CVE & Exploit Intelligence Database

Updated 2h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

337,123 CVEs tracked 53,219 with exploits 4,686 exploited in wild 1,539 CISA KEV 3,912 Nuclei templates 37,757 vendors 42,422 researchers

7 results Clear all

CVE-2016-20021 9.8 CRITICAL EPSS 0.00

Gentoo Portage <3.0.47 - Info Disclosure

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.

CWE-347 Jan 12, 2024

CVE-2019-20384 5.5 MEDIUM EPSS 0.00

Gentoo Portage < 2.3.84 - Race Condition

Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners.

CWE-362 Jan 21, 2020

CVE-2004-2778 7.1 HIGH EPSS 0.00

Gentoo Portage - Access Control

Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restricted directories or execute restricted commands via navigating to the affected directories, or executing the affected commands.

CWE-264 Jun 27, 2017

CVE-2013-2100 EPSS 0.01

Gentoo Portage < 2.1.12.2 - Cryptographic Issue

The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.

CWE-310 Sep 29, 2014

CVE-2008-4394 EPSS 0.00

Portage <2.1.4.5 - RCE

Multiple untrusted search path vulnerabilities in Portage before 2.1.4.5 include the current working directory in the Python search path, which allows local users to execute arbitrary code via a modified Python module that is loaded by the (1) ys-apps/portage, (2) net-mail/fetchmail, (3) app-editors/leo ebuilds, and other ebuilds.

CVE-2007-6249 EPSS 0.00

etc-update <2.1.3.11 - Info Disclosure

etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file, often resulting in permissions weaker than those of the original files, which might allow local users to obtain sensitive information by reading the merge file.

CWE-200 Dec 15, 2007

CVE-2004-1901 5.5 MEDIUM EPSS 0.00

Gentoo Portage < 2.0.50 - Symlink Following

Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles.

CWE-59 Dec 31, 2004