mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-06 13:10:37 -04:00
033f0c84da
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com> Co-authored-by: Aditya Tripathi <aditya@climactic.co>
169 lines
146 KiB
Plaintext
169 lines
146 KiB
Plaintext
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.1,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding","epss":0.9003,"fix":"fixed","fixv":["13.19","14.16","15.11","16.7","17.3"],"id":"CVE-2025-1094","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":70.2234,"sev":"High","sugg":"15.11","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.4,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.69286,"fix":"fixed","fixv":["1.1.1t-r0"],"id":"CVE-2023-0286","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libcrypto1.1","rcvss":[{"score":7.4,"source":"nvd@nist.gov","version":"3.1"},{"score":7.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read mem","rel":["CVE-2023-0286"],"risk":51.61807,"sev":"High","sugg":"1.1.1t-r0","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.4,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.69286,"fix":"fixed","fixv":["1.1.1t-r0"],"id":"CVE-2023-0286","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libssl1.1","rcvss":[{"score":7.4,"source":"nvd@nist.gov","version":"3.1"},{"score":7.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read mem","rel":["CVE-2023-0286"],"risk":51.61807,"sev":"High","sugg":"1.1.1t-r0","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":6.5,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.75358,"fix":"fixed","fixv":["1.1.1u-r0"],"id":"CVE-2023-2650","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libcrypto1.1","rcvss":[{"score":6.5,"source":"nvd@nist.gov","version":"3.1"},{"score":6.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit. OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form","rel":["CVE-2023-2650"],"risk":43.33085,"sev":"Medium","sugg":"1.1.1u-r0","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":6.5,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.75358,"fix":"fixed","fixv":["1.1.1u-r0"],"id":"CVE-2023-2650","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libssl1.1","rcvss":[{"score":6.5,"source":"nvd@nist.gov","version":"3.1"},{"score":6.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit. OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form","rel":["CVE-2023-2650"],"risk":43.33085,"sev":"Medium","sugg":"1.1.1u-r0","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"3620d82daecac96f","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.41365,"fix":"fixed","fixv":["2.9.14-r2"],"id":"CVE-2022-40303","kev":false,"mt":"exact-direct-match","ns":"alpine:distro:alpine:3.16","pkg":"libxml2","rcvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.","rel":["CVE-2022-40303"],"risk":31.02375,"sev":"High","sugg":"2.9.14-r2","type":"apk","ver":"2.9.14-r1"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills.","epss":0.52421,"fix":"unknown","fixv":[],"id":"CVE-2024-2511","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":28.569444999999998,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills.","epss":0.52421,"fix":"unknown","fixv":[],"id":"CVE-2024-2511","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":28.569444999999998,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.2859,"fix":"fixed","fixv":["1.1.1t-r0"],"id":"CVE-2022-4450","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libcrypto1.1","rcvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and\ndecodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data.\nIf the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are\npopulated with pointers to buffers containing the relevant decoded data. The\ncaller is responsible for freeing those buffers. It is possible to construct a\nPEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()\nwill return a failure code but will populate the header argument with a pointer\nto a buffer that has already been freed. If the ca","rel":["CVE-2022-4450"],"risk":21.4425,"sev":"High","sugg":"1.1.1t-r0","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.2859,"fix":"fixed","fixv":["1.1.1t-r0"],"id":"CVE-2022-4450","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libssl1.1","rcvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and\ndecodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data.\nIf the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are\npopulated with pointers to buffers containing the relevant decoded data. The\ncaller is responsible for freeing those buffers. It is possible to construct a\nPEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()\nwill return a failure code but will populate the header argument with a pointer\nto a buffer that has already been freed. If the ca","rel":["CVE-2022-4450"],"risk":21.4425,"sev":"High","sugg":"1.1.1t-r0","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.9,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.23509,"fix":"fixed","fixv":["1.1.1t-r0"],"id":"CVE-2022-4304","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libcrypto1.1","rcvss":[{"score":5.9,"source":"nvd@nist.gov","version":"3.1"},{"score":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"A timing based side channel exists in the OpenSSL RSA Decryption implementation\nwhich could be sufficient to recover a plaintext across a network in a\nBleichenbacher style attack. To achieve a successful decryption an attacker\nwould have to be able to send a very large number of trial messages for\ndecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,\nRSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an\nencrypted pre-master secret to the server. An attacker that had observed a\ngenuine connection between a client and a server cou","rel":["CVE-2022-4304"],"risk":12.812405000000002,"sev":"Medium","sugg":"1.1.1t-r0","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.9,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.23509,"fix":"fixed","fixv":["1.1.1t-r0"],"id":"CVE-2022-4304","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libssl1.1","rcvss":[{"score":5.9,"source":"nvd@nist.gov","version":"3.1"},{"score":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"A timing based side channel exists in the OpenSSL RSA Decryption implementation\nwhich could be sufficient to recover a plaintext across a network in a\nBleichenbacher style attack. To achieve a successful decryption an attacker\nwould have to be able to send a very large number of trial messages for\ndecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,\nRSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an\nencrypted pre-master secret to the server. An attacker that had observed a\ngenuine connection between a client and a server cou","rel":["CVE-2022-4304"],"risk":12.812405000000002,"sev":"Medium","sugg":"1.1.1t-r0","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"a79f9a786809c847","cvss":[{"score":8.8,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.06858,"fix":"fixed","fixv":["1.19.4-r0"],"id":"CVE-2022-42898","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"krb5-libs","rcvss":[{"score":8.8,"source":"nvd@nist.gov","version":"3.1"},{"score":8.8,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\"","rel":["CVE-2022-42898"],"risk":5.58927,"sev":"High","sugg":"1.19.4-r0","type":"apk","ver":"1.19.3-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":9.1,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols