← All tracked CVEs
Updated 06:01
Low severity
Low90d SLAWe fix a low vulnerability within 90 days of publication, under our service-level agreement (SLA). We track 128 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| Fixed | GetUserMedia cleanup bug enables cross-origin data leak in Chrome before 153.0.8010.47 | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Chrome <153.0.8010.47 network race condition leaks cross-origin data from compromised renderer process | secure-packages-26.05 | Sep 18, 2026 | |
| In progress | Graphviz <2.2.1 vulnerable to local arbitrary file overwrite via temp-file symlink attack | secure-packages-rolling | — | |
| In progress | Zulip auth bypass: LDAP+external backends allow non-LDAP account creation when invites disabled | secure-packages-rolling | — | |
| In progress | yasm 1.3.0 memory leak in yasm_intnum_copy; vulnerability disputed per YASM policy | secure-packages-rolling | — | |
| In progress | yasm v1.3.0 memory leak via yasm_intnum_copy (libyasm/intnum.c); vulnerability disputed | secure-packages-26.05 | — | |
| In progress | Zulip 6.1 and below invite UI bypasses stream-adding permissions for invited users | secure-packages-rolling | — | |
| In progress | tarfile misinterprets GNU longname/longlink due to AREGTYPE-to-DIRTYPE normalization in multi-block entries | secure-packages-25.11 | — | |
| In progress | Animation timing side-channel in Chrome <155.0.8059.39 leaks cross-origin data | secure-packages-rolling | — | |
| In progress | Chrome Scroll bug pre-155.0.8059.39 leaks cross-origin data via crafted extension | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 Google Lens auth flaw allows renderer-compromised cross-origin data exfiltration | secure-packages-rolling | — | |
| In progress | Chrome Core use-after-free allows compromised renderer to read cross-origin data pre-155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Out-of-bounds read in Skia before Chrome 155.0.8059.39 enables memory disclosure via crafted file | secure-packages-rolling | — | |
| In progress | OpenSSH sshd before 10.6 interprets 'none' as filename instead of disabling options | secure-packages-26.05 | — | |
| In progress | OpenSSH sshd pre-10.6 misinterprets 'none' as filename instead of disabling feature | secure-packages-rolling | — | |
| In progress | pip extracts malicious wheels outside install directory via limited path traversal | secure-packages-26.05 | — | |
| In progress | GNU inetutils telnet through 2.7 leaks arbitrary client environment variables via NEW_ENVIRON SEND USERVAR | secure-packages-rolling | — | |
| In progress | GNU inetutils telnet through 2.7 leaks client environment variables via NEW_ENVIRON SEND USERVAR | secure-packages-26.05 | — | |
| In progress | OpenSSL QUIC server miscounts unvalidated bytes, violating 3x amplification limit; DDoS amplification risk | secure-packages-26.05 | — | |
| In progress | OpenSSL QUIC server overcounts datagram bytes per packet without validation, violating 3x amplification limit | secure-packages-rolling | — | |
| In progress | Paramiko <=4.0.0 pre-a448945 rsakey.py permits insecure SHA-1 algorithm | secure-packages-26.05 | — | |
| In progress | Paramiko ≤4.0.0 (pre-a448945) rsakey.py allows weak SHA-1 algorithm | secure-packages-25.11 | — | |
| In progress | GHSA-p688-r7jv-fm6f: Cargo sparse index URL normalization flaw may send credentials to attacker-controlled .git registry (CVE-2026-5222) | secure-packages-26.05 | — | |
| In progress | GHSA-p688-r7jv-fm6f: Cargo sparse index URL normalization flaw may send credentials to attacker-controlled .git registry (CVE-2026-5222) | secure-packages-26.05 | — | |
