← All tracked CVEs
Updated 18:00
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| In progress | GHSA-7gcf-g7xr-8hxj: serde_with KeyValueMap serializer panics on empty entry due to len-1 preallocation | secure-packages-26.05 | — | |
| In progress | GHSA-3cv2-h65g-fgmm: astral-tokio-tar pre-0.6.2 misapplies PAX headers, desynchronizing streams and enabling smuggled files | secure-packages-26.05 | — | |
| In progress | GHSA-qx2v-qp2m-jg93: PostCSS v8.5.5 doesn't escape </style> when stringifying, enabling XSS in <style> tags | secure-packages-26.05 | — | |
| In progress | GHSA-mh29-5h37-fv8m: Prototype pollution in js-yaml <4.1.1/3.14.2 when parsing untrusted YAML | secure-packages-26.05 | — | |
| In progress | GHSA-w9m9-85wc-3x92: Uncontrolled recursion in postcss-selector-parser AST toString leads remote DoS (pre-6.1.3/7.1.1) | secure-packages-26.05 | — | |
| In progress | GHSA-2vh6-hw4j-32ww: gix-packetline panics on empty side-band payload enabling pre-auth remote DoS | secure-packages-26.05 | — | |
| In progress | GHSA-4gg8-gxpx-9rph: uv <0.11.15 writes entry point executables outside env, enabling PATH hijack and code execution | secure-packages-25.11 | — | |
| In progress | GHSA-6gx3-4362-rf54: Malformed PAX extensions skipped in astral-tokio-tar <=0.5.6, enabling parser differential attacks | secure-packages-26.05 | — | |
| In progress | RUSTSEC-2026-0067: tar-rs <=0.4.44 unpack_dir symlink bug allows chmod outside extraction root | secure-packages-25.11 | — | |
| In progress | GHSA-p52g-cm5j-mjv4: OpenSSL RSA decryption timing leak enables remote Bleichenbacher attack recovering TLS pre-master secrets | secure-packages-25.11 | — | |
| In progress | GHSA-h395-gr6q-cpjc: jsonwebtoken 10.2.0: FailedToParse treated as NotPresent lets string nbf/exp bypass validation | secure-packages-26.05 | — | |
| In progress | GHSA-qj8w-gfj5-8c6v: serialize-javascript DoS: CPU exhaustion when serializing crafted array-like object with huge length | secure-packages-26.05 | — | |
| In progress | GHSA-9857-6mw7-fq2m: gitoxide gix-transport curl backend leaks credentials after redirect due to original-URL auth check | secure-packages-26.05 | — | |
| In progress | GHSA-7rrj-xr53-82p7: pipe_mode call resets reject_remote_clients in Tokio Windows named pipes, allowing remote clients | secure-packages-25.11 | — | |
| In progress | GHSA-6gx3-4362-rf54: astral-tokio-tar <=0.5.6 silently skips malformed PAX extensions, enabling parser differentials | secure-packages-25.11 | — | |
| In progress | GHSA-rr8g-9fpq-6wmg: Broadcast channel clones with only Send bound, causing unsoundness for Send + !Sync Clone types | secure-packages-26.05 | — | |
| In progress | GHSA-chgr-c6px-7xpp: PyCFunction::new_closure lacks Sync bound, enabling data races under free-threaded or concurrent Python execution | secure-packages-25.11 | — | |
| In progress | GHSA-mh29-5h37-fv8m: Prototype pollution in js-yaml parsing via __proto__ on untrusted input (pre-4.1.1/3.14.2) | secure-packages-25.11 | — | |
| In progress | GHSA-6gx3-4362-rf54: astral-tokio-tar <=0.5.6 silently skips malformed PAX extensions, enabling parser differentials | secure-packages-25.11 | — | |
| In progress | GHSA-chgr-c6px-7xpp: PyCFunction::new_closure lacks Sync bound, enabling data races under free-threaded or concurrent Python execution | secure-packages-25.11 | — | |
| In progress | GHSA-2frx-2596-x5r6: gitoxide uses SHA-1 without collision detection, enabling collision attacks and breaking Git object integrity | secure-packages-25.11 | — | |
| In progress | GHSA-qj8w-gfj5-8c6v: serialize-javascript DoS: CPU exhaustion when serializing crafted array-like object with huge length | secure-packages-26.05 | — | |
| In progress | RUSTSEC-2026-0067: tar-rs ≤0.4.44 unpack_dir symlink bug allows chmod of directories outside extraction root | secure-packages-26.05 | — | |
| In progress | GHSA-4gg8-gxpx-9rph: uv <0.11.15 writes entry point executables outside env, enabling PATH hijack and code execution | secure-packages-25.11 | — | |
