← All tracked CVEs
Updated 17:00
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| In progress | Linux NTFS sync_fs clears dirty bit despite errors, marking volumes clean and skipping recovery | secure-packages-25.11 | — | |
| In progress | NTFS overcounts freed clusters after bitmap clear failures, corrupting statfs and allocator free-space gate | secure-packages-26.05 | — | |
| In progress | NTFS: Counting failed bitmap clears inflates free_clusters, corrupting statfs and allocation gating | secure-packages-25.11 | — | |
| In progress | nvmet-rdma leaks queue and IB resources when connection backlog limit is exceeded | secure-packages-25.11 | — | |
| In progress | nvmet-rdma leaks queue and IB resources when connect backlog is exceeded | secure-packages-26.05 | — | |
| In progress | rtl8723bs: HalData vzalloc buffer freed with kfree in rtw_sdio_if1_init error path causing memory corruption risk | secure-packages-25.11 | — | |
| In progress | Linux rtl8723bs: HalData vzalloc buffer freed with kfree in rtw_sdio_if1_init error path risking memory corruption | secure-packages-26.05 | — | |
| In progress | nvdimm pmem: data writes proceed after failed REQ_PREFLUSH; error overwritten by REQ_FUA | secure-packages-25.11 | — | |
| In progress | pmem_submit_bio allows writes after failed REQ_PREFLUSH, error masked by later REQ_FUA | secure-packages-26.05 | — | |
| In progress | Linux ksmbd: tree connection leak on ksmbd_iov_pin_rsp failure in smb2_tree_connect | secure-packages-25.11 | — | |
| In progress | smb2_tree_connect leaks tree connection when ksmbd_iov_pin_rsp fails; missing disconnect | secure-packages-26.05 | — | |
| In progress | ksmbd: tree connection leak when ksmbd_iov_pin_rsp fails in smb2_tree_connect | secure-packages-rolling | — | |
| In progress | PYSEC-2026-2109: AIOHTTP pre-3.14.1 DigestAuthMiddleware sends auth digest after cross-origin redirect | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-2323: Zeep <4.3.3 ignores forbid_external; SSRF via WSDL/XSD imports and DTDs | secure-packages-26.05 | — | |
| In progress | GHSA-9x8q-7h8h-wcw9: aiohttp payload resources leak when client disconnects mid-write, causing temporary resource starvation | secure-packages-26.05 | — | |
| In progress | GHSA-qwm4-qh6w-59xr: pip mishandles doubly-encoded package URLs, enabling arbitrary file writes via malicious indexes during wheel installs | secure-packages-rolling | — | |
| In progress | PYSEC-2026-3943: WebOb Location normalization allows off-host redirects via leading space/C0 control stripping mismatch | secure-packages-rolling | — | |
| In progress | GHSA-x33g-cr3x-6449: PyJWT accepts inconsistent OKP JWKs: mismatched x and d allow DPoP binding bypass | secure-packages-rolling | — | |
| In progress | PYSEC-2026-4141: PyJWT deeply nested payload triggers uncaught RecursionError pre-verification, causing request-level DoS | secure-packages-rolling | — | |
| In progress | PYSEC-2026-3721: pip arbitrary file write via doubly-encoded index URLs, affecting --only-binary wheel downloads | secure-packages-rolling | — | |
| In progress | GHSA-6hr6-w5qg-qmwg: h2 <=4.4.0 forwards multiple Host headers, enabling HTTP/1.1 downgrade request smuggling | secure-packages-rolling | — | |
| In progress | GHSA-9h9j-4vrj-gf7g: Newline injection via virtualenv prompt overrides pyvenv.cfg home and interpreter metadata | secure-packages-rolling | — | |
| In progress | GHSA-42vr-xj54-vc7v: Deeply nested JWT JSON payload triggers uncaught RecursionError pre-verification, causing DoS in PyJWT 2.x | secure-packages-rolling | — | |
| In progress | GHSA-3hv7-mjh2-fv65: HTTPServerRequest query parsing missing field-count limit; enables DoS via many query parameters. | secure-packages-rolling | — | |
| In progress | GHSA-6hx8-3wjj-gr8g: WebOb open redirect: leading whitespace/C0 controls bypass guards; urljoin strips, off-host redirects | secure-packages-rolling | — | |
| In progress | GHSA-8423-8fgw-73vq: parse_multipart_form_data splits before max_parts check, causing pre-auth memory amplification DoS | secure-packages-rolling | — | |