ar","epss":0.05582,"fix":"unknown","fixv":[],"id":"CVE-2024-5535","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":5.05171,"sev":"Critical","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":9.1,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols ar","epss":0.05582,"fix":"unknown","fixv":[],"id":"CVE-2024-5535","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":5.05171,"sev":"Critical","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"3620d82daecac96f","cvss":[{"score":7.8,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.05812,"fix":"fixed","fixv":["2.9.14-r2"],"id":"CVE-2022-40304","kev":false,"mt":"exact-direct-match","ns":"alpine:distro:alpine:3.16","pkg":"libxml2","rcvss":[{"score":7.8,"source":"nvd@nist.gov","version":"3.1"},{"score":7.8,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.","rel":["CVE-2022-40304"],"risk":4.44618,"sev":"High","sugg":"2.9.14-r2","type":"apk","ver":"2.9.14-r1"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.05024,"fix":"fixed","fixv":["1.1.1t-r0"],"id":"CVE-2023-0215","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libcrypto1.1","rcvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"The public API function BIO_new_NDEF is a helper function used for streaming\nASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the\nSMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by\nend user applications.\n\nThe function receives a BIO from the caller, prepends a new BIO_f_asn1 filter\nBIO onto the front of it to form a BIO chain, and then returns the new head of\nthe BIO chain to the caller. Under certain conditions, for example if a CMS\nrecipient public key is invalid, the new filter BIO is freed and the function\nreturns a NULL result indica","rel":["CVE-2023-0215"],"risk":3.768,"sev":"High","sugg":"1.1.1t-r0","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.05024,"fix":"fixed","fixv":["1.1.1t-r0"],"id":"CVE-2023-0215","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libssl1.1","rcvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"The public API function BIO_new_NDEF is a helper function used for streaming\nASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the\nSMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by\nend user applications.\n\nThe function receives a BIO from the caller, prepends a new BIO_f_asn1 filter\nBIO onto the front of it to form a BIO chain, and then returns the new head of\nthe BIO chain to the caller. Under certain conditions, for example if a CMS\nrecipient public key is invalid, the new filter BIO is freed and the function\nreturns a NULL result indica","rel":["CVE-2023-0215"],"risk":3.768,"sev":"High","sugg":"1.1.1t-r0","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"nvd@nist.gov","version":"3.1"},{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.","epss":0.04393,"fix":"fixed","fixv":["12.21","13.17","14.14","15.9","16.5","17.1"],"id":"CVE-2024-10979","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":3.580295,"sev":"High","sugg":"15.9","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"nvd@nist.gov","version":"3.1"},{"score":8.8,"source":"secalert@redhat.com","version":"3.1"}],"desc":"A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.","epss":0.04322,"fix":"fixed","fixv":["11.22","12.17","13.13","14.10","15.5"],"id":"CVE-2023-5869","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":3.522430000000001,"sev":"High","sugg":"15.5","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.06531,"fix":"fixed","fixv":["1.1.1u-r2"],"id":"CVE-2023-3446","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libcrypto1.1","rcvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"},{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normall","rel":["CVE-2023-3446"],"risk":3.363465,"sev":"Medium","sugg":"1.1.1u-r2","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.06531,"fix":"fixed","fixv":["1.1.1u-r2"],"id":"CVE-2023-3446","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libssl1.1","rcvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"},{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normall","rel":["CVE-2023-3446"],"risk":3.363465,"sev":"Medium","sugg":"1.1.1u-r2","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":8.1,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","version":"3.1"},{"score":8.8,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application","epss":0.04002,"fix":"unknown","fixv":[],"id":"CVE-2026-45447","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":3.191595,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":8.1,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","version":"3.1"},{"score":8.8,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application","epss":0.04002,"fix":"unknown","fixv":[],"id":"CVE-2026-45447","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":3.191595,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.03985,"fix":"fixed","fixv":["1.1.1t-r1"],"id":"CVE-2023-0464","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libcrypto1.1","rcvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints. Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.","rel":["CVE-2023-0464"],"risk":2.9887499999999996,"sev":"High","sugg":"1.1.1t-r1","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.03985,"fix":"fixed","fixv":["1.1.1t-r1"],"id":"CVE-2023-0464","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libssl1.1","rcvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints. Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.","rel":["CVE-2023-0464"],"risk":2.9887499999999996,"sev":"High","sugg":"1.1.1t-r1","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"cab40152dbfc9d5f","cvss":[{"score":9.8,"source":"nvd@nist.gov","version":"3.1"}],"desc":"There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.","epss":0.03158,"fix":"","fixv":[],"id":"CVE-2022-48174","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"busybox","rcvss":[],"rdesc":"","rel":[],"risk":2.96852,"sev":"Critical","type":"apk","ver":"1.35.0-r17"}
|
|
{"art":"32ce50bc8da2c8ca","cvss":[{"score":9.8,"source":"nvd@nist.gov","version":"3.1"}],"desc":"There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.","epss":0.03158,"fix":"","fixv":[],"id":"CVE-2022-48174","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"ssl_client","rcvss":[],"rdesc":"","rel":[],"risk":2.96852,"sev":"Critical","type":"apk","ver":"1.35.0-r17"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":4.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood","epss":0.05842,"fix":"unknown","fixv":[],"id":"CVE-2024-9143","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":2.7165299999999997,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":4.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood","epss":0.05842,"fix":"unknown","fixv":[],"id":"CVE-2024-9143","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":2.7165299999999997,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.04459,"fix":"fixed","fixv":["1.1.1w-r1"],"id":"CVE-2023-5678","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libcrypto1.1","rcvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"},{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays. Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all","rel":["CVE-2023-5678"],"risk":2.296385,"sev":"Medium","sugg":"1.1.1w-r1","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.04459,"fix":"fixed","fixv":["1.1.1w-r1"],"id":"CVE-2023-5678","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libssl1.1","rcvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"},{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays. Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all","rel":["CVE-2023-5678"],"risk":2.296385,"sev":"Medium","sugg":"1.1.1w-r1","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the inter","epss":0.02925,"fix":"unknown","fixv":[],"id":"CVE-2024-4741","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":2.19375,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the inter","epss":0.02925,"fix":"unknown","fixv":[],"id":"CVE-2024-4741","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":2.19375,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.5,"source":"nvd@nist.gov","version":"3.1"},{"score":5.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted sour","epss":0.03187,"fix":"unknown","fixv":[],"id":"CVE-2024-0727","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":1.6731750000000003,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.5,"source":"nvd@nist.gov","version":"3.1"},{"score":5.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted sour","epss":0.03187,"fix":"unknown","fixv":[],"id":"CVE-2024-0727","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":1.6731750000000003,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.03047,"fix":"fixed","fixv":["1.1.1v-r0"],"id":"CVE-2023-3817","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libcrypto1.1","rcvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"},{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A ","rel":["CVE-2023-3817"],"risk":1.569205,"sev":"Medium","sugg":"1.1.1v-r0","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.03047,"fix":"fixed","fixv":["1.1.1v-r0"],"id":"CVE-2023-3817","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libssl1.1","rcvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"},{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A ","rel":["CVE-2023-3817"],"risk":1.569205,"sev":"Medium","sugg":"1.1.1v-r0","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8,"source":"nvd@nist.gov","version":"3.1"},{"score":8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.","epss":0.01808,"fix":"fixed","fixv":["12.18","13.14","14.11","15.6"],"id":"CVE-2024-0985","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":1.4012,"sev":"High","sugg":"15.6","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"secalert@redhat.com","version":"3.1"}],"desc":"IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or \"\"). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.","epss":0.01676,"fix":"fixed","fixv":["11.21","12.16","13.12","14.9","15.4"],"id":"CVE-2023-39417","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":1.31147,"sev":"High","sugg":"15.4","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":4.3,"source":"nvd@nist.gov","version":"3.1"},{"score":4.3,"source":"secalert@redhat.com","version":"3.1"}],"desc":"A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.","epss":0.02775,"fix":"fixed","fixv":["11.22","12.17","13.13","14.10","15.5"],"id":"CVE-2023-5868","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":1.2903749999999998,"sev":"Medium","sugg":"15.5","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.","epss":0.01565,"fix":"fixed","fixv":["12.20","13.16","14.13","15.8","16.4"],"id":"CVE-2024-7348","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":1.2246125,"sev":"High","sugg":"15.8","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password ","epss":0.01554,"fix":"unknown","fixv":[],"id":"CVE-2025-9230","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":1.1655,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password ","epss":0.01554,"fix":"unknown","fixv":[],"id":"CVE-2025-9230","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":1.1655,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"af54c9f1dadc7e6e","cvss":[{"score":7.8,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.01465,"fix":"fixed","fixv":["1.46.6-r0"],"id":"CVE-2022-1304","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libcom_err","rcvss":[{"score":7.8,"source":"nvd@nist.gov","version":"3.1"},{"score":6.8,"source":"nvd@nist.gov","version":"2.0"},{"score":7.8,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.","rel":["CVE-2022-1304"],"risk":1.120725,"sev":"High","sugg":"1.46.6-r0","type":"apk","ver":"1.46.5-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","version":"3.1"},{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.","epss":0.01372,"fix":"fixed","fixv":["14.21","15.16","16.12","17.8","18.2"],"id":"CVE-2026-2005","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":1.11818,"sev":"High","sugg":"15.16","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","version":"3.1"},{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.","epss":0.01342,"fix":"fixed","fixv":["14.21","15.16","16.12","17.8","18.2"],"id":"CVE-2026-2004","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":1.09373,"sev":"High","sugg":"15.16","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":4.4,"source":"nvd@nist.gov","version":"3.1"},{"score":2.2,"source":"secalert@redhat.com","version":"3.1"}],"desc":"A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.","epss":0.02555,"fix":"fixed","fixv":["11.22","12.17","13.13","14.10","15.5"],"id":"CVE-2023-5870","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":1.0603250000000002,"sev":"Medium","sugg":"15.5","type":"binary","ver":"15.0"}
|
|
{"art":"3620d82daecac96f","cvss":[{"score":9.8,"source":"nvd@nist.gov","version":"3.1"},{"score":7.8,"source":"cve@mitre.org","version":"3.1"}],"desc":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.","epss":0.01178,"fix":"unknown","fixv":[],"id":"CVE-2024-56171","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libxml2","rcvss":[],"rdesc":"","rel":[],"risk":1.0484200000000004,"sev":"Critical","type":"apk","ver":"2.9.14-r1"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","version":"3.1"},{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.","epss":0.01162,"fix":"fixed","fixv":["14.21","15.16","16.12","17.8","18.2"],"id":"CVE-2026-2006","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.94703,"sev":"High","sugg":"15.16","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"},{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_po","epss":0.01772,"fix":"unknown","fixv":[],"id":"CVE-2023-0466","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.91258,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"},{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_po","epss":0.01772,"fix":"unknown","fixv":[],"id":"CVE-2023-0466","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.91258,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.01772,"fix":"fixed","fixv":["1.1.1t-r2"],"id":"CVE-2023-0465","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libcrypto1.1","rcvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"},{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n","rel":["CVE-2023-0465"],"risk":0.91258,"sev":"Medium","sugg":"1.1.1t-r2","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.01772,"fix":"fixed","fixv":["1.1.1t-r2"],"id":"CVE-2023-0465","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"libssl1.1","rcvss":[{"score":5.3,"source":"nvd@nist.gov","version":"3.1"},{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"rdesc":"Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n","rel":["CVE-2023-0465"],"risk":0.91258,"sev":"Medium","sugg":"1.1.1t-r2","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":7.2,"source":"nvd@nist.gov","version":"3.1"},{"score":7.