NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2016-4738 

libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2025-26465 

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2019-3859 

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Note: Red Hat has scored this vulnerability as 5.0 (Medium), based on distribution-specific mitigations.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2019-3860 

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Note: Red Hat has scored this vulnerability as 5.0 (Medium), based on distribution-specific mitigations

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2017-1000381 

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2020-27617 

eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2015-6748 

Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.