| In progress | GHSA-p688-r7jv-fm6f: Cargo sparse registry URL normalization leaks credentials to attacker-controlled .git registry (CVE-2026-5222) | secure-packages-25.11 | — | |
| In progress | python-multipart <0.0.31: negative Content-Length bypasses bounds; parse_form() reads entire body | secure-packages-26.05 | — | |
| In progress | ECDSA/SM2 scalar multiplication timing leak on generic curves enables nonce exposure, key recovery | secure-packages-26.05 | — | |
| In progress | Timing leak in generic ECC scalar multiplication exposes ECDSA/SM2 nonces, risking private key recovery | secure-packages-rolling | — | |
| In progress | OpenSSL: Non-constant-time SM2 scalar multiplication leaks timing/cache on ARM64 and RISC-V | secure-packages-26.05 | — | |
| In progress | Non-constant-time SM2 scalar multiplication leaks secrets on ARM64/RISC-V in OpenSSL | secure-packages-rolling | — | |
| In progress | JRuby Nokogiri XML::Schema ignores NONET, allows external fetches; SSRF/XXE before 1.19.4. | secure-packages-rolling | — | |
| In progress | libssh logic error: cert-based auth loop causes client DoS on missing/rejected certs | secure-packages-25.11 | — | |
| In progress | ONNX version_converter Gemm_7_6 OOB read with <2D inputs during opset 7→6 downgrade (<1.22.0) | secure-packages-26.05 | — | |
| In progress | SM2 signature generation timing leak from non-constant-time operations on secret nonce and private key | secure-packages-26.05 | — | |
| In progress | SM2 signature generation timing side-channel from non-constant-time secret nonce/private key operations | secure-packages-rolling | — | |
| In progress | ImageMagick <7.1.2-30 Windows TOCTOU path policy bypass via symlink race | secure-packages-25.11 | — | |
| In progress | ImageMagick video decoder TOCTOU allows path policy write bypass via symlink swaps | secure-packages-25.11 | — | |
| In progress | PCRE2 <10.48 out-of-bounds read in pcre2_match after JIT fallback with invalid UTF | secure-packages-rolling | — | |
| In progress | PCRE2 <10.48 pcre2_match out-of-bounds read after JIT fallback with invalid UTF input | secure-packages-26.05 | — | |
| In progress | PCRE2 < 10.48 out-of-bounds read in pcre2_match with PCRE2_MATCH_INVALID_UTF on invalid UTF subject | secure-packages-rolling | — | |
| In progress | PCRE2 <10.48 out-of-bounds read in pcre2_match with invalid UTF (PCRE2_MATCH_INVALID_UTF) | secure-packages-26.05 | — | |
| In progress | PCRE2 <10.48: pcre2_serialize_encode leaks two bytes to adversary in unsafe contexts | secure-packages-rolling | — | |
| In progress | PCRE2 <10.48: pcre2_serialize_encode leaks two bytes to adversary | secure-packages-26.05 | — | |
| In progress | GHSA-wwv5-g3v4-889x: Tornado set_cookie kwargs capitalization regression bypasses validation, enabling cookie attribute injection | secure-packages-rolling | — | |
| In progress | GHSA-g98v-hv3f-hcfr: Windows: atty may dereference unaligned pointer; crate unmaintained with stale fix PR | secure-packages-25.11 | — | |
| In progress | GHSA-mj6p-44ch-cq69: uutils mkdir -m sets mode via chmod after creation, briefly exposing umask perms to others | secure-packages-25.11 | — | |
| In progress | GHSA-2w8r-9xj7-69j5: uutils mktemp mishandles empty TMPDIR, uses CWD instead of /tmp, risking data exposure | secure-packages-25.11 | — | |
| In progress | GHSA-4q83-7cq4-p6wg: Tokio ReadHalf::unsplit violates Pin contract causing soundness bug under io-util with !Unpin | secure-packages-25.11 | — | |
| In progress | GHSA-xgp8-3hg3-c2mh: Wildcard DNS names bypass permitted subtree checks in X.509 name constraints | secure-packages-26.05 | — | |
| In progress | GHSA-8fgc-7cc6-rx7x: Webpack buildHttp allowedUris bypass via userinfo, enabling build-time SSRF and untrusted content inclusion | secure-packages-25.11 | — |