Export limit exceeded: 17087 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2026-5367

Ovn: ovn: information disclosure via crafted dhcpv6 packets

A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Fast Datapath Openshift and 1 more
CVE-2018-3646

Kernel: hw: cpu: L1 terminal fault (L1TF)

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis.

CVSS 3.1 · 5.6 Medium EPSS 8.1% KEV · Not listed
Vendors
Intel Redhat
Products
Core I3 Core I5 Core I7 and 13 more
CVE-2018-3639

hw: cpu: speculative store bypass

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.

CVSS 3.1 · 5.5 Medium EPSS 60.4% KEV · Not listed
Vendors
Arm Canonical Debian and 9 more
Products
Cortex-a Ubuntu Linux Debian Linux and 327 more
CVE-2018-3620

Kernel: hw: cpu: L1 terminal fault (L1TF)

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis.

CVSS 3.1 · 5.6 Medium EPSS 5.6% KEV · Not listed
Vendors
Intel Redhat
Products
Core I3 Core I5 Core I7 and 13 more
CVE-2018-13785

libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service

In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.

CVSS 3.1 · 6.5 Medium EPSS 4.4% KEV · Not listed
Vendors
Canonical Libpng Oracle and 1 more
Products
Ubuntu Linux Libpng Jdk and 7 more
CVE-2018-12130

hardware: Microarchitectural Fill Buffer Data Sampling (MFBDS)

Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf

CVSS 3.1 · 5.9 Medium EPSS 1.6% KEV · Not listed
Vendors
Fedoraproject Intel Redhat
Products
Fedora Microarchitectural Fill Buffer Data Sampling Microarchitectural Fill Buffer Data Sampling Firmware and 10 more
CVE-2018-12127

hardware: Micro-architectural Load Port Data Sampling - Information Leak (MLPDS)

Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf

CVSS 3.1 · 5.6 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Intel Redhat
Products
Fedora Microarchitectural Load Port Data Sampling Microarchitectural Load Port Data Sampling Firmware and 10 more
CVE-2018-12126

hardware: Microarchitectural Store Buffer Data Sampling (MSBDS)

Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf

CVSS 3.1 · 5.6 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Intel Redhat
Products
Fedora Microarchitectural Store Buffer Data Sampling Microarchitectural Store Buffer Data Sampling Firmware and 10 more
CVE-2016-9535

libtiff: Predictor heap-buffer-overflow

tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."

CVSS 3.1 · 9.8 Critical EPSS 4.7% KEV · Not listed
Vendors
Libtiff Redhat
Products
Libtiff Enterprise Linux
CVE-2016-6210

openssh: User enumeration via covert timing channel

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

CVSS 3.1 · 5.9 Medium EPSS 88.9% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2016-3115

openssh: missing sanitisation of input for X11 forwarding

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

CVSS 3.1 · 6.4 Medium EPSS 35.5% KEV · Not listed
Vendors
Openbsd Oracle Redhat
Products
Openssh Vm Server Enterprise Linux
CVE-2016-2183

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

CVSS 3.1 · 7.5 High EPSS 94.7% KEV · Not listed
Vendors
Cisco Nodejs Openssl and 3 more
Products
Content Security Management Appliance Node.js Openssl and 11 more
CVE-2016-1908

openssh: possible fallback from untrusted to trusted X11 forwarding

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

CVSS 3.1 · 9.8 Critical EPSS 13.7% KEV · Not listed
Vendors
Debian Openbsd Oracle and 1 more
Products
Debian Linux Openssh Linux and 7 more
CVE-2016-10012

openssh: Bounds check can be evaded in the shared memory manager used by pre-authentication compression support

The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2016-10011

openssh: Leak of host private key material to privilege-separated child process via realloc()

authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.

CVSS 3.1 · 6.2 Medium EPSS 1.1% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2016-10009

openssh: loading of untrusted PKCS#11 modules in ssh-agent

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

CVSS 3.1 · 7.3 High EPSS 37.4% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2016-0778

OpenSSH: Client buffer-overflow when using roaming connections

The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.

CVSS 3.1 · 8.1 High EPSS 20.9% KEV · Not listed
Vendors
Apple Hp Openbsd and 3 more
Products
Mac Os X Virtual Customer Access System Openssh and 4 more
CVE-2016-0777

OpenSSH: Client Information leak due to use of roaming connection feature

The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.

CVSS 3.1 · 6.5 Medium EPSS 63.5% KEV · Not listed
Vendors
Apple Hp Openbsd and 3 more
Products
Mac Os X Remote Device Access Virtual Customer Access System Openssh and 5 more
CVE-2010-5107

openssh: Prevent connection slot exhaustion attacks

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

CVSS 3.1 · 7.5 High EPSS 16.9% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2020-8927

Buffer overflow in Brotli library

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

CVSS 3.1 · 5.3 Medium EPSS 3.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more