Alpine Linux
Monthly
Incorrect privilege assignment in Gitea (all versions through 1.26.4) causes scoped API/OAuth2/basic-auth/HTTP-signature tokens to be trusted beyond the scope they were issued for, so any authenticated user who can mint a token can read and modify resources the token was never meant to reach, including private-release drafts, package-registry endpoints, go-get and git-over-HTTP repository access. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, 8.1) confirms the attacker must already hold a valid account and credential, and the flaw is a silent authorization bypass rather than a pre-authentication compromise. Upstream patched the token-scope plumbing in Gitea 1.27.2 (Alpine ships the fix as gitea 1.27.3-r0); EPSS is only 0.24% (14th percentile) and no public exploit code or CISA KEV entry was identified at time of analysis.
Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package manager) that can result in Remote Code Execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a malicious APKINDEX.tar.gz file with a bad pax. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution by crafting a malicious APKINDEX.tar.gz file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Buffer overflow in Net-SNMP's SNMP parsing code can allow remote attackers to corrupt memory, potentially leading to code execution or denial of service, and affects users of net-snmp packages including Alpine Linux before 5.9.5.2-r0 and Debian 11. Publicly available exploit code exists, but the precise trigger is not detailed in the NVD entry and may depend on reachable SNMP service exposure or valid SNMP query prerequisites; EPSS is low at 0.42%.
Incorrect privilege assignment in Gitea (all versions through 1.26.4) causes scoped API/OAuth2/basic-auth/HTTP-signature tokens to be trusted beyond the scope they were issued for, so any authenticated user who can mint a token can read and modify resources the token was never meant to reach, including private-release drafts, package-registry endpoints, go-get and git-over-HTTP repository access. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, 8.1) confirms the attacker must already hold a valid account and credential, and the flaw is a silent authorization bypass rather than a pre-authentication compromise. Upstream patched the token-scope plumbing in Gitea 1.27.2 (Alpine ships the fix as gitea 1.27.3-r0); EPSS is only 0.24% (14th percentile) and no public exploit code or CISA KEV entry was identified at time of analysis.
Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package manager) that can result in Remote Code Execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a malicious APKINDEX.tar.gz file with a bad pax. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution by crafting a malicious APKINDEX.tar.gz file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Buffer overflow in Net-SNMP's SNMP parsing code can allow remote attackers to corrupt memory, potentially leading to code execution or denial of service, and affects users of net-snmp packages including Alpine Linux before 5.9.5.2-r0 and Debian 11. Publicly available exploit code exists, but the precise trigger is not detailed in the NVD entry and may depend on reachable SNMP service exposure or valid SNMP query prerequisites; EPSS is low at 0.42%.