CVE-2018-1060

python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

CVSS 3.1 · 7.5 High EPSS 5.0% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 11 more

CVE-2024-9398

firefox: thunderbird: External protocol handlers could be enumerated via popups

By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux and 5 more

CVE-2026-18922

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Directory Server Directory Server E4s Enterprise Linux and 8 more

CVE-2018-14647

python: Missing salt initialization in _elementtree.c module

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

CVSS 3.1 · 7.5 High EPSS 10.9% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 12 more

CVE-2026-73433

Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write

A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Gstreamer Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-18649

Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 5 more

CVE-2026-73434

Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing

A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Gstreamer Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2023-1390

kernel: remote DoS in TIPC kernel module

A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.

CVSS 3.1 · 7.5 High EPSS 5.1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Aus and 2 more

CVE-2023-35788

kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt()

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 17 more

CVE-2026-19387

Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 5 more

CVE-2023-4622

Use-after-free in Linux kernel's af_unix component

A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c (or backported equivalents).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 6 more

CVE-2023-29550

Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10

Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Firefox Mobile and 7 more

CVE-2023-29533

Mozilla: Fullscreen notification obscured

A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Firefox Mobile and 7 more

CVE-2023-29541

Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux

Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Firefox Mobile and 7 more

CVE-2023-29539

Mozilla: Content-Disposition filename truncation leads to Reflected File Download

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Firefox Mobile and 7 more

CVE-2023-29536

Mozilla: Invalid free from JavaScript code

An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Firefox Mobile and 7 more

CVE-2023-29548

Mozilla: Incorrect optimization result on ARM64

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Firefox Mobile and 7 more

CVE-2023-29535

Mozilla: Potential Memory Corruption following Garbage Collector compaction

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Firefox Mobile and 7 more

CVE-2025-43441

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ios Ipad Os Ipados and 11 more

CVE-2025-43438

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Apple Redhat

Products

Ios Ipad Os Ipados and 12 more