← All tracked CVEs
Updated 21:00
High severity
High15d SLAWe fix a high vulnerability within 15 days of publication, under our service-level agreement (SLA). We track 788 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| Fixed | GHSA-2wc2-fm75-p42x: Soupsieve CSS parser allocates unbounded memory for large comma-separated selector lists, causing DoS | secure-packages-25.11 | Sep 15, 2026 | |
| Fixed | Incomplete CVE-2026-0672 fix allows control characters via Morsel.update, |=, unpickling; BaseCookie.js_output lacks output validation | secure-packages-26.05 | Sep 14, 2026 | |
| In progress | Stack buffer overflow in Graphviz 2.20.2 push_subg via large DOT Agraph_t count, DoS/RCE | secure-packages-rolling | — | |
| In progress | Graphviz yyerror format string vulnerability in lib/cgraph/scan.l allows remote exploitation | secure-packages-rolling | — | |
| In progress | Graphviz lib/common/shapes.c buffer overflow enables RCE/DoS via crafted file (<= f8b9e035) | secure-packages-rolling | — | |
| In progress | REXML gem <3.3.2 DoS vulnerabilities parsing XML with excessive whitespace, '>]', and ']>' | secure-packages-rolling | — | |
| In progress | REXML 3.3.2 DoS vulnerability via XML entity expansion in SAX2/pull parser APIs | secure-packages-rolling | — | |
| In progress | REXML gem <3.3.9 ReDoS parsing hex numeric character references; only affects Ruby 3.1 | secure-packages-rolling | — | |
| In progress | Hugo v0.161–0.165 Node.js tools symlink bypass allows arbitrary file disclosure during builds | secure-packages-25.11 | — | |
| In progress | Hugo 0.123.1–0.165: symlinked theme/module mount roots bypass confinement, expose external files | secure-packages-25.11 | — | |
| In progress | Hugo v0.162–0.165 mixed-case schemes bypass security.http.urls IP-literal deny rule | secure-packages-25.11 | — | |
| In progress | PyJWT pre-2.15.0 unhandled RecursionError in get_signing_key_from_jwt via nested payload causes 500s | secure-packages-rolling | — | |
| In progress | PyJWT PyJWKClient.get_signing_key_from_jwt unhandled RecursionError causes HTTP 500 (<2.15.0) | secure-packages-26.05 | — | |
| In progress | PyJWT <2.15.0 OKPAlgorithm.from_jwk doesn't verify x matches d; token replay risk | secure-packages-rolling | — | |
| In progress | PyJWT <2.15.0 OKP JWK x/d mismatch allows sender-constrained token misuse | secure-packages-26.05 | — | |
| In progress | Clipboard cell paste trusts metadata.trusted, enabling XSS without execution in JupyterLab/Notebook/JupyterLite | secure-packages-26.05 | — | |
| In progress | virtualenv pre-21.7.13 activation scripts command injection due to surplus quoting | secure-packages-rolling | — | |
| In progress | virtualenv pre-21.7.13 activation scripts over-quote, enabling command injection via crafted paths in bash/zsh/fish | secure-packages-26.05 | — | |
| In progress | virtualenv pre-21.7.13 activation scripts vulnerable to command injection from crafted environment paths | secure-packages-25.11 | — | |
| In progress | virtualenv <21.7.12 fails to verify seed wheel digests, enabling malicious wheel injection | secure-packages-rolling | — | |
| In progress | virtualenv <21.7.12 lacks digest verification for pip/setuptools seed wheels, enabling substitution | secure-packages-26.05 | — | |
| In progress | virtualenv <21.7.12 skips digest verification for pip/setuptools seed wheels, risking cache poisoning | secure-packages-25.11 | — | |
| In progress | virtualenv <21.7.12 Windows activation yields command injection via attacker-controlled prompt | secure-packages-rolling | — | |
| In progress | virtualenv pre-21.7.12 cmd.exe prompt injection via activate.bat enables arbitrary command execution | secure-packages-26.05 | — | |
| In progress | virtualenv pre-21.7.12 Windows prompt quote handling allows activation command injection | secure-packages-25.11 | — | |
| In progress | pypdf _page_labels.py DoS via oversized Roman page labels causing memory exhaustion | secure-packages-26.05 | — | |
| In progress | pypdf <6.18.0 DoS via long indirect-object/generation-number tokens without whitespace | secure-packages-26.05 | — | |
| In progress | pypdf pre-6.18.1 /ToUnicode oversized tokens in parse_bfchar cause memory exhaustion | secure-packages-26.05 | — | |
| In progress | pypdf <6.18.1 excessive memory from oversized simple font /Widths during text extraction | secure-packages-26.05 | — | |
| In progress | pypdf <6.18.1 DoS via padded malformed FlateDecode triggering inefficient bytewise decompression | secure-packages-26.05 | — | |
| In progress | pypdf <6.19.0: crafted form fields with flattening trigger appearance-stream loop DoS | secure-packages-26.05 | — | |
| In progress | pypdf <6.19.0 attachment lookups reparse full embedded-file list, causing long runtimes | secure-packages-26.05 | — | |
| In progress | pypdf pre-6.19.0: crafted PDFs cause unbounded page-label strings, leading to memory exhaustion | secure-packages-26.05 | — | |
| In progress | Jinja2 template injection in fsspec ReferenceFileSystem enables RCE via Kerchunk reference JSON | secure-packages-26.05 | — | |
| In progress | Chrome Windows CredentialProvider uncontrolled search path enables local code execution outside sandbox pre-155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Confused deputy in Android Chrome SignIn pre-155.0.8059.39 enables remote privileged page access | secure-packages-rolling | — | |
| In progress | iOS Chrome Reader Mode code injection enables origin policy bypass via crafted HTML pre-155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Chrome Media use-after-free enables sandboxed RCE via crafted HTML prior to 155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Missing Actor authorization allows sandbox escape via crafted HTML in Chrome <155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Chrome Parser use-after-free allows sandboxed RCE via crafted HTML prior to 155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Missing authorization in Chrome WebAppInstalls enables sandbox escape RCE via crafted HTML pre-155.0.8059.39 | secure-packages-rolling | — | |
| In progress | iOS Chrome pre-155.0.8059.39 missing navigation authorization enables origin bypass via crafted HTML to privileged page | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 FileSystem auth flaw enables renderer-compromised web origin policy bypass via crafted HTML page | secure-packages-rolling | — | |
| In progress | Chrome Android <155.0.8059.39 Actor auth bug allows compromised renderer to bypass site isolation | secure-packages-rolling | — | |
| In progress | Use-after-free in Chrome Track pre-155.0.8059.39 allows sandboxed RCE via crafted HTML | secure-packages-rolling | — | |
| In progress | V8 race condition in Chrome pre-155.0.8059.39 allows remote sandboxed code execution via crafted HTML | secure-packages-rolling | — | |
| In progress | Pre-155.0.8059.39 Chrome for iOS Autofill cleanup flaw enabled exfiltration via socially engineered HTML | secure-packages-rolling | — | |
| In progress | Use-after-free in Chrome PDF allows sandboxed RCE before 155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Android Chrome <155.0.8059.39 Passwords auth flaw allows site isolation bypass after renderer compromise | secure-packages-rolling | — | |
| In progress | V8 race condition in Chrome <155.0.8059.39 enables remote code execution in renderer sandbox via HTML | secure-packages-rolling | — |