← All tracked CVEs
Updated 12:00
High severity
High15d SLAWe fix a high vulnerability within 15 days of publication, under our service-level agreement (SLA). We track 788 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| Fixed | Uncontrolled recursion vulnerability in Apache Thrift Node.js bindings prior to 0.23.0 | secure-packages-rolling | Oct 12, 2026 | |
| Fixed | Apache Thrift Python pre-0.24.0 data amplification vulnerability with highly compressed data | secure-packages-rolling | Oct 12, 2026 | |
| Fixed | Integer overflow/wraparound vulnerability in Apache Thrift versions prior to 0.23.0 | secure-packages-rolling | Oct 12, 2026 | |
| Fixed | Out-of-bounds read vulnerability in Apache Thrift versions before 0.23.0 | secure-packages-rolling | Oct 12, 2026 | |
| Fixed | Integer overflow/wraparound in Apache Thrift Go TFramedTransport before 0.23.0 | secure-packages-rolling | Oct 12, 2026 | |
| Fixed | Mismatched memory management in Thrift c_glib pre-0.23.0 crashes servers on crafted requests | secure-packages-rolling | Oct 12, 2026 | |
| Fixed | Incorrect authorization in Zulip <=5.4 lets members make their bots organization administrators | secure-packages-rolling | Oct 12, 2026 | |
| Fixed | Improper access control in GitHub repository zulip/zulip prior to 4.10 | secure-packages-rolling | Oct 12, 2026 | |
| Fixed | Zulip <1.3.12 allows deactivated users to access messages with SSO enabled | secure-packages-rolling | Oct 12, 2026 | |
| Fixed | PYSEC-2026-4151: PyJWT 2.13.0 accepts public JWK/JWKS as HMAC secret, enabling HS* token forgery | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | PYSEC-2026-4150: PyJWT 2.13.0 accepts RSA public JWK as HMAC key via BOM bypass | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | PYSEC-2026-4149: DER-encoded public keys bypass PyJWT HMAC guard, enabling HS256 key confusion forgery | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | PYSEC-2026-4144: PyJWT PyJWKClient follows unvalidated JWKS redirects, causing header leaks and forged JWT acceptance | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | PYSEC-2026-4143: PyJWT accepts forged HS256 JWTs when verifying empty 'oct' JWK via PyJWK | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | GHSA-w2cx-738m-mc7w: PyJWT 2.13.0 algorithm confusion allows HS* forgery via public JWK as HMAC | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | GHSA-r6x4-923q-g947: UTF-8 BOM not stripped in JWK detection allows RSA as HMAC secret in PyJWT 2.13.0 | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | GHSA-p4g4-x82p-q773: PyJWT HMAC prepare_key accepts DER public keys, enabling HS/RS key confusion token forgery | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | GHSA-9v7f-9g4p-ffgj: PyJWT PyJWKClient follows unvalidated redirects, allowing JWKS poisoning and forged JWTs | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | GHSA-9j54-fg26-wv3r: PyJWT inconsistent empty HMAC key validation via PyJWK allows HS256 JWT forgery | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | PyJWT 2.9–2.13: PyJWKSet fails on malformed RSA JWK, causing auth failures/DoS | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | PyJWT 2.13.x accepts public JWK as HMAC secret, enabling JWT forgery | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | PyJWT 2.13.x BOM in JWK enables HMAC key misuse and token forgery | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | PyJWT <2.14.0 treats DER public keys as HMAC secrets, enabling JWT forgery | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | PyJWT pre-2.14.0: Unknown kid forces repeated JWKS refresh, amplifying outbound requests | secure-packages-26.05 | Oct 12, 2026 | |
| Fixed | Improper input validation in Chrome Printing before 154.0.8037.57 enables RCE outside sandbox via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome V8 type confusion pre-154.0.8037.57 enables sandboxed code execution via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Externally controlled reference in Chrome DevTools pre-154.0.8037.57 lets adjacent attacker bypass system access restrictions | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Use-after-free in Chrome DevTools enables sandbox RCE via crafted HTML (pre-154.0.8037.57) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chromecast use-after-free in Chrome <154.0.8037.57 allows code execution outside sandbox via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | XML bug in Chrome <154.0.8037.57 enables remote sandboxed code execution via HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Type confusion in Chrome IndexedDB pre-154.0.8037.57 enables sandboxed RCE via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | DevTools CSRF bypasses web origin policy via crafted HTML in Chrome <154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome iOS <154.0.8037.57 Navigation auth flaw enables sandbox escape and RCE | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Use-after-free in Chrome Verifier enables sandbox escape RCE via network pre-154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Use-after-free in Google Chrome Bindings enables sandboxed RCE via crafted HTML (pre-154.0.8037.57) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome pre-154.0.8037.57 Views use-after-free allows sandbox escape RCE via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Use-after-free in Chrome Bluetooth pre-154.0.8037.57 allows renderer sandbox escape, remote code execution | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Actor use-after-free before 154.0.8037.57 enables sandboxed RCE via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome DevTools race condition pre-154.0.8037.57 enabled site isolation bypass via crafted extension | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome WebAudio use-after-free allows sandbox remote code execution via crafted HTML pre-154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Desktop <154.0.8037.57 input validation bug enables RCE outside sandbox via network | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | PDFium use-after-free enables sandboxed RCE via crafted PDF in Chrome <154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | HID use-after-free enables sandbox escape code execution via crafted HTML in Chrome <154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Incorrect WebProtect reference resolution allows compromised renderer sandbox escape RCE in Chrome <154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Google Chrome Metrics use-after-free (pre-154.0.8037.57) enables remote code execution outside sandbox via crafted network traffic | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Bluetooth cleanup flaw allows bypass of system access restrictions via crafted HTML pre-154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Android GPU out-of-bounds write enables sandbox escape RCE via crafted HTML (pre-154.0.8037.57) Critical | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Use-after-free in Chrome Printing pre-154.0.8037.57 allows code execution outside sandbox via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | High-severity Chrome Aura use-after-free pre-154.0.8037.57 enables local code execution outside sandbox | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <154.0.8037.57 HID authorization flaw let compromised renderer bypass access restrictions via crafted HTML | secure-packages-25.11 | Oct 9, 2026 |