← All tracked CVEs
Updated 07:01
Low severity
Low90d SLAWe fix a low vulnerability within 90 days of publication, under our service-level agreement (SLA). We track 128 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| Fixed | Android Chrome prior to 154.0.8037.57 GPU uninitialized resource leaks out-of-sandbox memory via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome pre-154.0.8037.57 GPU uninitialized resource lets compromised renderer read memory outside sandbox via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | MediaCapture improper authorization in Chrome <154.0.8037.57 allows extension-based cross-origin data access | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Performance unchecked return allows local memory read before 154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Passwords info leak pre-154.0.8037.57 allows cross-origin data exfiltration via crafted HTML under renderer compromise | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome pre-154.0.8037.57 Metrics integer overflow allows renderer-compromised read outside sandbox via HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Android Chrome WebAPK authorization bug lets co-installed apps read cross-origin data pre-154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 Core use-after-free lets compromised renderer read cross-origin data via HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 Google Lens auth missing lets renderer-compromised attacker steal cross-origin data via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Pre-154.0.8037.92 Chrome GPU uninitialized resource allows post-renderer-compromise sandbox memory read | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Uninitialized Chrome Media resource enables out-of-sandbox memory read via crafted HTML (Windows <154.0.8037.92) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Android GPU uninitialized resource permits out-of-sandbox memory read after renderer compromise via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Core UAF pre-155.0.8059.39 let compromised renderer read cross-origin data via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39: Google Lens missing authorization exposes cross-origin data via compromised renderer | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Graphviz before 2.2.1 vulnerable to local temp file symlink attack, arbitrary file overwrite | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Nokogiri JRuby pre-1.19.4 doesn't enforce NONET in Schema parsing, enabling SSRF/XXE. | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Python-Multipart <=0.0.29 uses ';' as field separator, enabling parameter smuggling | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | libcharon memory leak in IKE message parser affects strongSwan 4.1.2–6.0.7 | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | strongSwan 5.0.2–6.0.7 openssl plugin PKCS#7 enumeration memory leak | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | libxml2 <2.15.4: xmlregexp NULL dereference in xmlRegNewParserCtxt after strdup failure | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | libxml2 pre-2.15.4 out-of-bounds read in xmlregexp NXT macro via xmlFAParsePosCharGroup | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | strongSwan 4.2.0–6.0.7: Memory leak in x509 attribute certificate parser | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | Unbound 1.20–1.26 serve-expired double-decrements wait-limit, bypassing CVE-2024-33655; enables DoS | secure-packages-rolling | Oct 1, 2026 | |
| Fixed | libxml2 xmlregexp NULL pointer dereference in xmlRegNewParserCtxt after strdup failure (<2.15.4) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | libxml2 <2.15.4: xmlregexp NXT macro out-of-bounds read in xmlFAParsePosCharGroup | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Memory leak in strongSwan x509 attribute certificate parser (versions 4.2.0–6.0.7) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | strongSwan libcharon 4.1.2–6.0.7: memory leak in IKE message parser | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | strongSwan openssl plugin PKCS#7 certificate enumeration memory leak (5.0.2–6.0.7) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Unbound 1.20–1.26 serve-expired double-decrements wait-limit, letting attackers bypass DNSBomb countermeasures | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Zulip ≤6.1 invite flow allows setting streams without stream-add permission | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Unauthorized account creation via external backend with ZulipLDAPAuthBackend when invitations not required | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Unbound 1.20–1.26 serve-expired double-decrements per-client wait-limit, enabling DNSBomb protection bypass | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | ImageMagick pre-7.1.2-30/6.9.13-55 TOCTOU in video decoder bypasses path policy via symlink swaps | secure-packages-26.05 | Sep 23, 2026 | |
| Fixed | ImageMagick <7.1.2-30 Windows TOCTOU symlink race bypasses path policy read/write restrictions | secure-packages-26.05 | Sep 23, 2026 | |
| Fixed | SSRF in Chrome Android Omnibox pre-153.0.8010.52 allows bypassing system access restrictions via crafted traffic | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Chrome <153 FileSystem race lets compromised renderer bypass system access via crafted HTML | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Missing Storage authorization in Chrome pre-153 allows renderer-compromised site isolation bypass via PDF | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | SSRF in Chrome Android Omnibox before 153.0.8010.52 bypasses system access restrictions via crafted traffic | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Chrome <153.0.8010.52 FileSystem race enables privilege bypass via crafted HTML after renderer compromise | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Google Chrome <153.0.8010.52 Storage auth flaw allows compromised-renderer PDF to bypass site isolation | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | SSRF in Chrome Omnibox on Android <153.0.8010.52 enables access restriction bypass | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | Chrome <153.0.8010.52 FileSystem race allows system access bypass via crafted HTML page | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | Pre-153 Chrome Storage auth bug let compromised renderer bypass site isolation via crafted PDF | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | Skia use-after-free in Chrome <153.0.8010.47 enables cross-origin data exfiltration via crafted HTML | secure-packages-25.11 | Sep 18, 2026 | |
| Fixed | Incomplete GetUserMedia cleanup in Chrome <153.0.8010.47 leaks cross-origin data post-renderer compromise | secure-packages-25.11 | Sep 18, 2026 | |
| Fixed | Chrome pre-153.0.8010.47 network race lets compromised renderer exfiltrate cross-origin data via crafted HTML | secure-packages-25.11 | Sep 18, 2026 | |
| Fixed | Skia use-after-free in Chrome <153.0.8010.47 enables renderer-compromised cross-origin data exfiltration | secure-packages-rolling | Sep 18, 2026 | |
| Fixed | Chrome pre-153.0.8010.47 GetUserMedia cleanup bug enabled cross-origin data exfiltration via crafted HTML | secure-packages-rolling | Sep 18, 2026 | |
| Fixed | Google Chrome <153.0.8010.47 Network race enables cross-origin data leak via compromised renderer | secure-packages-rolling | Sep 18, 2026 | |
| Fixed | Skia use-after-free in Chrome <153.0.8010.47 enables compromised renderer cross-origin data exfiltration | secure-packages-26.05 | Sep 18, 2026 |