| In progress | GHSA-434x-w66g-qw3r: Unchecked overflow in BytesMut::reserve corrupts capacity, causing OOB UB in release builds | secure-packages-26.05 | — | |
| In progress | GHSA-3pv8-6f4r-ffg2: tar-rs applies PAX headers to non-file entries, causing desync and extraction mismatches | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-2151: Flask <=3.1.2 lacks Vary: Cookie on certain session access, risking cached sensitive data | secure-packages-26.05 | — | |
| In progress | GHSA-6w46-j5rx-g56g: Pytest ≤9.0.2 UNIX predictable /tmp/pytest-of-{user} dirs enable local DoS/privilege escalation | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-1845: UNIX pytest <=9.0.2 insecure /tmp/pytest-of-{user} temp directory enables local DoS/privilege escalation | secure-packages-26.05 | — | |
| In progress | GHSA-6w46-j5rx-g56g: UNIX predictable /tmp/pytest-of-{user} in pytest <=9.0.2 allows DoS or privilege escalation | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-1845: pytest ≤9.0.2 on UNIX uses predictable '/tmp/pytest-of-{user}', enabling local DoS/privilege escalation | secure-packages-25.11 | — | |
| In progress | GHSA-597g-3phw-6986: virtualenv TOCTOU allows symlink attacks on app_data and lock directories up to 20.36.1 | secure-packages-25.11 | — | |
| In progress | GHSA-5239-wwwm-4pmq: Pygments <2.20 AdlLexer ReDoS in lexers/archetype.py; public exploit; local-only | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-2009: virtualenv <=20.36.1 TOCTOU enables symlink attacks on app_data and lockfile paths | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-2044: Werkzeug safe_join permits Windows device names with extensions/spaces, causing send_from_directory hangs | secure-packages-25.11 | — | |
| In progress | GHSA-29vq-49wr-vm6x: Werkzeug safe_join accepts Windows device names in subpaths, causing send_from_directory hang. | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-2320: Werkzeug <=3.1.5 safe_join allows Windows device names via segmented paths; send_from_directory hangs | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-2151: Flask <=3.1.2 omits Vary: Cookie on 'in' session checks, enabling sensitive caching | secure-packages-25.11 | — | |
| In progress | GHSA-87hc-h4r5-73f7: Werkzeug safe_join allows Windows device names with compound extensions/trailing spaces, causing send_from_directory hang | secure-packages-25.11 | — | |
| In progress | GHSA-vmf3-w455-68vh: node-tar misapplies PAX size to metadata headers, desyncing parse and hiding files | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-2987: Pygments <2.20.0 AdlLexer ReDoS from inefficient regex; local, public exploit available | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-1845: pytest ≤9.0.2 UNIX uses /tmp/pytest-of-{user} dirs enabling local DoS/privilege escalation | secure-packages-rolling | — | |
| In progress | GHSA-6w46-j5rx-g56g: UNIX pytest through 9.0.2 predictable /tmp/pytest-of-{user} dirs allow DoS/privilege escalation | secure-packages-rolling | — | |
| In progress | GHSA-j934-xhv5-fg8f: Unanchored RE_WS_END search causes quadratic-time slowdown on long selector whitespace/comments | secure-packages-rolling | — | |
| In progress | GHSA-gjv8-xp57-g29c: CSS selector ReDoS in soupsieve: overlapping quantifiers in IDENTIFIER cause quadratic backtracking | secure-packages-rolling | — | |
| In progress | GHSA-rw4j-r22c-9gc3: AsyncSSH client/server hangs when peer sets channel maximum packet size 0, blocking event loop | secure-packages-26.05 | — | |
| In progress | GHSA-g6x2-hccm-hh4m: Werkzeug safe_join allows Windows device names with empty ADS, causing send_from_directory hang on NTFS | secure-packages-25.11 | — | |
| In progress | GHSA-qx36-8mw2-4r3x: Key vault .sock KMS endpoint causes PyMongo to connect to attacker-chosen Unix socket | secure-packages-rolling | — | |
| In progress | GHSA-g6x2-hccm-hh4m: Werkzeug safe_join allows Windows device names with empty ADS, hanging send_from_directory on NTFS | secure-packages-rolling | — | |
| In progress | GHSA-8fvv-fgr5-f8ch: GridFS API misinterprets hash IDs as query criteria during read/write, bypassing exact match | secure-packages-rolling | — |