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.","epss":0.01199,"fix":"fixed","fixv":["11.20","12.15","13.11","14.8","15.3"],"id":"CVE-2023-2454","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.881265,"sev":"High","sugg":"15.3","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","version":"3.1"},{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.","epss":0.01006,"fix":"fixed","fixv":["14.23","15.18","16.14","17.10","18.4"],"id":"CVE-2026-6473","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.81989,"sev":"High","sugg":"15.18","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer. More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigaby","epss":0.01025,"fix":"unknown","fixv":[],"id":"CVE-2026-34180","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.76875,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer. More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigaby","epss":0.01025,"fix":"unknown","fixv":[],"id":"CVE-2026-34180","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.76875,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"7d63b7273d146863","cvss":[{"score":7.8,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.00979,"fix":"fixed","fixv":["6.3_p20220521-r1"],"id":"CVE-2023-29491","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"ncurses-libs","rcvss":[{"score":7.8,"source":"nvd@nist.gov","version":"3.1"}],"rdesc":"ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.","rel":["CVE-2023-29491"],"risk":0.748935,"sev":"High","sugg":"6.3_p20220521-r1","type":"apk","ver":"6.3_p20220521-r0"}
|
|
{"art":"eb1596ccf0e27b1b","cvss":[{"score":7.8,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.00979,"fix":"fixed","fixv":["6.3_p20220521-r1"],"id":"CVE-2023-29491","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"ncurses-terminfo-base","rcvss":[{"score":7.8,"source":"nvd@nist.gov","version":"3.1"}],"rdesc":"ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.","rel":["CVE-2023-29491"],"risk":0.748935,"sev":"High","sugg":"6.3_p20220521-r1","type":"apk","ver":"6.3_p20220521-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve c","epss":0.00944,"fix":"unknown","fixv":[],"id":"CVE-2025-69421","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.7080000000000001,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve c","epss":0.00944,"fix":"unknown","fixv":[],"id":"CVE-2025-69421","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.7080000000000001,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value ","epss":0.0092,"fix":"unknown","fixv":[],"id":"CVE-2025-69420","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.69,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value ","epss":0.0092,"fix":"unknown","fixv":[],"id":"CVE-2025-69420","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.69,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on t","epss":0.00916,"fix":"unknown","fixv":[],"id":"CVE-2026-63072","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.6869999999999999,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on t","epss":0.00916,"fix":"unknown","fixv":[],"id":"CVE-2026-63072","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.6869999999999999,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"3620d82daecac96f","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":2.9,"source":"cve@mitre.org","version":"3.1"}],"desc":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.","epss":0.01053,"fix":"unknown","fixv":[],"id":"CVE-2025-27113","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libxml2","rcvss":[],"rdesc":"","rel":[],"risk":0.668655,"sev":"High","type":"apk","ver":"2.9.14-r1"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL poin","epss":0.00885,"fix":"unknown","fixv":[],"id":"CVE-2026-28388","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.6637500000000001,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL poin","epss":0.00885,"fix":"unknown","fixv":[],"id":"CVE-2026-28388","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.6637500000000001,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":8.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfr","epss":0.00831,"fix":"unknown","fixv":[],"id":"CVE-2026-84782","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.6523349999999999,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":8.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfr","epss":0.00831,"fix":"unknown","fixv":[],"id":"CVE-2026-84782","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.6523349999999999,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":8.1,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the","epss":0.00804,"fix":"unknown","fixv":[],"id":"CVE-2026-7383","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.62712,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":8.1,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the","epss":0.00804,"fix":"unknown","fixv":[],"id":"CVE-2026-7383","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.62712,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.","epss":0.00762,"fix":"fixed","fixv":["13.22","14.19","15.14","16.10","17.6"],"id":"CVE-2025-8714","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.62103,"sev":"High","sugg":"15.14","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that","epss":0.00805,"fix":"unknown","fixv":[],"id":"CVE-2026-28389","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.6037499999999999,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis","epss":0.00805,"fix":"unknown","fixv":[],"id":"CVE-2026-28390","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.6037499999999999,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that","epss":0.00805,"fix":"unknown","fixv":[],"id":"CVE-2026-28389","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.6037499999999999,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"nvd@nist.gov","version":"3.1"},{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis","epss":0.00805,"fix":"unknown","fixv":[],"id":"CVE-2026-28390","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.6037499999999999,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an applicati","epss":0.0106,"fix":"unknown","fixv":[],"id":"CVE-2026-42766","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.5777,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an applicati","epss":0.0106,"fix":"unknown","fixv":[],"id":"CVE-2026-42766","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.5777,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription:","epss":0.01104,"fix":"unknown","fixv":[],"id":"CVE-2026-75806","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.56856,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription:","epss":0.01104,"fix":"unknown","fixv":[],"id":"CVE-2026-75806","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.56856,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Type confusion in PostgreSQL \"portal\"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00683,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-16239","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.5566450000000001,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00662,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-14669","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.5395300000000001,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads","epss":0.00707,"fix":"unknown","fixv":[],"id":"CVE-2026-9076","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.53025,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads","epss":0.00707,"fix":"unknown","fixv":[],"id":"CVE-2026-9076","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.53025,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":8.1,"source":"nvd@nist.gov","version":"3.1"},{"score":8.1,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs","epss":0.00671,"fix":"unknown","fixv":[],"id":"CVE-2026-28387","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.5233800000000001,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":8.1,"source":"nvd@nist.gov","version":"3.1"},{"score":8.1,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs","epss":0.00671,"fix":"unknown","fixv":[],"id":"CVE-2026-28387","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.5233800000000001,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00595,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-15742","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.48492500000000005,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":4.3,"source":"nvd@nist.gov","version":"3.1"},{"score":3.1,"source":"secalert@redhat.com","version":"3.1"}],"desc":"A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.","epss":0.01086,"fix":"fixed","fixv":["15.4"],"id":"CVE-2023-39418","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.47241,"sev":"Medium","sugg":"15.4","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messa","epss":0.00622,"fix":"unknown","fixv":[],"id":"CVE-2026-54874","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.46649999999999997,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messa","epss":0.00622,"fix":"unknown","fixv":[],"id":"CVE-2026-54874","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.46649999999999997,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":7.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously\ncrafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing\nnon-ASCII BMP code point can trigger a one byte write before the allocated\nbuffer.\n\nImpact summary: The out-of-bounds write can cause a memory corruption\nwhich can have various consequences including a Denial of Service.\n\nThe OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12\nBMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,\nthe helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16","epss":0.00607,"fix":"unknown","fixv":[],"id":"CVE-2025-69419","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.452215,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":7.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously\ncrafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing\nnon-ASCII BMP code point can trigger a one byte write before the allocated\nbuffer.\n\nImpact summary: The out-of-bounds write can cause a memory corruption\nwhich can have various consequences including a Denial of Service.\n\nThe OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12\nBMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,\nthe helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16","epss":0.00607,"fix":"unknown","fixv":[],"id":"CVE-2025-69419","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.452215,"sev":"High","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":7.5,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.","epss":0.00595,"fix":"fixed","fixv":["14.23","15.18","16.14","17.10","18.4"],"id":"CVE-2026-6479","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.44625000000000004,"sev":"High","sugg":"15.18","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.2,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","version":"3.1"},{"score":6.5,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.","epss":0.00558,"fix":"fixed","fixv":["14.23","15.18","16.14","17.10","18.4"],"id":"CVE-2026-6478","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.414315,"sev":"High","sugg":"15.18","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.","epss":0.00758,"fix":"fixed","fixv":["13.21","14.18","15.13","16.9","17.5"],"id":"CVE-2025-4207","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.41311000000000003,"sev":"Medium","sugg":"15.13","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":7.2,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00528,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-6471","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.38808,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":5.4,"source":"nvd@nist.gov","version":"3.1"},{"score":4.2,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under o","epss":0.00769,"fix":"fixed","fixv":["12.21","13.17","14.14","15.9","16.5","17.1"],"id":"CVE-2024-10976","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.37681000000000003,"sev":"Medium","sugg":"15.9","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24","epss":0.0046,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-14662","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.3749,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.4,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","version":"3.1"},{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \\lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.","epss":0.00454,"fix":"fixed","fixv":["14.23","15.18","16.14","17.10","18.4"],"id":"CVE-2026-6477","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.36546999999999996,"sev":"High","sugg":"15.18","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":5.4,"source":"nvd@nist.gov","version":"3.1"},{"score":5.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security po","epss":0.007,"fix":"fixed","fixv":["11.20","12.15","13.11","14.8","15.3"],"id":"CVE-2023-2455","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.364,"sev":"Medium","sugg":"15.3","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00436,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-14664","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.35534000000000004,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00436,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-14670","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.35534000000000004,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \\sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00435,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-15741","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.354525,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but ","epss":0.00427,"fix":"fixed","fixv":["13.22","14.19","15.14","16.10","17.6"],"id":"CVE-2025-8715","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.34800500000000006,"sev":"High","sugg":"15.14","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00427,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-19385","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.34800500000000006,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Type confusion in PostgreSQL module \"refint\" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject \"refint: Remove plan cache.\", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00423,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-14671","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.344745,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Type confusion with PostgreSQL \"internal\" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type \"internal\" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00423,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-14680","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.344745,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00414,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-14677","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.33741,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18,","epss":0.0041,"fix":"fixed","fixv":["14.23","15.18","16.14","17.10","18.4"],"id":"CVE-2026-6475","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.33415000000000006,"sev":"High","sugg":"15.18","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":4.2,"source":"nvd@nist.gov","version":"3.1"},{"score":4.2,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID ","epss":0.0069,"fix":"fixed","fixv":["12.21","13.17","14.14","15.9","16.5","17.1"],"id":"CVE-2024-10978","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.3174,"sev":"Medium","sugg":"15.9","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":4.3,"source":"nvd@nist.gov","version":"3.1"},{"score":3.1,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instru","epss":0.00728,"fix":"fixed","fixv":["14.12","15.7","16.3"],"id":"CVE-2024-4317","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.31668,"sev":"Medium","sugg":"15.7","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribut","epss":0.00589,"fix":"unknown","fixv":[],"id":"CVE-2026-22796","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.303335,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribut","epss":0.00589,"fix":"unknown","fixv":[],"id":"CVE-2026-22796","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.303335,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Stack buffer overflow in PostgreSQL module \"refint\" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a \"refint\" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.","epss":0.0037,"fix":"fixed","fixv":["14.23","15.18","16.14","17.10","18.4"],"id":"CVE-2026-6637","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.30155000000000004,"sev":"High","sugg":"15.18","type":"binary","ver":"15.0"}
|
|
{"art":"3620d82daecac96f","cvss":[{"score":7.7,"source":"nvd@nist.gov","version":"3.1"},{"score":7.8,"source":"cve@mitre.org","version":"3.1"}],"desc":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.","epss":0.00385,"fix":"unknown","fixv":[],"id":"CVE-2025-24928","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libxml2","rcvss":[],"rdesc":"","rel":[],"risk":0.2935625,"sev":"High","type":"apk","ver":"2.9.14-r1"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \\restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \\restrict and \\unrestrict to block this attack, but \\unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \\restrict would be affected, but we've not identified non-core use. Vers","epss":0.00355,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-18408","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.28932500000000005,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.1,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the \"COPY FROM STDIN\" or \"\\copy FROM STDIN\" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. \"COPY FROM\" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data row","epss":0.00358,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-6464","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.27924,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":4.1,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported ellip","epss":0.00613,"fix":"unknown","fixv":[],"id":"CVE-2024-13176","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.27891499999999997,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":4.1,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported ellip","epss":0.00613,"fix":"unknown","fixv":[],"id":"CVE-2024-13176","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.27891499999999997,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.1,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00334,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-14668","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.26052000000000003,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"8092164ff64609f2","cvss":[{"score":7,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.00349,"fix":"fixed","fixv":["1.2.3-r4"],"id":"CVE-2025-26519","kev":false,"mt":"exact-direct-match","ns":"alpine:distro:alpine:3.16","pkg":"musl","rcvss":[{"score":7,"source":"nvd@nist.gov","version":"3.1"},{"score":8.1,"source":"cve@mitre.org","version":"3.1"}],"rdesc":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.","rel":["CVE-2025-26519"],"risk":0.253025,"sev":"High","sugg":"1.2.3-r4","type":"apk","ver":"1.2.3-r0"}
|
|
{"art":"6f414781c949f74a","cvss":[{"score":7,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.00349,"fix":"fixed","fixv":["1.2.3-r4"],"id":"CVE-2025-26519","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"musl-utils","rcvss":[{"score":7,"source":"nvd@nist.gov","version":"3.1"},{"score":8.1,"source":"cve@mitre.org","version":"3.1"}],"rdesc":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.","rel":["CVE-2025-26519"],"risk":0.253025,"sev":"High","sugg":"1.2.3-r4","type":"apk","ver":"1.2.3-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":8.2,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00293,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-14679","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.23000499999999996,"sev":"High","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"cab40152dbfc9d5f","cvss":[{"score":5.5,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.00416,"fix":"fixed","fixv":["1.35.0-r18"],"id":"CVE-2023-42366","kev":false,"mt":"exact-direct-match","ns":"alpine:distro:alpine:3.16","pkg":"busybox","rcvss":[{"score":5.5,"source":"nvd@nist.gov","version":"3.1"}],"rdesc":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","rel":["CVE-2023-42366"],"risk":0.21839999999999998,"sev":"Medium","sugg":"1.35.0-r18","type":"apk","ver":"1.35.0-r17"}
|
|
{"art":"32ce50bc8da2c8ca","cvss":[{"score":5.5,"source":"nvd@nist.gov","version":"3.1"}],"desc":"","epss":0.00416,"fix":"fixed","fixv":["1.35.0-r18"],"id":"CVE-2023-42366","kev":false,"mt":"exact-indirect-match","ns":"alpine:distro:alpine:3.16","pkg":"ssl_client","rcvss":[{"score":5.5,"source":"nvd@nist.gov","version":"3.1"}],"rdesc":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","rel":["CVE-2023-42366"],"risk":0.21839999999999998,"sev":"Medium","sugg":"1.35.0-r18","type":"apk","ver":"1.35.0-r17"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":3.7,"source":"nvd@nist.gov","version":"3.1"},{"score":3.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.","epss":0.00622,"fix":"fixed","fixv":["12.14","13.10","14.7","15.2"],"id":"CVE-2022-41862","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.20836999999999994,"sev":"Low","sugg":"15.2","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.","epss":0.00364,"fix":"fixed","fixv":["13.23","14.20","15.15","16.11","17.7","18.1"],"id":"CVE-2025-12818","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.19838,"sev":"Medium","sugg":"15.15","type":"binary","ver":"15.0"}
|
|
