Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21

Export CSV
CVE-2026-31431

crypto: algif_aead - Revert to operating out-of-place

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CVSS 3.1 · 7.8 High EPSS 98.1% KEV · Listed
Vendors
Amazon Arista Canonical and 7 more
Products
Amazon Linux Cloudvision Agni Cloudvision Portal and 57 more
CVE-2026-41054

Missing exit out of permission check in haveged could lead to root exploit

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Novell Suse
Products
Suse Linux Enterprise For Sap Applications Container Suse/sle-micro Container Suse/sle-micro-rancher and 18 more
CVE-2016-3718

ImageMagick: SSRF vulnerability

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

CVSS 3.1 · 5.5 Medium EPSS 75.6% KEV · Listed
Vendors
Canonical Imagemagick Opensuse and 3 more
Products
Ubuntu Linux Imagemagick Leap and 28 more
CVE-2016-3427

OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVSS 3.1 · 9.8 Critical EPSS 92.3% KEV · Listed
Vendors
Apache Canonical Debian and 5 more
Products
Cassandra Ubuntu Linux Debian Linux and 39 more
CVE-2025-53880

susemanager-tftpsync-recv allows arbitrary file creation and deletion due to path traversal

A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Manager Manager Proxy Manager Server
CVE-2021-4034

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

CVSS 3.1 · 7.8 High EPSS 94.9% KEV · Listed
Vendors
Canonical Oracle Polkit Project and 4 more
Products
Ubuntu Linux Http Server Zfs Storage Appliance Kit and 34 more
CVE-2015-5194

ntp: crash with crafted logconfig configuration command

The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.

CVSS 3.0 · 7.5 High EPSS 6.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2015-5219

ntp: infinite loop in sntp processing crafted packet

The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.

CVSS 3.1 · 7.5 High EPSS 6.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 7 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2015-5300

ntp: MITM attacker can force ntpd to make a step larger than the panic threshold

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).

CVSS 3.0 · 7.5 High EPSS 9.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2015-7976

ntp: 'ntpq saveconfig' command allows dangerous characters in filenames

The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.

CVSS 3.0 · 4.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Novell Ntp Opensuse and 1 more
Products
Suse Openstack Cloud Ntp Leap and 7 more
CVE-2017-7995

xen: Checks access permissions to MMIO ranges only after accessing them

Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the get_user function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL.

CVSS 3.0 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Novell Suse Xen
Products
Suse Linux Enterprise Point Of Sale Suse Linux Enterprise Server Manager and 3 more
CVE-2016-4954

ntp: partial processing of spoofed packets

The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.

CVSS 3.1 · 7.5 High EPSS 13.3% KEV · Not listed
Vendors
Ntp Opensuse Oracle and 2 more
Products
Ntp Leap Opensuse and 12 more
CVE-2016-4956

ntp: broadcast interleave (incomplete fix for CVE-2016-1548)

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.

CVSS 3.1 · 5.3 Medium EPSS 16.4% KEV · Not listed
Vendors
Novell Ntp Opensuse and 3 more
Products
Suse Manager Ntp Leap and 8 more
CVE-2016-4957

ntp: crypto-NAK DoS (incorrect fix for CVE-2016-1547)

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.

CVSS 3.1 · 7.5 High EPSS 44.9% KEV · Not listed
Vendors
Novell Ntp Opensuse and 2 more
Products
Suse Manager Ntp Leap and 6 more
CVE-2016-0264

JDK: buffer overflow vulnerability in the IBM JVM

Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 3.1 · 5.6 Medium EPSS 3.9% KEV · Not listed
Vendors
Ibm Redhat Suse
Products
Java Sdk Enterprise Linux Desktop Enterprise Linux Hpc Node Supplementary and 12 more
CVE-2016-4953

ntp: bad authentication demobilizes ephemeral associations

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time.

CVSS 3.1 · 7.5 High EPSS 17.2% KEV · Not listed
Vendors
Ntp Opensuse Oracle and 2 more
Products
Ntp Leap Opensuse and 12 more
CVE-2016-4955

ntp: autokey association reset

ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.

CVSS 3.1 · 5.9 Medium EPSS 8.8% KEV · Not listed
Vendors
Novell Ntp Opensuse and 3 more
Products
Suse Manager Ntp Leap and 8 more
CVE-2016-1286

bind: malformed signature records for DNAME records can trigger assertion failure

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.

CVSS 3.1 · 8.6 High EPSS 60.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 48 more
CVE-2016-1285

bind: malformed packet sent to rndc can trigger assertion failure

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.

CVSS 3.1 · 6.8 Medium EPSS 57.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 48 more