← All tracked CVEs
Updated 14:00
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| In progress | WebAudio uninitialized resource in Chrome before 155.0.8059.39 allows remote sandbox memory read | secure-packages-rolling | — | |
| In progress | Chrome DataTransfer missing authorization pre-155.0.8059.39 allows compromised renderer to access sensitive data | secure-packages-rolling | — | |
| In progress | Chrome USB authorization bug pre-155.0.8059.39 lets crafted extension bypass system access via social engineering | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 SanitizerAPI bug leaks data via remote crafted HTML | secure-packages-rolling | — | |
| In progress | Incorrect WebShare authorization lets compromised renderer spoof UI in Chrome Android <155.0.8059.39 | secure-packages-rolling | — | |
| In progress | WebAudio info leak enabled cross-origin data exfiltration in Chrome <155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 Glic cleanup flaw leaks cross-origin data via social-engineered HTML | secure-packages-rolling | — | |
| In progress | Dawn uninitialized resource in Chrome Android <155.0.8059.39 enables remote sandbox memory read | secure-packages-rolling | — | |
| In progress | iOS Chrome <155.0.8059.39 authorization flaw allows social-engineered HTML bypass of system access restrictions | secure-packages-rolling | — | |
| In progress | Google Chrome Media authorization flaw pre-155.0.8059.39 enables cross-origin data leak via crafted HTML page | secure-packages-rolling | — | |
| In progress | Chrome Android Messages clickjacking enabled remote UI spoofing via crafted HTML pre-155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Chrome Extensions incorrect authorization enables UI spoofing via crafted extension (pre-155.0.8059.39) | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 FontAccess authorization flaw lets compromised renderer bypass system restrictions | secure-packages-rolling | — | |
| In progress | Android Chrome <155.0.8059.39: CustomTabs race enables local co-installed app to bypass web origin policy | secure-packages-rolling | — | |
| In progress | Chrome iOS <155.0.8059.39 missing authorization enables UI spoofing via crafted HTML page | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 GetUserMedia auth bug lets compromised renderer bypass system restrictions via crafted HTML | secure-packages-rolling | — | |
| In progress | iOS Chrome <155.0.8059.39 protection failure enables web origin policy bypass via crafted HTML | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 Permissions auth flaw enables UI spoofing via compromised renderer | secure-packages-rolling | — | |
| In progress | Race condition in Chrome before 155.0.8059.39 allows renderer-based UI spoofing | secure-packages-rolling | — | |
| In progress | Remote sensitive info leak in Chrome Enterprise via crafted HTML before 155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Google Chrome Extensions pre-155.0.8059.39 code injection allows remote UI spoofing via malicious extension | secure-packages-rolling | — | |
| In progress | Google Chrome Windows <155.0.8059.39 API miscalc enables extension UI spoofing via social engineering | secure-packages-rolling | — | |
| In progress | Incorrect API authorization in Chrome <155.0.8059.39 enables web origin policy bypass via crafted HTML | secure-packages-rolling | — | |
| In progress | Chrome Audio info leak before 155.0.8059.39: compromised renderer reads memory outside sandbox via crafted extension | secure-packages-rolling | — | |
| In progress | Confused deputy in iOS Chrome enables privileged page access via crafted HTML pre-155.0.8059.39 | secure-packages-rolling | — | |
| In progress | pip mishandles doubly-encoded index URLs, enabling arbitrary file writes during wheel installs | secure-packages-rolling | — | |
| In progress | pip --only-binary vulnerable to doubly-encoded URLs causing arbitrary file writes via malicious indexes | secure-packages-26.05 | — | |
| In progress | libssh SFTP directory listing stack buffer overflow via attacker-controlled longname causing crash/RCE | secure-packages-25.11 | — | |
| In progress | Werkzeug safe_join vulnerability allowing Windows device names with extensions or trailing spaces pre-3.1.5 | secure-packages-25.11 | — | |
| In progress | TOCTOU in virtualenv <20.36.1 enables symlink attacks on app_data/lockfile directory creation | secure-packages-25.11 | — | |
| In progress | wheel unpack trusts header filename for chmod, enabling critical file permission tampering, privilege escalation (0.40.0–0.46.1) | secure-packages-26.05 | — | |
| In progress | Werkzeug <=3.1.5 safe_join accepts Windows device names, causing send_from_directory read hang | secure-packages-25.11 | — | |
| In progress | Flask <=3.1.2: session 'in' checks miss Vary: Cookie, exposing cached responses | secure-packages-25.11 | — | |
| In progress | Flask ≤3.1.2 fails Vary: Cookie on session key-only access, risking sensitive caching | secure-packages-26.05 | — | |
| In progress | pip misidentifies dual tar/ZIP archives as ZIP, leading to confusing or incorrect installations | secure-packages-26.05 | — | |
| In progress | OpenSSL CRL Distribution Points caching causes excessive heap growth from crafted certificates, DoS risk | secure-packages-rolling | — | |
| In progress | Crafted certificate causes OpenSSL heap growth via X.509 CRL distribution points caching | secure-packages-26.05 | — | |
| In progress | Uncontrolled recursion vulnerability in Apache Thrift versions prior to 0.23.0 | secure-packages-rolling | — | |
| In progress | Out-of-bounds read vulnerability in Apache Thrift before 0.23.0 | secure-packages-rolling | — | |
| In progress | OpenSSL QUIC stream reassembly O(n^2) under out-of-order packets enables CPU DoS | secure-packages-26.05 | — | |
| In progress | OpenSSL QUIC out-of-order stream reassembly has quadratic complexity, enabling low-bandwidth CPU DoS | secure-packages-rolling | — | |
| In progress | Memory allocation excessive size vulnerability in Apache Thrift before 0.23.0 | secure-packages-rolling | — | |
| In progress | ONNX convert_version null pointer DoS on zero-input Upsample node before 1.22.0 | secure-packages-rolling | — | |
| In progress | Null pointer dereference DoS in ONNX convert_version handling zero-input Upsample node | secure-packages-26.05 | — | |
| In progress | WebOb <1.8.10 open redirect via Location normalization; control chars bypass CVE-2024-42353 | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4140: CVE-2026-48524: PyJWT PyJWKClient unknown kid triggers unbounded JWKS fetches (DoS) | secure-packages-26.05 | — | |
| In progress | oauthlib RevocationEndpoint reflects unvalidated JSONP callback, enabling arbitrary JavaScript injection | secure-packages-rolling | — | |
| In progress | Unvalidated JSONP callback in RevocationEndpoint enables attacker-controlled JavaScript response injection | secure-packages-26.05 | — | |
| In progress | Timing side-channel in oauthlib PKCE code_challenge verification using '==' comparison | secure-packages-rolling | — | |
| In progress | PKCE timing side-channel (CWE-208) in oauthlib authorization_code via non-constant-time compare | secure-packages-26.05 | — |