Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,194

Export CSV
CVE-2019-11050

Use-after-free in exif parsing under memory sanitizer

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

CVSS 3.1 · 4.8 Medium EPSS 7.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2022-1055

Use after Free in tc_new_tfilter allowing for privilege escalation in Linux Kernel

A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 2 more
Products
Ubuntu Linux Fedora Linux Kernel and 19 more
CVE-2013-0335

Openstack nova: vnc proxy can connect to the wrong vm

OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.

CVSS 3.1 · 7.6 High EPSS 2.1% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Essex Folsom and 2 more
CVE-2022-29581

kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 19 more
CVE-2026-47334

Deadlock or kernel panic in Ubuntu Linux AppArmor notification handling

Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Linux
CVE-2026-47333

Out-of-bounds read in Ubuntu Linux AppArmor notification handling

Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Linux
CVE-2026-47332

Out-of-bounds read in Ubuntu Linux AppArmor notification handling

Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Linux
CVE-2026-47331

Use-after-free in Ubuntu Linux AppArmor notification handling

Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Linux
CVE-2026-47330

Use of uninitialized value in Ubuntu Linux AppArmor notification handling

Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Linux
CVE-2026-47329

Incorrect validation of field size in Ubuntu Linux AppArmor notification responses

Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Linux
CVE-2026-47328

Invalid pointer deallocation in Ubuntu Linux AppArmor notification handling

Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Linux
CVE-2026-47327

NULL pointer dereference in Ubuntu Linux AppArmor notification handling

Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Linux
CVE-2026-47326

Memory leak in Ubuntu Linux AppArmor large notification response allocation

Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Linux
CVE-2026-3888

Local Privilege Escalation in snapd

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Ubuntu Linux
CVE-2022-0492

kernel: cgroups v1 release_agent feature may allow privilege escalation

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

CVSS 3.1 · 7.8 High EPSS 5.5% KEV · Listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 36 more
CVE-2026-47335

NULL pointer dereference in Ubuntu Linux AppArmor notification handling

Ubuntu Linux 6.8 contains SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel panic.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Linux
CVE-2026-47336

Use of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rules

Ubuntu Linux 6.8 contains SAUCE patches with a possible use of an uninitialized variable in AppArmor AF_INET/AF_INET6 socket mediation code. The bug can be triggered by an unprivileged local user and could result in incorrect fine-grained mediation of network sockets.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Linux
CVE-2026-47337

NULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation

Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Linux
CVE-2018-3639

hw: cpu: speculative store bypass

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.

CVSS 3.1 · 5.5 Medium EPSS 60.4% KEV · Not listed
Vendors
Arm Canonical Debian and 9 more
Products
Cortex-a Ubuntu Linux Debian Linux and 327 more
CVE-2018-13785

libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service

In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.

CVSS 3.1 · 6.5 Medium EPSS 4.4% KEV · Not listed
Vendors
Canonical Libpng Oracle and 1 more
Products
Ubuntu Linux Libpng Jdk and 7 more