← All tracked CVEs
Updated 16:00
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| In progress | Nokogiri <1.19.1 canonicalize ignores xmlC14NExecute failures, enabling SAML signature bypass | secure-packages-rolling | — | |
| In progress | sqlparse <0.6.0 reindent quadratic CPU on attacker-controlled tuple lists (DoS risk) | secure-packages-rolling | — | |
| In progress | pypdf pre-6.16.0 infinite loop via cyclic /Next links in TreeObject.insert_child | secure-packages-26.05 | — | |
| In progress | pypdf <6.16.1: _get_outline lacks global limits, enabling DoS via outline traversal | secure-packages-26.05 | — | |
| In progress | pypdf <6.16.1 DoS via exponential DAG of reused form XObjects in text extraction | secure-packages-26.05 | — | |
| In progress | Soup Sieve <2.9 RE_WS_END trimming causes quadratic CPU on attacker-controlled selectors (DoS) | secure-packages-rolling | — | |
| In progress | Soup Sieve <2.9 ReDoS: crafted selectors cause quadratic regex backtracking and CPU exhaustion | secure-packages-rolling | — | |
| In progress | pip treats console_scripts/gui_scripts as paths, installing entry points outside the installation directory | secure-packages-26.05 | — | |
| In progress | PCRE2 <10.48 32-bit: pcre2_pattern_convert out-of-bounds write with large attacker-supplied pattern | secure-packages-rolling | — | |
| In progress | PCRE2 <10.48 on 32-bit: pcre2_pattern_convert out-of-bounds write with attacker-supplied pattern | secure-packages-26.05 | — | |
| In progress | PCRE2 <10.48 on 32-bit: pcre2_compile_32 integer overflow causing OOB write | secure-packages-rolling | — | |
| In progress | PCRE2 <10.48 on 32-bit: pcre2_compile_32 integer overflow causes out-of-bounds write | secure-packages-26.05 | — | |
| In progress | MongoDB Python CSFLE treats '.sock' endpoint as Unix socket, enabling local connections via key metadata | secure-packages-rolling | — | |
| In progress | MongoDB Python Driver CSFLE '.sock' key endpoint triggers unintended local Unix socket connections | secure-packages-26.05 | — | |
| In progress | urllib3 2.6.2–2.8.0: infinite loop on chunked deflate stream with trailing bytes, high CPU, hangs requests | secure-packages-26.05 | — | |
| In progress | urllib3 <2.8.0: stream/read_chunked infinite loop on chunked deflate with trailing bytes, CPU spin | secure-packages-25.11 | — | |
| In progress | is_cmpxchg_insn ignores BPF_PROBE_ATOMIC, skipping zero-extension for arena 32-bit cmpxchg | secure-packages-rolling | — | |
| In progress | BPF arena 32-bit cmpxchg misses zero-extension; is_cmpxchg_insn ignores BPF_PROBE_ATOMIC | secure-packages-26.05 | — | |
| In progress | Missing zero-extension for arena 32-bit cmpxchg when rewritten to BPF_PROBE_ATOMIC | secure-packages-25.11 | — | |
| In progress | bcmasp tx_spb_ring_full() reinitializes index, checks same slot repeatedly, failing consecutive slots check | secure-packages-26.05 | — | |
| In progress | Linux bcmasp tx_spb_ring_full() reinitializes next_index, checks same descriptor slot repeatedly | secure-packages-25.11 | — | |
| In progress | ASoC Intel AVS out-of-bounds access from config_ids indexing init_configs array | secure-packages-26.05 | — | |
| In progress | Out-of-bounds access in ASoC Intel avs init_configs due to mismatched config_ids indexing | secure-packages-25.11 | — | |
| In progress | Linux kernel Intel ASoC avs module refcount leak when strace_open fails after try_module_get | secure-packages-26.05 | — | |
| In progress | Unbalanced module refcount on strace_open() failure in ASoC Intel AVS driver | secure-packages-25.11 | — | |
| In progress | BPF tp_btf trusts siginfo pointer in signal tracepoints; 0/1 cause kernel panic | secure-packages-25.11 | — | |
| In progress | Linux BPF tp_btf signal tracepoints allow dereferencing 0/1 siginfo values, causing kernel panic | secure-packages-26.05 | — | |
| In progress | Linux IPVS sync reverses hton_seq args, leaving unwritten bytes, leaking heap, corrupting sequence | secure-packages-26.05 | — | |
| In progress | ipvs: reversed hton_seq parameters leak stale heap data, corrupt connection sequence state | secure-packages-25.11 | — | |
| In progress | Btrfs qgroup snapshot accounting triggers relocation backref corruption, kernel warning, read-only remount | secure-packages-26.05 | — | |
| In progress | Btrfs qgroup_account_snapshot forces reloc root, causing metadata extent backref corruption and RO filesystem | secure-packages-25.11 | — | |
| In progress | Btrfs bioc_list memory leak on error/IOERR in ordered extents | secure-packages-26.05 | — | |
| In progress | btrfs bioc_list memory leak when btrfs_insert_raid_extent errors or ordered extent IOERR | secure-packages-25.11 | — | |
| In progress | Bluetooth hci_core race: power_on runs before MSFT init, locking uninitialized mutex during device registration | secure-packages-25.11 | — | |
| In progress | Bluetooth hci_core race: power_on runs before MSFT init, locking uninitialized mutex | secure-packages-26.05 | — | |
| In progress | stmmac TSO transmit path leaks DMA mappings on skb fragment mapping failure | secure-packages-rolling | — | |
| In progress | stmmac_tso_xmit fails to unmap previous DMA mappings on fragment map failure | secure-packages-26.05 | — | |
| In progress | stmmac TSO transmit path leaks DMA mappings when skb fragment DMA mapping fails | secure-packages-25.11 | — | |
| In progress | BPF verifier downgrades half-dead scalar zero spills to STACK_ZERO, breaking precision propagation | secure-packages-26.05 | — | |
| In progress | eBPF verifier downgrades partial zero spill to STACK_ZERO, breaking precision propagation | secure-packages-25.11 | — | |
| In progress | ntfs_set_ea error path clears HasEA, hiding existing EAs until inode eviction | secure-packages-26.05 | — | |
| In progress | Linux NTFS setxattr failure clears HasEA, hiding on-disk EAs until inode eviction | secure-packages-25.11 | — | |
| In progress | BPF verifier misinfers non-null pointers in comparisons, leading null dereference vulnerability | secure-packages-rolling | — | |
| In progress | Linux BPF verifier misinfers non-null in pointer comparisons, allowing null dereference | secure-packages-26.05 | — | |
| In progress | BPF verifier misinterprets PTR_MAYBE_NULL, causing null pointer dereference after pointer comparison | secure-packages-25.11 | — | |
| In progress | NTFS accepts non-power-of-two sectors_per_cluster, leading to undefined shift (UBSAN) | secure-packages-26.05 | — | |
| In progress | NTFS boot sector validation allows zero/non-power-of-two sectors_per_cluster, causing undefined shift | secure-packages-25.11 | — | |
| In progress | Linux kernel NTFS fallocate ignored zeroout failures, exposing stale data | secure-packages-26.05 | — | |
| In progress | Linux NTFS: nonzero dio zero-range return ignored, fallocate may expose stale on-disk data | secure-packages-25.11 | — | |
| In progress | NTFS sync_fs clears dirty bit despite errors, marking volumes clean and bypassing recovery | secure-packages-26.05 | — |