| In progress | PYSEC-2026-3628: h2 <=4.4.0 forwards multiple Host headers; HTTP/2 to HTTP/1.1 downgrade enables request smuggling | secure-packages-rolling | — | |
| In progress | GHSA-379c-qx7v-6h59: Path traversal in folder-based dataset builders via unvalidated file_name, allowing arbitrary file reads through v5.0.0 | secure-packages-rolling | — | |
| In progress | GHSA-hj66-6f7g-4r5v: oauthlib RevocationEndpoint JSONP callback unvalidated enables arbitrary JavaScript injection in responses | secure-packages-rolling | — | |
| In progress | GHSA-5639-2j2p-m4mx: Windows: Drive-letter URIs bypass Mako TemplateLookup directory traversal guard; arbitrary file read | secure-packages-rolling | — | |
| In progress | GHSA-4xgf-cpjx-pc3j: pydantic-settings NestedSecretsSettingsSource follows symlinks, allowing out-of-tree reads and size cap bypass | secure-packages-rolling | — | |
| In progress | GHSA-59cr-6r3x-644w: GitPython 3.1.61: Submodule.update() uses unchecked .gitmodules path, enabling repository escape | secure-packages-rolling | — | |
| In progress | GHSA-5xxx-qhh7-9287: GitPython Repo.blame option gap allows arbitrary local file read via --contents/-S | secure-packages-rolling | — | |
| In progress | PYSEC-2026-4113: oauthlib RevocationEndpoint JSONP reflects unsanitized callback, enabling arbitrary JavaScript injection | secure-packages-rolling | — | |
| In progress | GHSA-xpv3-w29h-x7cv: oauthlib PKCE timing side-channel: code_challenge_method_plain uses == for verifier comparison | secure-packages-rolling | — | |
| In progress | PYSEC-2026-3716: Arbitrary file read via path traversal in Datasets <=5.0.0 folder-based builders | secure-packages-rolling | — | |
| In progress | PYSEC-2026-3837: GitPython TagReference.create positional reference bypasses unsafe-option guard; arbitrary file read | secure-packages-rolling | — | |
| In progress | GHSA-3wxw-xv34-2frg: GitPython TagReference.create positional reference bypasses unsafe guard enabling arbitrary file read | secure-packages-rolling | — | |
| In progress | PYSEC-2026-4114: OAuthlib PKCE verifier comparison uses '==' causing timing side-channel in authorization code flow | secure-packages-rolling | — | |
| In progress | GHSA-54p9-h82j-f925: multidict 6.7–6.9 C items-view union/subtraction ref leak allows remote unreclaimable memory growth | secure-packages-rolling | — | |
| In progress | GHSA-q445-7m23-qrmw: MemBio::get_buf passed null pointer to slice::from_raw_parts, causing UB and debug assertions. | secure-packages-25.11 | — | |
| In progress | GHSA-p52g-cm5j-mjv4: OpenSSL RSA decryption timing leak enables remote Bleichenbacher attack recovering TLS pre-master secrets | secure-packages-25.11 | — | |
| In progress | RUSTSEC-2026-0045: Timing side-channel in AWS-LC EVP AES-CCM decryption leaks tag validity | secure-packages-26.05 | — | |
| In progress | GHSA-3v7f-55p6-f55p: picomatch POSIX_REGEX_SOURCE method injection allows malformed POSIX classes to alter glob matching | secure-packages-26.05 | — | |
| In progress | GHSA-434x-w66g-qw3r: Unchecked overflow in BytesMut::reserve corrupts capacity, causing OOB UB in release builds | secure-packages-26.05 | — | |
| In progress | GHSA-chgr-c6px-7xpp: PyCFunction::new_closure lacks Sync bound, enabling data races under free-threaded or concurrent Python execution | secure-packages-25.11 | — | |
| In progress | GHSA-2frx-2596-x5r6: gitoxide uses SHA-1 without collision detection, enabling collision attacks and breaking Git object integrity | secure-packages-25.11 | — | |
| In progress | GHSA-hhw4-xg65-fp2x: serde_yml::ser::Serializer.emitter unsound; can cause segfault; crate archived | secure-packages-25.11 | — | |
| In progress | RUSTSEC-2026-0067: tar-rs ≤0.4.44 unpack_dir symlink bug allows chmod of directories outside extraction root | secure-packages-26.05 | — | |
| In progress | GHSA-xx64-wwv2-hcqq: astral-tokio-tar <=0.6.0 unpack_in can change permissions of directories outside archive | secure-packages-26.05 | — |