE-2021-21301](https://nvd.nist.gov/vuln/detail/CVE-2021-21301) | 2.6 | Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulne... | | wire | 0.7.0-go-modules | [CVE-2021-21301](https://nvd.nist.gov/vuln/detail/CVE-2021-21301) | 2.6 | Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulne... | | go | 1.24.13-linux-amd64-bootstrap | [CVE-2026-27139](https://nvd.nist.gov/vuln/detail/CVE-2026-27139) | 2.5 | On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo ... | | openssh | 10.5p1 | [CVE-2026-106583](https://nvd.nist.gov/vuln/detail/CVE-2026-106583) | 2.5 | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. | | openssh | 10.5p1 | [CVE-2026-106584](https://nvd.nist.gov/vuln/detail/CVE-2026-106584) | 2.5 | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving m... | | openssh | 10.5p1 | [CVE-2026-106586](https://nvd.nist.gov/vuln/detail/CVE-2026-106586) | 2.5 | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel for... | | openssh | 10.5p1 | [CVE-2026-106553](https://nvd.nist.gov/vuln/detail/CVE-2026-106553) | 2.2 | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentic... | | openssh | 10.5p1 | [CVE-2026-106555](https://nvd.nist.gov/vuln/detail/CVE-2026-106555) | 2.2 | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authent... |

gitea-actions bot added the vulnix label 2026-09-12 00:52:58 +00:00

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

flake-update

fix-flake-update

flowey/name-autodeploy-fix

flowey/fix-flake-update

flowey/auto-deploy

frcc-kvm

flowey/fix-vulnix-again

flowey/better-cache-management

v2026.09.22-0

v2026.09.17-1

v2026.09.17-0

v2026.09.14-0

v2026.09.13-0

v2026.09.09-0

Labels

Clear labels

automated

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

vulnix

vulnix error scanning

wontfix

This won't be fixed

No labels vulnix

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

autumn ci-bot flowey

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: server/server-config#5