Skip to content
← All tracked CVEs

Updated 17:00

High severity

High15d SLA

We fix a high vulnerability within 15 days of publication, under our service-level agreement (SLA). We track 788 CVEs here: in progress, or fixed in the last 30 days.

Status
CVEStatusSummaryDistributionFixed
FixedInteger overflow/wraparound in Apache Thrift C++, c_glib, Go, netstd, Delphi, Haxe before 0.24.0secure-packages-26.05Sep 30, 2026
FixedInefficient complexity enables unbounded resource allocation in Apache Thrift Node.js before 0.24.0secure-packages-26.05Sep 30, 2026
FixedImproper handling of highly compressed data in Apache Thrift Ruby bindings before 0.24.0secure-packages-26.05Sep 30, 2026
FixedImproper handling of compressed data causes amplification in Apache Thrift versions prior to 0.24.0secure-packages-26.05Sep 30, 2026
FixedApache Thrift C++ improper TLS certificate host validation vulnerability before version 0.24.0secure-packages-26.05Sep 30, 2026
FixedResource allocation without limits/throttling in Apache Thrift Java bindings 0.19.0 to <0.24.0secure-packages-26.05Sep 30, 2026
FixedInfinite loop vulnerability in Apache Thrift Python, Go, PHP, Java bindings before 0.24.0secure-packages-26.05Sep 30, 2026
FixedApache Thrift pre-0.23.0 multiple vulns: origin validation, path traversal, HTTP splitting, DoSsecure-packages-26.05Sep 30, 2026
FixedApache Thrift <0.23.0: Improper TLS certificate host validation vulnerabilitysecure-packages-26.05Sep 30, 2026
FixedUncontrolled recursion vulnerability in Apache Thrift Node.js bindings before 0.23.0secure-packages-26.05Sep 30, 2026
FixedApache Thrift Python bindings vulnerable to data amplification via highly compressed data pre-0.24.0secure-packages-26.05Sep 30, 2026
FixedInteger overflow/wraparound vulnerability in Apache Thrift before 0.23.0secure-packages-26.05Sep 30, 2026
FixedOut-of-bounds read vulnerability in Apache Thrift versions prior to 0.23.0secure-packages-26.05Sep 30, 2026
FixedInteger overflow/wraparound vulnerability in Apache Thrift Go TFramedTransport before 0.23.0secure-packages-26.05Sep 30, 2026
FixedCrafted requests trigger free(): invalid pointer crash in Apache Thrift c_glib pre-0.23.0secure-packages-26.05Sep 30, 2026
FixedPYSEC-2026-68: Authenticated path traversal in Jupyter Server <=2.17.0 escapes root_dir to shared-prefix sibling directories via /api/contentssecure-packages-26.05Sep 30, 2026
FixedPYSEC-2026-2187: CORS origin validation bypass via allow_origin_pat re.match in Jupyter Server <=2.17.0secure-packages-26.05Sep 30, 2026
FixedGHSA-5mrq-x3x5-8v8f: Jupyter Server static cookie secret allows stolen sessions to persist despite password changessecure-packages-26.05Sep 30, 2026
FixedGHSA-5789-5fc7-67v3: Jupyter Server <=2.17.0 allows sibling directory access if names share root prefixsecure-packages-26.05Sep 30, 2026
FixedGHSA-24qx-w28j-9m6p: Jupyter Server <=2.17.0 Origin validation bug: re.match allows spoofed domains to passsecure-packages-26.05Sep 30, 2026
Fixedlibxml2 <2.15.4: xmlSnprintfElements strcat stack-based buffer overflow in valid.csecure-packages-26.05Sep 30, 2026
FixedUnbound ≤1.26.0 heap overflow in RRSet canonicalisation with 255-length query and large TCP responsesecure-packages-26.05Sep 30, 2026
FixedIncorrect access control in strongSwan eap-ttls/eap-peap due to missing or mismatched inner EAP identity (4.5.0–6.0.7)secure-packages-26.05Sep 30, 2026
Fixedlibcharon use-after-free in strongSwan 6.0.0–6.0.7 during IKEv2 rekeying collision handlingsecure-packages-26.05Sep 30, 2026
FixedstrongSwan 5.1.3–6.0.7: Infinite loop in x509 attribute certificate parser (ietfAttrSyntax)secure-packages-26.05Sep 30, 2026
