← All tracked CVEs
Updated 07:01
Low severity
Low90d SLAWe fix a low vulnerability within 90 days of publication, under our service-level agreement (SLA). We track 128 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| In progress | GHSA-cq8v-f236-94qc: rand unsound: reentrant ThreadRng in custom logger triggers UB via aliased mutable borrow | secure-packages-26.05 | — | |
| In progress | GHSA-965h-392x-2mh5: Library ignores URI name constraints; restricted certificates accepted; exploit requires misissuance after signature verification. | secure-packages-25.11 | — | |
| In progress | GHSA-xgp8-3hg3-c2mh: Wildcard DNS SANs bypass permitted subtree NameConstraints in X.509 certificate validation | secure-packages-25.11 | — | |
| In progress | GHSA-mj6p-44ch-cq69: uutils mkdir -m sets mode via chmod after creation, briefly exposing umask perms to others | secure-packages-25.11 | — | |
| In progress | GHSA-965h-392x-2mh5: Library ignores URI name constraints; restricted certificates accepted; exploit requires misissuance after signature verification. | secure-packages-25.11 | — | |
| In progress | GHSA-w6xc-g9qj-vp32: safe_traversal Linux-only; macOS/FreeBSD directory traversal lacks fd-relative TOCTOU, vulnerable to symlink races | secure-packages-25.11 | — | |
| In progress | GHSA-xgp8-3hg3-c2mh: Wildcard DNS names bypass permitted subtree checks in X.509 name constraints | secure-packages-26.05 | — | |
| In progress | GHSA-2w8r-9xj7-69j5: uutils mktemp mishandles empty TMPDIR, uses CWD instead of /tmp, risking data exposure | secure-packages-25.11 | — | |
| In progress | GHSA-w6xc-g9qj-vp32: safe_traversal Linux-only; macOS/FreeBSD directory traversal lacks fd-relative TOCTOU, vulnerable to symlink races | secure-packages-25.11 | — | |
| In progress | GHSA-965h-392x-2mh5: URI name constraints ignored and accepted; bug reachable post-signature verification; needs misissuance | secure-packages-26.05 | — | |
| In progress | GHSA-8fgc-7cc6-rx7x: Webpack buildHttp allowedUris bypass via userinfo, enabling build-time SSRF and untrusted content inclusion | secure-packages-25.11 | — | |
| In progress | GHSA-965h-392x-2mh5: URI name constraints ignored and accepted; bug reachable post-signature verification; needs misissuance | secure-packages-26.05 | — | |
| In progress | GHSA-68rp-wp8r-4726: Flask omits Vary: Cookie on session membership checks, risking cached user-specific responses | secure-packages-26.05 | — | |
| In progress | GHSA-r374-rxx8-8654: Insecure SHA-1 allowed in Paramiko rsakey.py through 4.0.0 (pre-a448945) | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-2858: Paramiko rsakey.py allows weak SHA-1 algorithm through 4.0.0 before a448945 | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-2858: Paramiko up to 4.0.0: rsakey.py allows insecure SHA-1 (pre a448945) | secure-packages-25.11 | — | |
| In progress | GHSA-68rp-wp8r-4726: Flask omits Vary: Cookie on non-mutating session key checks (e.g., 'in'), risking proxy caching | secure-packages-25.11 | — | |
| In progress | GHSA-g8m3-5g58-fq7m: Undici misparses Set-Cookie SameSite via substring match, enabling silent policy downgrades since 5.15.0 | secure-packages-25.11 | — | |
| In progress | GHSA-r374-rxx8-8654: Paramiko <=4.0.0 rsakey.py permits insecure SHA-1 algorithm prior to commit a448945 | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-1796: pip wheel extraction path traversal allows files outside installation directory | secure-packages-26.05 | — | |
| In progress | GHSA-v9pg-7xvm-68hf: Negative Content-Length makes parse_form read until EOF, loading full body at once. | secure-packages-26.05 | — | |
| In progress | GHSA-p893-rvq9-2xf9: Heap-buffer-overflow in ONNX Gemm_7_6 version conversion with <2D inputs (B_shape[1]) | secure-packages-26.05 | — | |
| In progress | GHSA-wwv5-g3v4-889x: Capitalized kwargs bypass Tornado set_cookie validation, re-enabling Set-Cookie attribute injection | secure-packages-26.05 | — | |
| In progress | GHSA-6vgw-5pg2-w6jp: pip wheel extraction path traversal may write outside install dir; cannot typically overwrite executables | secure-packages-26.05 | — | |
| In progress | GHSA-8rfp-98v4-mmr6: Bleach.clean fails to strip Unicode-obfuscated javascript: href, violating URI scheme allowlist | secure-packages-26.05 | — | |
| In progress | GHSA-whvh-wf3x-g77j: JupyterLab PyPIExtensionManager.install() missing await bypasses allowlist/blocklist; security risk for integrators | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3587: onnx convert_version Gemm_7_6 heap-buffer-overflow on <2D input tensor shapes | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3040: parse_form accepts negative Content-Length, causing unbounded EOF read and whole body buffering | secure-packages-26.05 | — |