← All tracked CVEs
Updated 23:00
High severity
High15d SLAWe fix a high vulnerability within 15 days of publication, under our service-level agreement (SLA). We track 788 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| In progress | CairoSVG <2.9.1 quadratic CPU DoS via path parsing and draw_markers on complex SVGs | secure-packages-rolling | — | |
| In progress | pgvector <0.8.6 IVFFlat index integer wraparound enables OOB write, RCE on 32-bit | secure-packages-rolling | — | |
| In progress | Use-after-free in Apache Arrow C++ IPC file reader with pre-buffering, variadic buffers (15–23) | secure-packages-26.05 | — | |
| In progress | AIOHTTP <3.14.0 CookieJar.load() arbitrary code execution vulnerability via untrusted input | secure-packages-26.05 | — | |
| In progress | Incomplete http.cookies CVE-2026-0672 fix: Morsel update/|=, unpickling allow control chars; BaseCookie.js_output lacks validation. | secure-packages-25.11 | — | |
| In progress | lxml <6.1.0 default parsers enable XXE local file read from untrusted XML | secure-packages-26.05 | — | |
| In progress | Mako TemplateLookup.get_template path traversal with // URIs enables arbitrary file reads before 1.3.11 | secure-packages-26.05 | — | |
| In progress | Windows backslash traversal bypass in Mako <1.3.12 enables reading files outside template dir | secure-packages-26.05 | — | |
| In progress | AIOHTTP <3.14.0 leaks per-request cookies on cross-origin redirects | secure-packages-26.05 | — | |
| In progress | AIOHTTP pre-3.14.0 header injection via user-controlled multipart/payload headers | secure-packages-26.05 | — | |
| In progress | AIOHTTP pre-3.14.1 allows unlimited pipelined requests leading to memory exhaustion DoS | secure-packages-26.05 | — | |
| In progress | AIOHTTP <3.14.1: incomplete WebSocket frames bypass memory-use limits via large payloads | secure-packages-26.05 | — | |
| In progress | AIOHTTP <3.14.1: TLS SNI bypass via connection reuse with varying server_hostname | secure-packages-26.05 | — | |
| In progress | AIOHTTP pre-3.14.1 C parser bypasses max_line_size; oversized HTTP lines cause DoS | secure-packages-26.05 | — | |
| In progress | AIOHTTP <3.14.1 in-memory decompression during cleanup enables DoS via zip bomb | secure-packages-26.05 | — | |
| In progress | AIOHTTP pre-3.14.1 CookieJar save/load loses host-only cookie flag | secure-packages-26.05 | — | |
| In progress | AIOHTTP <3.14.1 doesn't close payload resources on mid-write disconnect, causing resource starvation | secure-packages-26.05 | — | |
| In progress | sqlparse pre-0.6.0 quadratic CPU in parse/format/split from nested token flattening | secure-packages-rolling | — | |
| In progress | secure-packages-rolling | — | ||
| In progress | sh.py pre-2.2.4 _uid incomplete privilege drop retains privileged supplementary groups on Linux/Unix | secure-packages-26.05 | — | |
| In progress | QUIC packet buffer retention allows remote peers to force unbounded memory overhead | secure-packages-rolling | — | |
| In progress | QUIC retains packet buffers too long, enabling remote memory over-allocation via crafted packets | secure-packages-26.05 | — | |
| In progress | Nokogiri NodeSet#[] 32-bit index truncation causes out-of-bounds read prior to 1.19.4 | secure-packages-rolling | — | |
| In progress | Nokogiri pre-1.19.4 CRuby: invalid Document#encoding= frees encoding, causing segfault or memory leak | secure-packages-rolling | — | |
| In progress | Perl ≤5.43.10 pack/unpack S_measure_struct overflow allows out-of-bounds heap read via large repeat counts | secure-packages-rolling | — | |
