Apple Multiple Products WebKit Code Execution Vulnerability

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like…

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g

Sudo Heap-Based Buffer Overflow Vulnerability

Linux Kernel Improper Privilege Management Vulnerability

7-Zip Mark-of-the-Web Bypass Vulnerability

Kernel: use after free in nvmet_tcp_free_crypto in nvme

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet…

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in…

A vulnerability was found in LibTIFF

In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes,…

There's a flaw in libxml2 in versions before 2.9.11

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any…

An issue has been found in third-party PNM decoding associated with libpng 1.6.35

HTTP/2 push headers memory-leak

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11

Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot)

Openssh: regresshion - race condition in ssh allows rce/dos

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g

A deserialization flaw was discovered in jackson-databind through 2.9.10.4

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`

Rsyslog is a rocket-fast system for log processing

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography…

A flaw was found in jackson-databind before 2.9.10.7

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka…

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka…

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool…

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory,…

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to…

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka…

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization)

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary…

An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8