← All tracked CVEs
Updated 15:01
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| In progress | GHSA-jq42-7mfv-hm57: Cargo tarball symlink extraction allows overwriting other crates' cache from same registry (CVE-2026-5223) | secure-packages-26.05 | — | |
| In progress | GHSA-jq42-7mfv-hm57: Cargo tarball symlink extraction allows overwriting other crates' cache from same registry (CVE-2026-5223) | secure-packages-26.05 | — | |
| In progress | AIOHTTP DigestAuthMiddleware leaks auth digest on cross-origin redirects prior to 3.14.1 | secure-packages-26.05 | — | |
| In progress | Open redirect in WebOb <1.8.11 via urljoin stripping leading spaces and control chars | secure-packages-rolling | — | |
| In progress | WebOb <1.8.11 open redirect via Location/relative URL whitespace normalization bypass | secure-packages-26.05 | — | |
| In progress | Buffer over-read vulnerability in Apache Thrift C++ bindings prior to 0.24.0 | secure-packages-rolling | — | |
| In progress | GNU coreutils uniq out-of-bounds read with -w multibyte input causing crash and heap exposure | secure-packages-25.11 | — | |
| In progress | Nokogiri <1.19.4: DTD allowed as root causing heap use-after-free/segfault | secure-packages-rolling | — | |
| In progress | Nokogiri pre-1.19.4 XPathContext doesn't retain document; GC can cause segfault on evaluation | secure-packages-rolling | — | |
| In progress | Nokogiri <1.19.4: XInclude do_xinclude frees nodes, causing Ruby object use-after-free | secure-packages-rolling | — | |
| In progress | nghttpx <=1.69.0 forwards ambiguous Upgrade+Content-Length on keep-alive, enabling smuggling and queue poisoning. | secure-packages-26.05 | — | |
| In progress | pydantic-settings symlink traversal with secrets_nested_subdir reads outside secrets_dir, bypasses secrets_dir_max_size (2.12.0–2.14.2) | secure-packages-rolling | — | |
| In progress | pydantic-settings 2.12.0–2.14.2 symlink traversal with secrets_nested_subdir=True reads outside secrets_dir, bypasses secrets_dir_max_size | secure-packages-26.05 | — | |
| In progress | Zeep <4.3.3 ignores forbid_external, allowing SSRF via WSDL/XSD imports and XML entities | secure-packages-26.05 | — | |
| In progress | libssh OpenSSL backend AES-GCM finalization bug allows undetected MITM plaintext modification | secure-packages-25.11 | — | |
| In progress | AIOHTTP <3.14.2 WebSocket decompresses RSV1 without permessage-deflate, enabling malicious server CPU/memory consumption | secure-packages-26.05 | — | |
| In progress | setuptools <83.0.0: FileList ignores Unicode normalization; macOS NFD files bypass MANIFEST.in excludes | secure-packages-26.05 | — | |
| In progress | sqlparse <0.6.0 improper backslash escaping enables code injection in Python/PHP outputs | secure-packages-rolling | — | |
| In progress | hpack pre-4.2.0: malformed input triggers quadratic-time varint decoding, causing denial-of-service | secure-packages-26.05 | — | |
| In progress | glibc 2.0.1–2.43 ns_printrr/ns_printrrf/fp_nquery mishandle A6/CERT/LOC/TKEY/TSIG RDATA; crash/uninitialized read | secure-packages-26.05 | — | |
| In progress | secure-packages-rolling | — | ||
| In progress | AsyncSSH zero send_pktsize triggers infinite send loop, freezing all connections pre-2.24.0 | secure-packages-26.05 | — | |
| In progress | pip <26.1 self-update runs post-wheel install, importing newly installed modules. | secure-packages-26.05 | — | |
| In progress | Linux kernel ethtool RSS: indir_table and hkey memory leak on get_rxfh failure | secure-packages-25.11 | — | |