FixedstrongSwan x509 plugin attribute certificate parser NULL pointer dereference (4.2.0–6.0.7)secure-packages-26.05Sep 30, 2026
FixedHeap buffer overflow in binutils XCOFF linker allows local RCE or DoSsecure-packages-26.05Sep 30, 2026
Fixedpyasn1 <0.6.4 REAL float conversion CPU/memory exhaustion via huge exponentsecure-packages-26.05Sep 30, 2026
Fixedpyasn1 <0.6.4 OID/RELATIVE-OID decode/encode quadratic complexity enables CPU DoS attackssecure-packages-26.05Sep 30, 2026
Fixedpyasn1 <0.6.4 BER/CER/DER unbounded long-form tag parsing DoS; Py3.11 ValueError crashsecure-packages-26.05Sep 30, 2026
FixedGNU Bison --html arbitrary command execution via %define tool.xsltproc; 3.8.2 vulnerablesecure-packages-26.05Sep 30, 2026
Fixeddhcpcd <=10.3.2 IPv6 RA Route Information memory leak allows DoS via crafted advertisementssecure-packages-26.05Sep 30, 2026
FixedOpenEXR 3.4.0–3.4.11 HTJ2K ht_undo_impl heap read overflow on mismatched line widthsecure-packages-26.05Sep 30, 2026
FixedInteger overflow in OpenEXR HTJ2K decode enables heap out-of-bounds write (3.4.0–3.4.11)secure-packages-26.05Sep 30, 2026
Fixedgiflib 5.2.2 EGifGCBToExtension buffer overflow enables remote DoS via unchecked GCE sizesecure-packages-26.05Sep 30, 2026
FixedStack overflow in libsass 3.6.5-8-g210218 ast_selectors.cpp has_real_parent_ref causes DoS; affects sassc 3.6.2secure-packages-26.05Sep 30, 2026
FixedRubyGems.org bug lets attackers change emails to unowned addresses, enabling account hijackingsecure-packages-26.05Sep 30, 2026
FixedZulip Server ≤5.4 privilege escalation lets members grant admin to their bots via APIsecure-packages-26.05Sep 30, 2026
FixedImproper access control vulnerability in zulip/zulip before 4.10secure-packages-26.05Sep 30, 2026
FixedZstandard <1.3.8 one-pass compression race allows OOB write with small output buffersecure-packages-26.05Sep 30, 2026
Fixedlibplist plist.c: plist_free_data invalid free when integer node treated as PLIST_KEY, causing DoSsecure-packages-26.05Sep 30, 2026
Fixedlibplist DoS via zero offset size causing large memory allocation and crashsecure-packages-26.05Sep 30, 2026
FixedDeactivated users could access messages in Zulip <1.3.12 with SSO enabledsecure-packages-26.05Sep 30, 2026
FixedRemote DoS in ClamAV libclamav on Cisco ESA/WSA via crafted document causes AMP restartsecure-packages-26.05Sep 30, 2026
Fixedcpio vulnerability allows remote arbitrary file overwrite via symlinks in RPM packages (2007.05.10, 2010.07.28, others)secure-packages-26.05Sep 30, 2026
FixedUnbound ≤1.26.0 RRSet canonicalization heap buffer overflow via 255-byte qname TCP responsesecure-packages-25.11Sep 30, 2026
FixedUse-after-free in Chrome PDFium (<153.0.8010.52) enables remote sandboxed RCE via crafted HTMLsecure-packages-rollingSep 22, 2026
FixedPDFium buffer overflow allows sandboxed code execution with crafted PDF in Chrome <153.0.8010.52 on Windowssecure-packages-rollingSep 22, 2026
FixedV8 type confusion in Chrome <153.0.8010.52 enables sandboxed RCE via crafted HTMLsecure-packages-rollingSep 22, 2026
FixedChrome Windows Tracing reference resolution flaw allows local RCE outside sandbox pre-153.0.8010.52secure-packages-rollingSep 22, 2026

Contact sales

Provide us with some basic details and we'll follow up with you about , usually within one business day.

We'll only use this to get back to you. See our privacy policy (opens in a new tab). This site is protected by reCAPTCHA and the Google Privacy Policy (opens in a new tab) and Terms of Service (opens in a new tab) apply.