Export limit exceeded: 425948 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,088

Export CSV
CVE-2022-28199

dpdk: error recovery in mlx5 driver not handled properly, allowing for denial of service

NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled properly, which can allow a remote attacker to cause denial of service and some impact to data integrity and confidentiality.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Linux Microsoft Nvidia and 1 more
Products
Linux Kernel Windows Data Plane Development Kit and 1 more
CVE-2022-28131

Stack exhaustion from deeply nested XML documents in encoding/xml

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 1 more
Products
Fedora Go Cloud Insights Telegraf and 13 more
CVE-2022-27664

golang: net/http: handle server errors after sending GOAWAY

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Acm and 16 more
CVE-2022-27651

buildah: Default inheritable capabilities for linux container should be empty

A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.

CVSS 3.1 · 6.8 Medium EPSS 1.3% KEV · Not listed
Vendors
Buildah Project Fedoraproject Redhat
Products
Buildah Fedora Enterprise Linux and 1 more
CVE-2022-27650

crun: Default inheritable capabilities for linux container should be empty

A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Crun Project Fedoraproject Redhat
Products
Crun Fedora Enterprise Linux and 1 more
CVE-2022-27649

podman: Default inheritable capabilities for linux container should be empty

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Podman Project Redhat
Products
Fedora Podman Developer Tools and 12 more
CVE-2022-27387

mariadb: assertion failures in decimal_bin_size

MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Debian Mariadb Redhat
Products
Debian Linux Mariadb Enterprise Linux and 1 more