← All tracked CVEs
Updated 08:00
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| Fixed | UCSI debugfs entries persist after unregister, causing duplicate directory errors on re-registration | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | iwlwifi: MEI passes q_head instead of cldev to iwl_mei_write_cyclic_buf | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | drm/msm: Retiring hung submit before GPU recovery frees BOs, causing GPU page faults | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | rtl8723bs mgmt xmit_frame/xmit_buf leak on error exhausts TX pools, breaking beacons/responses | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | bpf_refcount field not marked unique in Linux kernel BPF subsystem | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Chrome Windows pre-155.0.8059.39 API miscalculation enables remote UI spoofing via crafted extension | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 extension code injection enables remote UI spoofing via social engineering | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Remote information leak in Chrome Enterprise before 155.0.8059.39 via crafted HTML page | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Race condition allows UI spoofing via compromised renderer in Chrome <155.0.8059.39 | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 permissions auth flaw lets compromised renderers spoof UI via HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Missing authorization in Chrome iOS <155.0.8059.39 enables remote UI spoofing via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Incorrect authorization in Chrome Extensions allowed UI spoofing via crafted extension (pre-155.0.8059.39) | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Clickjacking in Chrome Android Messages before 155.0.8059.39 enables UI spoofing via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome Media authorization flaw leaks cross-origin data via crafted HTML (pre-155.0.8059.39) | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 Glic cleanup bug leaks cross-origin data via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Google Chrome WebAudio info leak enables cross-origin data exfiltration via crafted page (pre-155.0.8059.39) | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Android Chrome pre-155.0.8059.39 WebShare auth bug let renderer-compromised attacker spoof UI via HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 SanitizerAPI vulnerability leaks sensitive information via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 DataTransfer auth bug lets compromised renderer access sensitive data via HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 UI misrepresentation enables HTML-based UI spoofing via social engineering | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Uninitialized Skia resource in Chrome <155.0.8059.39 enables cross-origin data exfiltration | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome Android <155.0.8059.39 PiP UI flaw enables address bar spoofing via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome Android <155.0.8059.39 UI misrepresentation lets remote attacker spoof UI via crafted HTML Medium severity | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Google Chrome Paint discrepancy pre-155.0.8059.39 enables cross-origin data leak via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome pre-155.0.8059.39 Compositing integer overflow leaks cross-origin data via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Google Chrome Paint information leak before 155.0.8059.39 via crafted HTML enabled remote sensitive data exfiltration | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Android Chrome pre-155.0.8059.39 PDF auth flaw let co-installed app access sensitive data | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome Android pre-155.0.8059.39 UI confused deputy allowed local access to privileged page via co-installed app | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome Core reference resolution bug pre-155.0.8059.39 leaks cross-origin data via social engineering | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Incorrect authorization in WebAppInstalls Chrome Android allowed remote system access bypass via crafted HTML pre-155.0.8059.39 | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Google Chrome pre-155.0.8059.39 Editing info leak via crafted HTML, social engineering | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 UI use-after-free lets compromised renderer spoof UI elements | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome Android fullscreen UI bug allowed address bar spoofing before 155.0.8059.39 | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | UI spoofing vulnerability in Chromoting on macOS Chrome prior to 155.0.8059.39 | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome Android pre-155.0.8059.39 incorrect authorization lets local co-installed app exfiltrate data via social engineering | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Missing SignIn authorization in Chrome <155.0.8059.39 enables crafted extension data theft via social engineering | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Clickjacking in Chrome PermissionElement pre-155.0.8059.39 enables UI spoofing via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | FontAccess use-after-free enables origin policy bypass by renderer-compromised attacker (Chrome <155.0.8059.39) | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Mobile Chrome on Android <155.0.8059.39 allows remote UI spoofing via crafted HTML. | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | ANGLE out-of-bounds read in Google Chrome <155.0.8059.39 via crafted HTML enables outside-sandbox memory read | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 Autofill AI bug leaks data via compromised renderer, crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Google Chrome pre-155.0.8059.39 PermissionElement UI misrepresentation enables remote spoofing via crafted HTML and social engineering | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | CacheStorage race in Chrome <155.0.8059.39 leads to out-of-sandbox memory read | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 Unbounded Element auth bug allows UI spoofing via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 WebAppInstalls UI misrepresentation enables social-engineering system access bypass via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome pre-155.0.8059.39 WebOTP UI misrepresentation allows remote UI spoofing via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome Animation info leak pre-155.0.8059.39 allows remote cross-origin data exfiltration via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Payments UI spoofing vulnerability in Chrome pre-155.0.8059.39 via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 WebAppInstalls auth flaw allows UI spoofing via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Chrome 'File' UI spoofing pre-155.0.8059.39 via crafted HTML and social engineering | secure-packages-26.05 | Oct 9, 2026 |