← All tracked CVEs
Updated 19:00
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| In progress | GHSA-vmf3-w455-68vh: node-tar misapplies PAX size to metadata headers, desyncing parse and hiding files | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-2987: Pygments <2.20.0 AdlLexer ReDoS from inefficient regex; local, public exploit available | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-1845: pytest ≤9.0.2 UNIX uses /tmp/pytest-of-{user} dirs enabling local DoS/privilege escalation | secure-packages-rolling | — | |
| In progress | GHSA-6w46-j5rx-g56g: UNIX pytest through 9.0.2 predictable /tmp/pytest-of-{user} dirs allow DoS/privilege escalation | secure-packages-rolling | — | |
| In progress | GHSA-j934-xhv5-fg8f: Unanchored RE_WS_END search causes quadratic-time slowdown on long selector whitespace/comments | secure-packages-rolling | — | |
| In progress | GHSA-gjv8-xp57-g29c: CSS selector ReDoS in soupsieve: overlapping quantifiers in IDENTIFIER cause quadratic backtracking | secure-packages-rolling | — | |
| In progress | GHSA-rw4j-r22c-9gc3: AsyncSSH client/server hangs when peer sets channel maximum packet size 0, blocking event loop | secure-packages-26.05 | — | |
| In progress | GHSA-g6x2-hccm-hh4m: Werkzeug safe_join allows Windows device names with empty ADS, causing send_from_directory hang on NTFS | secure-packages-25.11 | — | |
| In progress | GHSA-qx36-8mw2-4r3x: Key vault .sock KMS endpoint causes PyMongo to connect to attacker-chosen Unix socket | secure-packages-rolling | — | |
| In progress | GHSA-g6x2-hccm-hh4m: Werkzeug safe_join allows Windows device names with empty ADS, hanging send_from_directory on NTFS | secure-packages-rolling | — | |
| In progress | GHSA-8fvv-fgr5-f8ch: GridFS API misinterprets hash IDs as query criteria during read/write, bypassing exact match | secure-packages-rolling | — | |
| In progress | GHSA-g6x2-hccm-hh4m: Werkzeug safe_join allows Windows NTFS device names with empty ADS, causing hangs via send_from_directory | secure-packages-26.05 | — | |
| In progress | GHSA-8fvv-fgr5-f8ch: PyMongo GridFS API misinterprets hash passed as ID, overriding exact match. | secure-packages-26.05 | — | |
| In progress | GHSA-qx36-8mw2-4r3x: PyMongo treats key vault .sock KMS endpoint as Unix socket, enabling local connections | secure-packages-26.05 | — | |
| In progress | GHSA-cfqr-cjx5-5jcm: sqlparse ReindentFilter CPU DoS from crafted tuple lists causing quadratic offset recomputation | secure-packages-rolling | — | |
| In progress | PYSEC-2026-4170: ReDoS: soupsieve IDENTIFIER/VALUE regex quadratic backtracking on long failing selectors | secure-packages-rolling | — | |
| In progress | PYSEC-2026-4171: soupsieve css_parser ReDoS: unanchored RE_WS_END search causes O(n^2) on whitespace/comments | secure-packages-rolling | — | |
| In progress | PYSEC-2026-3927: Apache Thrift Python: host mismatch certificate validation vulnerability before 0.24.0 | secure-packages-rolling | — | |
| In progress | GHSA-3496-9g83-7v6x: sqlparse python/php output modes allow code injection via improper backslash/quote escaping | secure-packages-rolling | — | |
| In progress | PYSEC-2026-3923: sqlparse reindent tuple-list formatting triggers CPU DoS from repeated statement-prefix offset calculations | secure-packages-rolling | — | |
| In progress | GHSA-hwrj-9rr4-24xh: Apache Thrift Python bindings: improper TLS certificate hostname validation vulnerability before 0.24.0 | secure-packages-rolling | — | |
| In progress | PYSEC-2026-3696: sqlparse python/php output filters allow code injection via improper backslash/quote escaping | secure-packages-rolling | — | |
| In progress | PYSEC-2026-4176: urllib3 2.6.2–2.7.0 infinite loop on chunked deflate streaming with trailing bytes causes high CPU | secure-packages-26.05 | — | |
| In progress | GHSA-gh4c-6fx4-qh6g: Infinite loop in urllib3 2.6.2–2.7.0 decoding chunked deflate streams, high CPU | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4026: AsyncSSH accepts peer channel max packet size 0, causing event loop hang | secure-packages-26.05 | — | |
