CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 03/03/2022 |
| CVE-2022-23308 | ÉLEVÉE7.5 | valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. | 26/02/2022 |
| CVE-2021-4115 | MOYENNE5.5 | There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned | 21/02/2022 |
| CVE-2022-25315 | CRITIQUE9.8 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. | 18/02/2022 |
| CVE-2022-25314 | ÉLEVÉE7.5 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. | 18/02/2022 |
| CVE-2022-25313 | MOYENNE6.5 | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. | 18/02/2022 |
| CVE-2022-25236 | CRITIQUE9.8 | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. | 16/02/2022 |
| CVE-2022-25235 | CRITIQUE9.8 | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. | 16/02/2022 |
| CVE-2022-0391 | ÉLEVÉE7.5 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a cr | 09/02/2022 |
| CVE-2021-4034KEV | ÉLEVÉE7.8 | A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends tr | 28/01/2022 |
| CVE-2022-21375 | MOYENNE5.5 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnera | 19/01/2022 |
| CVE-2022-21271 | MOYENNE5.3 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker | 19/01/2022 |
| CVE-2021-4185 | ÉLEVÉE7.5 | Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file | 30/12/2021 |
| CVE-2021-4184 | ÉLEVÉE7.5 | Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file | 30/12/2021 |
| CVE-2021-4183 | MOYENNE5.5 | Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file | 30/12/2021 |
| CVE-2021-4182 | ÉLEVÉE7.5 | Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file | 30/12/2021 |
| CVE-2021-4181 | ÉLEVÉE7.5 | Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file | 30/12/2021 |
| CVE-2021-44790 | CRITIQUE9.8 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier. | 20/12/2021 |