⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Automatically generated suggestions

Create Draft to queue a suggestion for refinement.

Dismiss to remove a suggestion from the queue.

CVE-2023-5215
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): ADJACENT_NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 3 months, 3 weeks ago
Libnbd: crash or misbehaviour when nbd server returns an unexpected block size

A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.

libnbd
*
virt:av/libnbd
virt:rhel/libnbd
virt-devel:av/libnbd

pkgs.libnbd.x86_64-linux

Network Block Device client library in userspace

pkgs.libnbd.aarch64-linux

Network Block Device client library in userspace

pkgs.python311Packages.libnbd

Network Block Device client library in userspace

pkgs.python312Packages.libnbd.x86_64-linux

Network Block Device client library in userspace

pkgs.python311Packages.libnbd.aarch64-linux

Network Block Device client library in userspace

pkgs.python312Packages.libnbd.aarch64-linux

Network Block Device client library in userspace
Package maintainers: 2
CVE-2024-4028
3.8 LOW
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 3 months, 3 weeks ago
Keycloak-core: stored xss in keycloak when creating a items in admin console

A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.

keycloak
<18.0.8
keycloak-core

pkgs.keycloak.x86_64-linux

Identity and access management for modern applications and services

pkgs.keycloak.aarch64-linux

Identity and access management for modern applications and services

pkgs.python311Packages.python-keycloak.x86_64-linux

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.x86_64-linux

Provides access to the Keycloak API

pkgs.python311Packages.python-keycloak.aarch64-linux

Provides access to the Keycloak API

pkgs.python311Packages.python-keycloak.x86_64-darwin

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.aarch64-linux

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.x86_64-darwin

Provides access to the Keycloak API

pkgs.python311Packages.python-keycloak.aarch64-darwin

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.aarch64-darwin

Provides access to the Keycloak API
Package maintainers: 3
CVE-2025-2157
3.3 LOW
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 3 months, 3 weeks ago
Foreman: disclosure of executed commands and outputs in foreman / red hat satellite

A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclosure and privilege escalation if exploited effectively.

foreman
==6.16
==6.17

pkgs.foreman.x86_64-linux

Process manager for applications with multiple components

pkgs.foreman.aarch64-linux

Process manager for applications with multiple components

pkgs.foreman.x86_64-darwin

Process manager for applications with multiple components

pkgs.foreman.aarch64-darwin

Process manager for applications with multiple components
Package maintainers: 1
CVE-2023-6787
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): HIGH
  • Availability impact (A): NONE
created 3 months, 3 weeks ago
Keycloak: session hijacking via re-authentication

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter their credentials. If the user cancels this re-authentication by selecting "Restart login," an account takeover may occur, as the new session, with a different SUB, will possess the same SID as the previous session.

keycloak
<22.0.10
<24.0.3
keycloak-core
rhbk/keycloak-rhel9
*
rhbk/keycloak-rhel9-operator
*
rhbk/keycloak-operator-bundle
*

pkgs.keycloak.x86_64-linux

Identity and access management for modern applications and services

pkgs.keycloak.aarch64-linux

Identity and access management for modern applications and services

pkgs.python311Packages.python-keycloak.x86_64-linux

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.x86_64-linux

Provides access to the Keycloak API

pkgs.python311Packages.python-keycloak.aarch64-linux

Provides access to the Keycloak API

pkgs.python311Packages.python-keycloak.x86_64-darwin

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.aarch64-linux

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.x86_64-darwin

Provides access to the Keycloak API

pkgs.python311Packages.python-keycloak.aarch64-darwin

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.aarch64-darwin

Provides access to the Keycloak API
Package maintainers: 3
CVE-2022-28652
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 3 months, 3 weeks ago
~/.config/apport/settings parsing is vulnerable to "billion laughs" attack

~/.config/apport/settings parsing is vulnerable to "billion laughs" attack

apport
<2.21.0

pkgs.texlivePackages.skrapport

'Simple' class for reports, etc.

pkgs.texlivePackages.skrapport.x86_64-linux

'Simple' class for reports, etc.

pkgs.haskellPackages.apportionment.x86_64-linux

Round a set of numbers while maintaining its sum

pkgs.haskellPackages.apportionment.aarch64-linux

Round a set of numbers while maintaining its sum

pkgs.haskellPackages.apportionment.x86_64-darwin

Round a set of numbers while maintaining its sum

pkgs.haskellPackages.apportionment.aarch64-darwin

Round a set of numbers while maintaining its sum
Package maintainers: 1
CVE-2025-0650
8.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 3 months, 3 weeks ago
Ovn: egress acls may be bypassed via specially crafted udp packet

A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured with a logical switch with DNS records set on it and if the same switch has any egress ACLs configured. This issue can lead to unauthorized access to virtual machines and containers running on the OVN network.

ovn
==22.03.8
==24.03.5
==24.09.2
ovn2.11
ovn2.12
ovn2.13
ovn-2021
ovn22.03
*
ovn22.06
*
ovn22.09
*
ovn22.12
*
ovn23.03
*
ovn23.06
*
ovn23.09
*
ovn24.03
*
ovn24.09
*