| In progress | Nokogiri <1.19.4 vulnerability: NULL deref via uninitialized XML::Node wrapper methods | secure-packages-rolling | — | |
| In progress | Nokogiri <1.19.4: use-after-free when setting XML attribute value causes invalid read/segfault | secure-packages-rolling | — | |
| In progress | sqlparse <0.6.0 quadratic CPU from scanning unmatched dollar-quote/comment delimiters in parse/format/split | secure-packages-rolling | — | |
| In progress | FFmpeg 2.7–8.1.2 TDSC decoder OOB write causing heap corruption and potential RCE | secure-packages-rolling | — | |
| In progress | FFmpeg <=8.1.2 heap corruption via TY demuxer OOB write using crafted ffconcat with -safe 0 | secure-packages-rolling | — | |
| In progress | FFmpeg 3.4-8.1.2 vf_floodfill OOB write with -reinit_filter 0, heap corruption | secure-packages-rolling | — | |
| In progress | FFmpeg 3.0-8.1.2 vf_swaprect OOB write on odd-width NV12 frames causing heap corruption | secure-packages-rolling | — | |
| In progress | Out-of-bounds heap read in PyTorch torchvision GIF decoder enables DoS/info leak (≤0.28.0) | secure-packages-rolling | — | |
| In progress | FFmpeg ≤8.1.2 vf_hqdn3d heap OOB write when -reinit_filter 0 and resolution increases | secure-packages-rolling | — | |
| In progress | FFmpeg ≤8.1.2 IAMF demuxer uncontrolled allocation from 17-byte input via count_label | secure-packages-rolling | — | |
| In progress | FFmpeg up to 8.1.2 LCL/ZLIB decoder leaks uninitialized heap; short inflate enables ASLR bypass | secure-packages-rolling | — | |
| In progress | FFmpeg <=8.1.2 MACE6 CAF bytes_per_packet integer overflow causes heap OOB write, RCE | secure-packages-rolling | — | |
| In progress | Heap out-of-bounds write in FFmpeg PNG/APNG encoder eXIf handling (≤8.1.2) | secure-packages-rolling | — | |
| In progress | FFmpeg 7.0–8.1.2 vf_quirc heap OOB write via crafted PGS/SUP subtitles mismatched dimensions | secure-packages-rolling | — | |
| In progress | Hugging Face Accelerate ≤1.14.0 path traversal in checkpoint loading allows file read/DoS | secure-packages-rolling | — | |
| In progress | Accelerate ≤1.14.0 path traversal in load_checkpoint_* via unsanitized weight_map enables file read/DoS | secure-packages-26.05 | — | |
| In progress | AIOHTTP pre-3.14.3 heap out-of-bounds read DoS via malformed responses in C parser | secure-packages-26.05 | — | |
| In progress | cryptography pkcs7_decrypt* side-channel enables Bleichenbacher oracle via error/timing distinctions (44.0.0-49.x) | secure-packages-26.05 | — | |
| In progress | Duplicate self-signed certs trigger exponential chain recursion DoS in python-cryptography 42–48 | secure-packages-26.05 | — | |
| In progress | FFmpeg <9.0 DVB subtitle parser signed integer overflow via WTV causes heap overflow | secure-packages-rolling | — | |
| In progress | FFmpeg <9.0 CFHD decoder OOB heap write via crafted AVI during probing, RCE | secure-packages-rolling | — | |
| In progress | sqlparse pre-0.6.0 quadratic CPU in parse()/format(strip_comments) from group_comments rescans | secure-packages-rolling | — | |
| In progress | OpenSSL TLS server SSL_set_SSL_CTX() mid-handshake OOB read/write with differing provider sigalgs, DoS | secure-packages-26.05 | — | |
| In progress | OpenSSL TLS server SSL_set_SSL_CTX switch causes OOB read/write when provider sigalgs differ | secure-packages-rolling | — | |
| In progress | JupyterLab ImageViewer SVG blob URL bug allows XSS, server code execution (pre-4.5.10/4.6.2) | secure-packages-26.05 | — |