{"art":"cab40152dbfc9d5f","cvss":[{"score":6.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).","epss":0.00312,"fix":"","fixv":[],"id":"CVE-2025-60876","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"busybox","rcvss":[],"rdesc":"","rel":[],"risk":0.17939999999999998,"sev":"Medium","type":"apk","ver":"1.35.0-r17"}
|
|
{"art":"32ce50bc8da2c8ca","cvss":[{"score":6.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).","epss":0.00312,"fix":"","fixv":[],"id":"CVE-2025-60876","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"ssl_client","rcvss":[],"rdesc":"","rel":[],"risk":0.17939999999999998,"sev":"Medium","type":"apk","ver":"1.35.0-r17"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof seve","epss":0.00317,"fix":"unknown","fixv":[],"id":"CVE-2026-35189","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.16325499999999998,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.3,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof seve","epss":0.00317,"fix":"unknown","fixv":[],"id":"CVE-2026-35189","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.16325499999999998,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":4.3,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00329,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-6470","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.15298499999999998,"sev":"Medium","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":4.3,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Improper validation of type \"oidvector\" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.","epss":0.00319,"fix":"fixed","fixv":["14.21","15.16","16.12","17.8","18.2"],"id":"CVE-2026-2003","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.148335,"sev":"Medium","sugg":"15.16","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":3.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a de","epss":0.00428,"fix":"unknown","fixv":[],"id":"CVE-2026-54872","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.14337999999999998,"sev":"Low","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":3.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a de","epss":0.00428,"fix":"unknown","fixv":[],"id":"CVE-2026-54872","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.14337999999999998,"sev":"Low","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":4.3,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00301,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-14678","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.13996499999999998,"sev":"Medium","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":4.3,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00301,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-18024","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.13996499999999998,"sev":"Medium","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":3.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature d","epss":0.00396,"fix":"unknown","fixv":[],"id":"CVE-2026-77696","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.13265999999999997,"sev":"Low","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":3.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature d","epss":0.00396,"fix":"unknown","fixv":[],"id":"CVE-2026-77696","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.13265999999999997,"sev":"Low","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"8092164ff64609f2","cvss":[{"score":8.1,"source":"cve@mitre.org","version":"3.1"}],"desc":"An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).","epss":0.00164,"fix":"","fixv":[],"id":"CVE-2026-40200","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"musl","rcvss":[],"rdesc":"","rel":[],"risk":0.12792,"sev":"High","type":"apk","ver":"1.2.3-r0"}
|
|
{"art":"6f414781c949f74a","cvss":[{"score":8.1,"source":"cve@mitre.org","version":"3.1"}],"desc":"An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).","epss":0.00164,"fix":"","fixv":[],"id":"CVE-2026-40200","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"musl-utils","rcvss":[],"rdesc":"","rel":[],"risk":0.12792,"sev":"High","type":"apk","ver":"1.2.3-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":3.7,"source":"nvd@nist.gov","version":"3.1"},{"score":3.1,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.","epss":0.00398,"fix":"fixed","fixv":["12.21","13.17","14.14","15.9","16.5","17.1"],"id":"CVE-2024-10977","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.12736,"sev":"Low","sugg":"15.9","type":"binary","ver":"15.0"}
|
|
{"art":"d11e74ed20dadd26","cvss":[{"score":5.5,"source":"nvd@nist.gov","version":"3.1"},{"score":2.9,"source":"cve@mitre.org","version":"3.1"}],"desc":"zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.","epss":0.00248,"fix":"unknown","fixv":[],"id":"CVE-2026-27171","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"zlib","rcvss":[],"rdesc":"","rel":[],"risk":0.11408,"sev":"Medium","type":"apk","ver":"1.2.12-r3"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":3.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This typically yields a simple SIGSEGV, but rare cases might achieve client-specific integrity impact via the write. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00335,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-16241","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.1139,"sev":"Low","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":3.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the prior statistics object owner. DROP TABLE remains able to remove statistics objects, so this exploit achieves nothing in many ownership arrangements. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","epss":0.00318,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-6469","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.10812000000000001,"sev":"Low","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":4.3,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.","epss":0.00214,"fix":"fixed","fixv":["14.23","15.18","16.14","17.10","18.4"],"id":"CVE-2026-6474","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.09950999999999999,"sev":"Medium","sugg":"15.18","type":"binary","ver":"15.0"}
|
|
{"art":"8092164ff64609f2","cvss":[{"score":4.8,"source":"cna@vuldb.com","version":"4.0"},{"score":3.3,"source":"cna@vuldb.com","version":"3.1"},{"score":1.7,"source":"cna@vuldb.com","version":"2.0"}],"desc":"A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.","epss":0.00236,"fix":"","fixv":[],"id":"CVE-2026-6042","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"musl","rcvss":[],"rdesc":"","rel":[],"risk":0.09754666666666667,"sev":"Medium","type":"apk","ver":"1.2.3-r0"}
|
|