pkgs.turbovnc

High-speed version of VNC derived from TightVNC

pkgs.ovn-lts.x86_64-linux

Open Virtual Network

pkgs.ovn-lts.aarch64-linux

Open Virtual Network

pkgs.turbovnc.x86_64-linux

High-speed version of VNC derived from TightVNC

pkgs.turbovnc.aarch64-linux

High-speed version of VNC derived from TightVNC

pkgs.python311Packages.slovnet

Deep-learning based NLP modeling for Russian language

pkgs.python312Packages.slovnet

Deep-learning based NLP modeling for Russian language

pkgs.nanovna-saver.x86_64-linux

A tool for reading, displaying and saving data from the NanoVNA

pkgs.nanovna-saver.aarch64-linux

A tool for reading, displaying and saving data from the NanoVNA

pkgs.nanovna-saver.x86_64-darwin

A tool for reading, displaying and saving data from the NanoVNA

pkgs.nanovna-saver.aarch64-darwin

A tool for reading, displaying and saving data from the NanoVNA

pkgs.python311Packages.slovnet.x86_64-linux

Deep-learning based NLP modeling for Russian language

pkgs.python312Packages.slovnet.x86_64-linux

Deep-learning based NLP modeling for Russian language

pkgs.python311Packages.slovnet.aarch64-linux

Deep-learning based NLP modeling for Russian language

pkgs.python311Packages.slovnet.x86_64-darwin

Deep-learning based NLP modeling for Russian language

pkgs.python312Packages.slovnet.aarch64-linux

Deep-learning based NLP modeling for Russian language

pkgs.python312Packages.slovnet.x86_64-darwin

Deep-learning based NLP modeling for Russian language

pkgs.python311Packages.slovnet.aarch64-darwin

Deep-learning based NLP modeling for Russian language

pkgs.python312Packages.slovnet.aarch64-darwin

Deep-learning based NLP modeling for Russian language
Package maintainers: 6
CVE-2024-2313
2.8 LOW
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
created 3 months, 3 weeks ago
If kernel headers need to be extracted, bpftrace will attempt …

If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.

bpftrace
<v0.20.2

pkgs.linuxKernel.packages.linux_6_1.bpftrace

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_lqx.bpftrace

High-level tracing language for Linux eBPF

pkgs.linuxPackages_zen.bpftrace.x86_64-linux

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_4_19.bpftrace

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_5_10.bpftrace

High-level tracing language for Linux eBPF

pkgs.linuxPackages_zen.bpftrace.aarch64-linux

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_libre.bpftrace

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_hardened.bpftrace

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_latest_libre.bpftrace

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_lqx.bpftrace.x86_64-linux

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_4_19.bpftrace.x86_64-linux

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_5_10.bpftrace.x86_64-linux

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_lqx.bpftrace.aarch64-linux

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_4_19.bpftrace.aarch64-linux

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_5_10.bpftrace.aarch64-linux

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_hardened.bpftrace.x86_64-linux

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_hardened.bpftrace.aarch64-linux

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_latest_libre.bpftrace.x86_64-linux

High-level tracing language for Linux eBPF

pkgs.linuxKernel.packages.linux_latest_libre.bpftrace.aarch64-linux

High-level tracing language for Linux eBPF
Package maintainers: 4
CVE-2024-43437
5.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 3 months, 3 weeks ago
Moodle: xss risk when restoring malicious course backup file

A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files.

moodle
<4.1.12
<4.4.2
<4.3.6
<4.2.9

pkgs.moodle

Free and open-source learning management system (LMS) written in PHP

pkgs.moodle.x86_64-linux

Free and open-source learning management system (LMS) written in PHP

pkgs.moodle.aarch64-linux

Free and open-source learning management system (LMS) written in PHP

pkgs.moodle.x86_64-darwin

Free and open-source learning management system (LMS) written in PHP

pkgs.moodle.aarch64-darwin

Free and open-source learning management system (LMS) written in PHP

pkgs.texlivePackages.moodle

Generating Moodle quizzes via LaTeX

pkgs.texlivePackages.moodle.x86_64-linux

Generating Moodle quizzes via LaTeX
Package maintainers: 2
CVE-2023-26020
5.7 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): HIGH
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 3 months, 3 weeks ago
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Crafter Studio

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26.

Studio
=<3.1.26
=<4.0.1

pkgs.vscode-extensions.visualstudioexptteam.intellicode-api-usage-examples

See relevant code examples from GitHub for over 100K different APIs right in your editor

pkgs.vscode-extensions.visualstudioexptteam.vscodeintellicode.x86_64-linux

AI-assisted development

pkgs.vscode-extensions.visualstudioexptteam.vscodeintellicode.aarch64-linux

AI-assisted development

pkgs.vscode-extensions.visualstudioexptteam.vscodeintellicode.x86_64-darwin

AI-assisted development

pkgs.vscode-extensions.visualstudioexptteam.vscodeintellicode.aarch64-darwin

AI-assisted development

pkgs.vscode-extensions.visualstudioexptteam.intellicode-api-usage-examples.x86_64-linux

See relevant code examples from GitHub for over 100K different APIs right in your editor

pkgs.vscode-extensions.visualstudioexptteam.intellicode-api-usage-examples.aarch64-linux

See relevant code examples from GitHub for over 100K different APIs right in your editor

pkgs.vscode-extensions.visualstudioexptteam.intellicode-api-usage-examples.x86_64-darwin

See relevant code examples from GitHub for over 100K different APIs right in your editor

pkgs.vscode-extensions.visualstudioexptteam.intellicode-api-usage-examples.aarch64-darwin

See relevant code examples from GitHub for over 100K different APIs right in your editor
Package maintainers: 3
CVE-2025-27274
4.9 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 4 months ago
WordPress GPX Viewer plugin <= 2.2.11 - Path Traversal vulnerability

Path Traversal vulnerability in NotFound GPX Viewer allows Path Traversal. This issue affects GPX Viewer: from n/a through 2.2.11.

gpx-viewer
=<2.2.11

pkgs.gpx-viewer

Simple tool to visualize tracks and waypoints stored in a gpx file

pkgs.gpx-viewer.x86_64-linux

Simple tool to visualize tracks and waypoints stored in a gpx file

pkgs.gpx-viewer.aarch64-linux

Simple tool to visualize tracks and waypoints stored in a gpx file
Package maintainers: 1