| In progress | cachefiles returns NULL on vfs_mkdir() failure due to missing error code extraction | secure-packages-rolling | — | |
| In progress | cachefiles: Improper error extraction on vfs_mkdir() failure returns NULL instead of error pointer | secure-packages-26.05 | — | |
| In progress | netfilter x_tables race: table visible with NULL ops; nf_unregister_net_hooks NULL deref | secure-packages-26.05 | — | |
| In progress | Concurrent pernet exit sees NULL ops in x_tables table, causing nf_unregister_net_hooks crash | secure-packages-rolling | — | |
| In progress | mt76 mt7921/mt7925 CSA beacon NULL dereference when new_ctx cleared after disconnect | secure-packages-rolling | — | |
| In progress | mt76 mt7921/mt7925 NULL dereference in CSA beacon handling when new_ctx cleared after disconnect | secure-packages-26.05 | — | |
| In progress | AnyIO pre-4.14.2: undrained worker stderr pipe blocks process-pool call on large output | secure-packages-26.05 | — | |
| In progress | Hugging Face Datasets ≤5.0.0 path traversal via file_name allows arbitrary file exposure | secure-packages-rolling | — | |
| In progress | Directory traversal in folder-based dataset builders via file_name leaks local files on save/push | secure-packages-26.05 | — | |
| In progress | Apache Thrift Python bindings: improper TLS certificate host mismatch validation vulnerability before 0.24.0 | secure-packages-rolling | — | |
| In progress | AIOHTTP pre-3.14.2 WebSocket upgrade request smuggling from premature protocol switch with body | secure-packages-26.05 | — | |
| In progress | cryptography 45–48: wildcard SAN bypasses DNS name constraints; invalid certificates accepted | secure-packages-26.05 | — | |
| In progress | FFmpeg 3.0–<9.0 RSCC decoder uninitialized heap read leaks memory on undersized tile decompression | secure-packages-rolling | — | |
| In progress | Uninitialized heap read in FFmpeg Screenpresso decoder leaks memory via incomplete zlib output (3.0–<9.0) | secure-packages-rolling | — | |
| In progress | FFmpeg <9.0 TIFF decoder uninitialized heap memory disclosure via tiff_unpack_zlib memcpy | secure-packages-rolling | — | |
| In progress | h2 <=4.4.0 forwards duplicate Host headers, enabling HTTP/1.1 downgrade request smuggling | secure-packages-rolling | — | |
| In progress | Duplicate Host headers in h2 up to 4.4.0 enable HTTP/1.1 request smuggling | secure-packages-26.05 | — | |
| In progress | JupyterLab PyPI extension manager blocklist bypass via weak package-name normalization (4.5.0–4.6.1) | secure-packages-26.05 | — | |
| In progress | Heap OOB read/write and leak via FUJIFILM strd underflow in GStreamer avidemux | secure-packages-25.11 | — | |
| In progress | OpenSSL QUIC ignores connection-level flow control; remote peers can force ~100MB memory per connection | secure-packages-26.05 | — | |
| In progress | OpenSSL QUIC lacks connection flow control, allowing 100MB per-connection memory exhaustion via streams | secure-packages-rolling | — | |
| In progress | OpenSSL CMP client NULL dereference on crafted revocation response with PKCS#10 CSR, DoS | secure-packages-26.05 | — | |
| In progress | OpenSSL CMP client NULL pointer dereference on PKCS#10 CSR revocation response causes DoS | secure-packages-rolling | — | |
| In progress | DTLS 1.2 AEAD improper length validation allows unauthenticated DoS via short record | secure-packages-rolling | — | |
| In progress | DTLS 1.2 AEAD short record causes unauthenticated DoS due to length validation bug | secure-packages-26.05 | — | |
| In progress | Nokogiri <1.19.3 XSLT Stylesheet transform null-byte parameter memory leak enables DoS | secure-packages-rolling | — |