| In progress | GHSA-9h9j-4vrj-gf7g: virtualenv: pyvenv.cfg line-break injection via prompt overrides 'home' and other keys | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-4176: urllib3 2.6.2–2.7.0 infinite loop on chunked deflate streaming causes CPU DoS | secure-packages-25.11 | — | |
| In progress | GHSA-gh4c-6fx4-qh6g: urllib3 2.6.2–2.7.0 infinite loop on chunked deflate streaming causes CPU exhaustion | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-4113: oauthlib RevocationEndpoint JSONP reflects unvalidated callback, enabling arbitrary JavaScript injection | secure-packages-26.05 | — | |
| In progress | GHSA-hj66-6f7g-4r5v: JSONP callback injection in oauthlib RevocationEndpoint due to unvalidated callback parameter | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4114: Observable timing discrepancy in oauthlib PKCE code_challenge due to insecure string comparison | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3447: MANIFEST.in excludes bypassed on macOS due to Unicode normalization in setuptools <83.0.0 | secure-packages-26.05 | — | |
| In progress | GHSA-xpv3-w29h-x7cv: PKCE timing side-channel from non-constant-time compare in oauthlib Authorization Code grant | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-196: pip treats console_scripts/gui_scripts as paths, installing entry points outside installation directory | secure-packages-26.05 | — | |
| In progress | GHSA-jp4c-xjxw-mgf9: pip <26.1 self-update ran after wheel install, importing newly-installed well-known modules unexpectedly | secure-packages-26.05 | — | |
| In progress | GHSA-23w6-3w8w-8484: pypdf vulnerability: crafted PDFs cause excessive runtime and memory via nested outlines | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3913: pypdf TreeObject.insert_child vulnerability allows malicious PDF to cause infinite loop | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-2875: pip installs dual-format tar+zip archives as ZIP, causing confusing or incorrect installations | secure-packages-26.05 | — | |
| In progress | GHSA-qwm4-qh6w-59xr: pip double-encoded URL bug allows arbitrary file writes when installing wheels from malicious indexes | secure-packages-26.05 | — | |
| In progress | GHSA-8v8h-hg4w-mvq2: python-hyper/hpack unbounded varint decoding causes O(n^2) DoS on malformed input | secure-packages-26.05 | — | |
| In progress | GHSA-h35f-9h28-mq5c: setuptools FileList MANIFEST.in excludes ignore Unicode normalization, leaking files on macOS APFS/HFS+ sdists | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3721: pip arbitrary file write via double-encoded package URLs from malicious index when downloading wheels | secure-packages-26.05 | — | |
| In progress | GHSA-58qw-9mgm-455v: pip misclassifies dual tar/ZIP archives as ZIP, leading to confusing, potentially incorrect installs | secure-packages-26.05 | — | |
| In progress | GHSA-763m-79hh-57f2: pypdf text extraction vulnerability causes excessive runtime and memory with many or reused XForm objects | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3716: Datasets <=5.0.0 unvalidated file_name enables path traversal, arbitrary file read in folder builders | secure-packages-26.05 | — | |
| In progress | GHSA-jp53-mhqp-8xcg: Crafted PDF triggers infinite loop via pypdf TreeObject.insert_child, causing DoS (pre-6.16.0) | secure-packages-26.05 | — | |
| In progress | GHSA-379c-qx7v-6h59: Path traversal via file_name leaks local files in Datasets <=5.0.0 folder builders | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-2876: pip self-update check runs after wheel install, imports newly-installed modules, potential security risk | secure-packages-26.05 | — | |
| In progress | GHSA-rrmf-rvhw-rf47: Critical memory corruption in PyTorch 2.6.0 torch.jit.script; local exploit publicly disclosed | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4024: AnyIO process-pool leaves stderr pipe undrained, enabling deadlock via large stderr output | secure-packages-26.05 | — |