Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
687230 source statements · aliases may refer to the same vulnerabilityAssimp through 6.0.5 NULL Pointer Dereference via Ogre Animation Track
cve-program ·
https://github.com: assimp
NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask
cve-program ·
https://github.com/netsurf-browser/libnsbmp: libnsbmp
MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs
cve-program ·
Vendor product: mongosh
libansilove 1.3.0 through 1.4.2 NULL Pointer Dereference via ansilove_xbin
cve-program ·
https://github.com/ansilove/libansilove: libansilove
FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits
cve-program ·
https://github.com: FreeImage · Vendor product: FreeImage
Kameleo Local API user-info information disclosure
cve-program ·
Vendor product: Kameleo
Use-after-free with `CParameter::StableInBuffer`
osv ·
crates.io: zstd-safe
Uninitialized memory exposed by `write::Decoder` on a corrupt legacy frame
osv ·
crates.io: zstd
Use-after-free through `init_using_cdict` and `init_using_ddict`
osv ·
crates.io: zstd-safe
`Seekable` reads a NULL or out-of-bounds seek table
osv ·
crates.io: zstd-safe
Aliasing violations in splice, mutable iteration and cursors
osv · GHSA-924w-mwc9-86m8
crates.io: skiplist
WebAssembly allocator shim corrupts memory on allocation failure
osv ·
crates.io: zstd-sys
Uninitialized memory exposed when streaming decompression of a legacy frame fails
osv ·
crates.io: zstd-safe
Use-after-free of a dictionary after a one-shot call on a context with an open stream
osv ·
crates.io: zstd-safe
Build environment compiled into the library and readable at runtime
osv ·
crates.io: rustpython-vm
Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
osv ·
crates.io: zstd-safe
Out-of-bounds read with an out-of-range `InBuffer::pos`
osv ·
crates.io: zstd-safe
Use-after-free when changing a multithreaded context with an unfinished frame
osv ·
crates.io: zstd-safe
`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end
osv ·
crates.io: zstd-safe
Out-of-bounds read in `Log2Cache::nlog2n()`, `nlog2n_difference()` and `plog2p()`
osv ·
crates.io: dahl-salso
`OutBuffer::around_pos` exposes uninitialized memory
osv ·
crates.io: zstd-safe
Data from an abandoned stream leaks into the next stream on a reused context
osv ·
crates.io: zstd
Out-of-bounds read when training a dictionary from inconsistent sample sizes
osv ·
crates.io: zstd
SSRF and local file disclosure via unvalidated URLs
osv · GHSA-23hp-j76v-pcwj
crates.io: webpage
Use-after-free from a comparator that answers inconsistently
osv · GHSA-cc53-p78w-23w9
crates.io: skiplist
`PamHandle::get_user` can cause an authentication bypass
osv ·
crates.io: pam-bindings
Out-of-bounds read in `train_from_buffer` when sample sizes overflow
osv ·
crates.io: zstd-safe
libTiMidity through 0.2.8 Stack Out-of-Bounds Write via parse_gen in SoundFont Loader
cve-program ·
https://github.com/sezero/libtimidity: libtimidity
libewf through 20260924 Heap Out-of-Bounds Read via L01 Extended Attribute Parsing
cve-program ·
https://github.com/libyal/libewf: libewf
UADE through 3.05 Out-of-Bounds Read in uade_filemagic via Short Module
cve-program ·
https://gitlab.com: uade
Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service
cve-program ·
https://github.com: apache/brpc
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: sudo · https://access.redhat.com/downloads/content/package-browser/: sudo · https://access.redhat.com/downloads/content/package-browser/: sudo
La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation
cve-program ·
Vendor product: docs
Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
cve-program ·
https://github.com: apache/brpc
Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: ipa · https://access.redhat.com/downloads/content/package-browser/: ipa · https://access.redhat.com/downloads/content/package-browser/: idm:client
Gcc: libstdc++ integer overflow in `new` operator
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: gcc · https://access.redhat.com/downloads/content/package-browser/: gcc · https://catalog.redhat.com/software/containers/: gcc-main
Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: gcc · https://access.redhat.com/downloads/content/package-browser/: gcc · https://catalog.redhat.com/software/containers/: gcc13-main
Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
cve-program ·
https://repo.hex.pm: hackney · https://github.com: benoitc/hackney
HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
cve-program ·
https://repo.hex.pm: hackney · https://github.com: benoitc/hackney
SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
cve-program ·
https://repo.hex.pm: hackney · https://github.com: benoitc/hackney
Kameleo Local API profiles information disclosure
cve-program ·
Vendor product: Kameleo
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.