LE
Product
Leap
On CISA KEVExploited in the wildRansomware-linked
1,893
CVEs
19
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 193High 302Medium 5Low 0
Watch
Add Leap to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-16846 In wildKEV | 9.8 | Nov 6 | SaltStack Salt Shell Injection Vulnerability Affected: 15.1 |
| CVE-2020-12641 In wildKEV | 9.8 | May 4 | Roundcube Webmail Remote Code Execution Vulnerability Affected: 15.1; 15.2 |
| CVE-2020-11651 In wildKEV | 9.8 | Apr 30 | SaltStack Salt Authentication Bypass Vulnerability Affected: 15.1 |
| CVE-2020-1938 In wildKEV | 9.8 | Feb 24 | Apache Tomcat Improper Privilege Management Vulnerability Affected: 15.1 |
| CVE-2016-3427 In wildKEV | 9.8 | Apr 21 | Oracle Java SE and JRockit Unspecified Vulnerability Affected: 42.1 |
| CVE-2020-16009 In wildKEV | 8.8 | Nov 3 | Google Chromium V8 Type Confusion Vulnerability Affected: 15.1; 15.2 |
| CVE-2019-13720 In wildKEV | 8.8 | Nov 25 | Google Chrome WebAudio Use-After-Free Vulnerability Affected: 15.1 |
| CVE-2016-1646 In wildKEV | 8.8 | Mar 29 | Google Chromium V8 Out-of-Bounds Read Vulnerability Affected: 42.1 |
| CVE-2016-3714 In wildKEV | 8.4 | May 5 | ImageMagick Improper Input Validation Vulnerability Affected: 42.1 |
| CVE-2026-31431 In wildKEV | 7.8 | Apr 22 | crypto: algif_aead - Revert to operating out-of-place Affected: 15.3; 15.4; 15.5; 15.6 |
| CVE-2025-32463 In wildKEV | 7.8 | Jun 30 | Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability Affected: 15.6 |
| CVE-2019-0211 In wildKEV | 7.8 | Apr 8 | Apache HTTP Server Privilege Escalation Vulnerability Affected: 15.0; 42.3 |
| CVE-2019-5418 In wildKEV | 7.5 | Mar 27 | Rails Ruby on Rails Path Traversal Vulnerability Affected: 15.0 |
| CVE-2016-0752 In wildKEV | 7.5 | Feb 16 | Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows… Affected: 42.1 |
| CVE-2020-11652 In wildKEV | 6.5 | Apr 30 | SaltStack Salt Path Traversal Vulnerability Affected: 15.1 |
| CVE-2020-1472 RansomwareIn wildKEV | 5.5 | Aug 17 | Netlogon Elevation of Privilege Vulnerability Affected: 15.1; 15.2 |
| CVE-2016-3715 In wildKEV | 5.5 | May 5 | ImageMagick Arbitrary File Deletion Vulnerability Affected: 42.1 |
| CVE-2016-3718 In wildKEV | 5.5 | May 5 | ImageMagick Server-Side Request Forgery (SSRF) Vulnerability Affected: 42.1 |
| CVE-2015-4902 In wildKEV | 5.3 | Oct 21 | Oracle Java SE Integrity Check Vulnerability Affected: 42.1 |
| CVE-2020-13753 | 10.0 | Jul 14 | The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl Affected: 15.1 |
| CVE-2016-1931 | 10.0 | Jan 31 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 allow remote attackers to cause a denial of service (memory corruption and application… Affected: 42.1 |
| CVE-2020-15683 | 9.8 | Oct 22 | Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3 Affected: 15.1; 15.2 |
| CVE-2020-26935 | 9.8 | Oct 10 | An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3 Affected: 15.1; 15.2 |
| CVE-2020-11800 | 9.8 | Oct 7 | Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code Affected: 15.1; 15.2 |
| CVE-2020-26154 | 9.8 | Sep 30 | url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header Affected: 15.1; 15.2 |
| CVE-2020-15208 | 9.8 | Sep 25 | In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside… Affected: 15.2 |
| CVE-2020-15205 | 9.8 | Sep 25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `data_splits` argument of `tf.raw_ops.StringNGrams` lacks validation Affected: 15.2 |
| CVE-2020-17368 | 9.8 | Aug 11 | Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection Affected: 15.2 |
| CVE-2020-11984 | 9.8 | Aug 7 | Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE Affected: 15.1; 15.2 |
| CVE-2020-17353 | 9.8 | Aug 5 | scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by… Affected: 15.2 |
| CVE-2020-15900 | 9.8 | Jul 28 | A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52 Affected: 15.1; 15.2 |
| CVE-2020-15917 | 9.8 | Jul 23 | common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled Affected: 15.1; 15.2 |
| CVE-2017-18922 | 9.8 | Jun 30 | It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames Affected: 15.1; 15.2 |
| CVE-2020-14983 | 9.8 | Jun 22 | The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow Affected: 15.1; 15.2 |
| CVE-2020-8165 | 9.8 | Jun 19 | A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and… Affected: 15.1; 15.2 |
| CVE-2017-9104 | 9.8 | Jun 18 | An issue was discovered in adns before 1.5.2 Affected: 15.1 |
| CVE-2017-9103 | 9.8 | Jun 18 | An issue was discovered in adns before 1.5.2 Affected: 15.1 |
| CVE-2017-9109 | 9.8 | Jun 18 | An issue was discovered in adns before 1.5.2 Affected: 15.1 |
| CVE-2020-6831 | 9.8 | May 26 | A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC Affected: 15.2 |
| CVE-2020-12823 | 9.8 | May 12 | OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in… Affected: 15.1; 15.2 |
| CVE-2020-12640 | 9.8 | May 4 | Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php Affected: 15.1; 15.2 |
| CVE-2020-10683 | 9.8 | May 1 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks Affected: 15.1 |
| CVE-2020-12268 | 9.8 | Apr 27 | jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow Affected: 15.1 |
| CVE-2020-11945 | 9.8 | Apr 23 | An issue was discovered in Squid before 5.0.2 Affected: 15.1 |
| CVE-2019-20787 | 9.8 | Apr 22 | Teeworlds before 0.7.4 has an integer overflow when computing a tilemap size Affected: 15.1 |
| CVE-2019-12519 | 9.8 | Apr 15 | An issue was discovered in Squid through 4.7 Affected: 15.1 |
| CVE-2020-10938 | 9.8 | Mar 24 | GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c Affected: 15.1 |
| CVE-2020-1747 | 9.8 | Mar 24 | A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through… Affected: 15.1 |
| CVE-2020-10018 | 9.8 | Mar 2 | WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary… Affected: 15.1 |
| CVE-2019-18903 | 9.8 | Mar 2 | A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or… Affected: 15.1 |
The 500 most important CVEs for this product (exploited first, then by severity)