{"art":"6f414781c949f74a","cvss":[{"score":4.8,"source":"cna@vuldb.com","version":"4.0"},{"score":3.3,"source":"cna@vuldb.com","version":"3.1"},{"score":1.7,"source":"cna@vuldb.com","version":"2.0"}],"desc":"A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.","epss":0.00236,"fix":"","fixv":[],"id":"CVE-2026-6042","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"musl-utils","rcvss":[],"rdesc":"","rel":[],"risk":0.09754666666666667,"sev":"Medium","type":"apk","ver":"1.2.3-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":4.2,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions","epss":0.00209,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-14666","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.09613999999999999,"sev":"Medium","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":5.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses betwee","epss":0.00179,"fix":"unknown","fixv":[],"id":"CVE-2026-22795","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.093975,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":5.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses betwee","epss":0.00179,"fix":"unknown","fixv":[],"id":"CVE-2026-22795","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.093975,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":4.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Writing large, newline-free data into a BIO chain using the\nline-buffering filter where the next BIO performs short writes can trigger\na heap-based out-of-bounds write.\n\nImpact summary: This out-of-bounds write can cause memory corruption which\ntypically results in a crash, leading to Denial of Service for an application.\n\nThe line-buffering BIO filter (BIO_f_linebuffer) is not used by default in\nTLS/SSL data paths. In OpenSSL command-line applications, it is typically\nonly pushed onto stdout/stderr on VMS systems. Third-party applications that\nexplicitly use this filter with a ","epss":0.00189,"fix":"unknown","fixv":[],"id":"CVE-2025-68160","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.091665,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":4.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: Writing large, newline-free data into a BIO chain using the\nline-buffering filter where the next BIO performs short writes can trigger\na heap-based out-of-bounds write.\n\nImpact summary: This out-of-bounds write can cause memory corruption which\ntypically results in a crash, leading to Denial of Service for an application.\n\nThe line-buffering BIO filter (BIO_f_linebuffer) is not used by default in\nTLS/SSL data paths. In OpenSSL command-line applications, it is typically\nonly pushed onto stdout/stderr on VMS systems. Third-party applications that\nexplicitly use this filter with a ","epss":0.00189,"fix":"unknown","fixv":[],"id":"CVE-2025-68160","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.091665,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":3.8,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.6, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.","epss":0.00269,"fix":"fixed","fixv":["14.24","15.19","16.15","18.5"],"id":"CVE-2026-14673","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.09146,"sev":"Low","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":5.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.","epss":0.00159,"fix":"fixed","fixv":["14.23","15.18","16.14","17.10","18.4"],"id":"CVE-2026-6472","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.08268,"sev":"Medium","sugg":"15.18","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":3.1,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.","epss":0.00243,"fix":"fixed","fixv":["13.23","14.20","15.15","16.11","17.7","18.1"],"id":"CVE-2025-12817","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.074115,"sev":"Low","sugg":"15.15","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":3.1,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms ","epss":0.00236,"fix":"fixed","fixv":["13.22","14.19","15.14","16.10","17.6"],"id":"CVE-2025-8713","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.07198,"sev":"Low","sugg":"15.14","type":"binary","ver":"15.0"}
|
|
{"art":"0bbf5c9dd36d4a50","cvss":[{"score":6.5,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","version":"3.1"}],"desc":"Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. V","epss":0.00114,"fix":"fixed","fixv":["14.24","15.19","16.15","17.11","18.5"],"id":"CVE-2026-14663","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"postgresql","rcvss":[],"rdesc":"","rel":[],"risk":0.06555,"sev":"Medium","sugg":"15.19","type":"binary","ver":"15.0"}
|
|
{"art":"87a7f557f0e7360a","cvss":[{"score":4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: When using the low-level OCB API directly with AES-NI or\u003cbr\u003eother hardware-accelerated code paths, inputs whose length is not a multiple\u003cbr\u003eof 16 bytes can leave the final partial block unencrypted and unauthenticated.\u003cbr\u003e\u003cbr\u003eImpact summary: The trailing 1-15 bytes of a message may be exposed in\u003cbr\u003ecleartext on encryption and are not covered by the authentication tag,\u003cbr\u003eallowing an attacker to read or tamper with those bytes without detection.\u003cbr\u003e\u003cbr\u003eThe low-level OCB encrypt and decrypt routines in the hardware-accelerated\u003cbr\u003estream path process full 16-byte blocks but do not ","epss":0.00132,"fix":"unknown","fixv":[],"id":"CVE-2025-69418","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libcrypto1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.0594,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"47c7de0aa73a8e83","cvss":[{"score":4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","version":"3.1"}],"desc":"Issue summary: When using the low-level OCB API directly with AES-NI or\u003cbr\u003eother hardware-accelerated code paths, inputs whose length is not a multiple\u003cbr\u003eof 16 bytes can leave the final partial block unencrypted and unauthenticated.\u003cbr\u003e\u003cbr\u003eImpact summary: The trailing 1-15 bytes of a message may be exposed in\u003cbr\u003ecleartext on encryption and are not covered by the authentication tag,\u003cbr\u003eallowing an attacker to read or tamper with those bytes without detection.\u003cbr\u003e\u003cbr\u003eThe low-level OCB encrypt and decrypt routines in the hardware-accelerated\u003cbr\u003estream path process full 16-byte blocks but do not ","epss":0.00132,"fix":"unknown","fixv":[],"id":"CVE-2025-69418","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"libssl1.1","rcvss":[],"rdesc":"","rel":[],"risk":0.0594,"sev":"Medium","type":"apk","ver":"1.1.1q-r0"}
|
|
{"art":"cab40152dbfc9d5f","cvss":[{"score":3.3,"source":"nvd@nist.gov","version":"3.1"},{"score":3.2,"source":"cve@mitre.org","version":"3.1"}],"desc":"In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.","epss":0.00183,"fix":"","fixv":[],"id":"CVE-2025-46394","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"busybox","rcvss":[],"rdesc":"","rel":[],"risk":0.0571875,"sev":"Low","type":"apk","ver":"1.35.0-r17"}
|
|
{"art":"32ce50bc8da2c8ca","cvss":[{"score":3.3,"source":"nvd@nist.gov","version":"3.1"},{"score":3.2,"source":"cve@mitre.org","version":"3.1"}],"desc":"In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.","epss":0.00183,"fix":"","fixv":[],"id":"CVE-2025-46394","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"ssl_client","rcvss":[],"rdesc":"","rel":[],"risk":0.0571875,"sev":"Low","type":"apk","ver":"1.35.0-r17"}
|
|
{"art":"cab40152dbfc9d5f","cvss":[{"score":2.5,"source":"cve@mitre.org","version":"3.1"}],"desc":"In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.","epss":0.00178,"fix":"","fixv":[],"id":"CVE-2024-58251","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"busybox","rcvss":[],"rdesc":"","rel":[],"risk":0.04895,"sev":"Low","type":"apk","ver":"1.35.0-r17"}
|
|
{"art":"32ce50bc8da2c8ca","cvss":[{"score":2.5,"source":"cve@mitre.org","version":"3.1"}],"desc":"In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.","epss":0.00178,"fix":"","fixv":[],"id":"CVE-2024-58251","kev":false,"mt":"cpe-match","ns":"nvd:cpe","pkg":"ssl_client","rcvss":[],"rdesc":"","rel":[],"risk":0.04895,"sev":"Low","type":"apk","ver":"1.35.0-r17"}
|
|
{"eol":{"name":"alpine","version":"3.16.2"}}
|