← All tracked CVEs
Updated 10:00
Critical severity
Critical7d SLAWe fix a critical vulnerability within 7 days of publication, under our service-level agreement (SLA). We track 174 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| Fixed | RDMA/srpt: srpt_alloc_rw_ctxs failure leaves stale counters, dangling rw_ctxs, wrong sq_wr_avail accounting | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Use-after-free in ANGLE allows remote code execution outside sandbox in Chrome Android <155.0.8059.39 | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 Media integer overflow enables remote code execution outside sandbox via HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome iOS before 155.0.8059.39 improper input validation enables sandbox escape RCE | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome Media out-of-bounds write enables sandbox-escape RCE via crafted HTML (prior to 155.0.8059.39, Medium severity) | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chromecast use-after-free in Chrome <155.0.8059.39 allows remote code execution outside sandbox | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Incomplete Dawn cleanup allows arbitrary code execution outside sandbox via crafted HTML in Chrome <155.0.8059.39 | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 UI authorization flaw enables remote RCE outside sandbox via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome FileSystem auth flaw allowed sandbox escape RCE via crafted HTML (pre-155.0.8059.39) | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | iOS Chrome pre-155.0.8059.39 missing authorization enables sandbox-escape RCE via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Use-after-free in Chrome Tabs on Mac <155.0.8059.39 allows sandbox escape RCE via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Use-after-free in Tint enables RCE outside sandbox via crafted HTML, Chrome <155.0.8059.39 | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Incorrect authorization in Chrome Android Search pre-155.0.8059.39 allows remote sandbox escape RCE via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome Android <155.0.8059.39 WebGL integer overflow enables remote arbitrary code execution outside sandbox | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome pre-155.0.8059.39 Permissions info leak enables site isolation bypass via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Use-after-free in Chrome Network pre-155.0.8059.39 allows RCE outside sandbox via extension | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Use-after-free in Chrome Core before 155.0.8059.39 enables remote sandbox-escape RCE via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <154.0.8037.97 FedCM use-after-free enables RCE outside sandbox via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome WebGL out-of-bounds write prior to 154.0.8037.97 enables sandbox-escape RCE | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome Windows FileSystem auth flaw allowed RCE outside sandbox via crafted HTML pre-154.0.8037.97 | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Hugo tailwindcss AllowChildProcess bypasses Node permissions, enabling arbitrary code execution during builds | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Perl <=5.43.9 regex alternation >65535 overflows trie field causing silent mismatches | secure-packages-rolling | Oct 5, 2026 | |
| Fixed | Unbound ≤1.26.0 heap overflow via CNAME TTL rewrite/compression pointer; crash/RCE risk | secure-packages-rolling | Oct 1, 2026 | |
| Fixed | Unbound <=1.26.0 DNSSEC DNSKEY compression pointer overflow allows DoS and possible RCE | secure-packages-rolling | Oct 1, 2026 | |
| Fixed | Apache Thrift C++ bindings: Improper input quantity validation causes out-of-bounds read (pre-0.24.0) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Out-of-bounds read vulnerability in Apache Thrift c_glib before 0.24.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Heap-based buffer overflow in Apache Thrift C++ bindings before v0.24.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Improper TLS certificate hostname validation in Apache Thrift c_glib before 0.24.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | PYSEC-2026-366: Jupyter nbconvert handlers lack CSP sandbox, enabling stored XSS via unsanitized HTMLExporter output | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | GHSA-fcw5-x6j4-ccmp: Jupyter nbconvert serves unsandboxed notebook HTML; non-sanitized output enables stored XSS, token exfiltration | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Unbound <=1.26.0 heap overflow via CNAME TTL rewrite and compression pointer; RCE risk | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Unbound ≤1.26.0 DNSSEC DNSKEY compression buffer overflow enables DoS and possible RCE | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | SimpleEval <1.0.5 sandbox escape via object attribute leakage and callback-passed dangerous functions | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | tarfile erroneously converts AREGTYPE to DIRTYPE during GNU longname/longlink, misinterpreting crafted archives | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Zulip <4.9 exposes RabbitMQ port 25672; weak cookie enables RCE and data exfiltration | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Unbound ≤1.26.0 CNAME synthesis TTL enforcement leads to heap corruption, possible RCE | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Unbound <=1.26.0 DNSSEC DNSKEY compression pointer digest buffer overflow enabling DoS and potential RCE | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Use-after-free in Dawn on Chrome Android enables RCE outside sandbox via crafted HTML (pre-153.0.8010.52) | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Use-after-free in Chrome Extensions before 153.0.8010.52 allows remote sandbox-escape RCE | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Critical WebGL buffer overflow in Chrome Android allows remote code execution outside sandbox pre-153.0.8010.52 | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Critical use-after-free in Dawn on Android Chrome <153.0.8010.52 enables RCE outside sandbox | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Use-after-free in Google Chrome Extensions enables remote code execution outside sandbox via crafted extension (pre-153.0.8010.52) | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Android Chrome WebGL buffer overflow pre-153.0.8010.52 enables sandbox escape RCE via crafted HTML Critical | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Critical use-after-free in Dawn on Android Chrome <153.0.8010.52 allows remote sandbox-escape RCE | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | Use-after-free in Chrome Extensions enables remote code execution outside sandbox prior to 153.0.8010.52 | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | Chrome Android <153.0.8010.52 WebGL buffer overflow enables remote sandbox-escape RCE via crafted HTML | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | ksmbd smb2_open use-after-free during durable reconnect due to early ksmbd_put_durable_fd call | secure-packages-25.11 | Sep 21, 2026 | |
| Fixed | PYSEC-2026-2120: Black GitHub Action use_pyproject allows malicious version URL, enabling RCE and secrets exposure | secure-packages-26.05 | Sep 21, 2026 | |
| Fixed | Black GitHub Action vulnerability: pyproject URL version injection enables RCE and secret exfiltration | secure-packages-26.05 | Sep 21, 2026 | |
| Fixed | Redis ≤8.2.1 Lua GC use-after-free enables authenticated RCE via EVAL/EVALSHA | secure-packages-26.05 | Sep 21, 2026 |