← All tracked CVEs
Updated 16:00
High severity
High15d SLAWe fix a high vulnerability within 15 days of publication, under our service-level agreement (SLA). We track 788 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| Fixed | GHSA-fr4h-3cph-29xv: GHSA-fr4h-3cph-29xv crafted hoisted alias escapes node_modules and overwrites layout in pnpm/pacquet | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | GHSA-c59q-g84q-2gj5: Unvalidated dp.parse() name allows lockfile path traversal; arbitrary writes during pnpm install | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | GHSA-c3mw-737p-c7g2: 500 error logs leak Referer token in jupyter_server/log.py before 2.21.0 | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | GHSA-72r4-9c5j-mj57: Arbitrary file deletion via pnpm patch-remove path traversal and symlink resolution flaws | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | GHSA-5wx6-mg75-v57r: Opaque locator normalization allows build-approval collisions (peer-suffix stripping, extra-@, semver-tail) GHSA-5wx6-mg75-v57r | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Jupyter Server <2.21.0 logs token-bearing Referer on 5xx, exposing auth tokens in logs | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | pnpm pre-10.34.5/11.11.0 path traversal via scoped tarball name enables arbitrary file overwrite and code execution | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | pnpm lockfile parsing path traversal allows write outside node_modules and code execution via lifecycle scripts | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Nokogiri <1.19.3 ReDoS via adversarial CSS selectors causing exponential regex backtracking | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | torchvision GIF decoder OOB heap read (≤0.28.0) enables DoS/info leak | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Nokogiri <1.19.4 use-after-free replacing XML attribute value leads segfault | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Nokogiri <1.19.4 crash from NULL pointer deref in uninitialized XML::Node wrappers | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Nokogiri CRuby use-after-free vulnerability in Document#encoding= with invalid encoding (pre-1.19.4) | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Nokogiri <1.19.4 NodeSet#[] index check bug causes OOB read, CRuby crash; JRuby wrong node | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | pnpm vulnerable: committed lockfile bootstrap bypasses resolution, executes attacker-selected bytes during version switch | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | pnpm <10.34.2/11.5.3 runs repo-controlled pacquet from configDependencies during install (RCE risk) | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | pnpm pre-10.34.2/11.5.3 normalizer strips parentheses, enabling locator collisions and attacker-controlled source spoofing | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | glibc 2.2+ deprecated ns_printrrf/ns_printrr/fp_nquery ignore buffer length, TSIG out-of-bounds write | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Starlette pre-1.3.1 ignores form limits for urlencoded bodies, enabling unauthenticated resource exhaustion | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | python-multipart pre-0.0.30 DoS via quadratic parsing of semicolon-separated form bodies | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | pnpm --frozen-lockfile skips integrity verification if lockfile integrity missing pre-10.34.0/11.4.0 | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | AsyncSSH <2.23.0 %u expansion path traversal enables authentication via attacker-selected authorized_keys | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | twisted.names DoS via crafted TCP DNS compression chain hangs reactor | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | REXML gem before 3.3.9 vulnerable to ReDoS parsing hex char refs; affects Ruby 3.1 | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | REXML Ruby gem 3.3.2 DoS via XML entity expansion in SAX2/pull parsers | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | REXML <3.3.2 DoS vulnerabilities parsing XML with excessive whitespace, '>]' and ']>' | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Expat ≤2.8.3 DoS: quadratic complexity in storeAtts() attribute handling triggers CPU exhaustion | secure-packages-rolling | Oct 5, 2026 | |
| Fixed | PCRE2 <10.48 pcre2_jit_match mishandles copied subject context, causing incorrect free | secure-packages-rolling | Oct 5, 2026 | |
| Fixed | strongSwan 4.5.0–6.0.7: eap-ttls/peap incorrect access control via missing/mismatched inner EAP identity | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Use-after-free in libcharon IKEv2 rekeying collision handling (strongSwan 6.0.0–6.0.7) | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | strongSwan 4.2.0 through 6.0.7: NULL pointer dereference in x509 attribute certificate parser | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | dhcpcd ≤10.3.2 IPv6 RA route info memory leak enables unauthenticated same-link DoS crash | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Stack overflow in libsass 3.6.5-8-g210218 Sass::CompoundSelector::has_real_parent_ref causing DoS; affects sassc 3.6.2 | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Email change confirmation bug lets attackers hijack RubyGems.org accounts and publish/yank gems | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Zstandard <1.3.8 one-pass compression race condition allows out-of-bounds write with undersized output buffer | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | libplist plist_free_data crash via integer node misclassified as PLIST_KEY causing invalid free | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | libplist DoS via zero offset size causing large memory allocation and crash | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | ClamAV libclamav remote DoS via crafted document causing AMP restart on Cisco ESA/WSA | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Expat XML parser <=2.8.3 remote unauthenticated DoS via quadratic storeAtts() attribute processing | secure-packages-25.11 | Oct 3, 2026 | |
| Fixed | libxml2 <2.15.4 xmlSnprintfElements stack-based buffer overflow via strcat in valid.c | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | strongSwan 5.1.3–6.0.7: infinite loop in x509 attribute certificate parser (ietfAttrSyntax) | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | GNU Bison: %define tool.xsltproc allows arbitrary program execution during --html | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | cpio 2007.05.10 and 2010.07.28 allow remote arbitrary file overwrite via RPM package symlink | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | PCRE2 <10.48: pcre2_jit_match incorrectly frees copied subject from context | secure-packages-26.05 | Oct 2, 2026 | |
| Fixed | Unbound ≤1.26.0 heap buffer overflow in RRSet canonicalization via 255-byte qname TCP response | secure-packages-rolling | Oct 1, 2026 | |
| Fixed | PYSEC-2026-3926: Infinite loop vulnerability in Apache Thrift bindings prior to 0.24.0 (Python/Go/PHP/Java) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | PYSEC-2026-3925: Data amplification via compressed data in Apache Thrift Python bindings before 0.24.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | GHSA-8wv5-x4w7-5gww: Infinite loop vulnerability in Apache Thrift Python, Go, PHP, and Java bindings prior to 0.24.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | GHSA-6pjx-3pjc-mrj8: Data amplification vulnerability in Apache Thrift Python bindings prior to 0.24.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Unbounded resource allocation vulnerability in Apache Thrift Rust bindings before 0.24.0 | secure-packages-26.05 | Sep 30, 2026 |