← All tracked CVEs
Updated 09:00
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| Fixed | GNU Bison improperly trusts %output/%header paths, overriding caller options and overwriting arbitrary files | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | dhcpcd ≤10.3.2 heap use-after-free in control socket; local unprivileged exploitation | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | GNU coreutils unexpand integer overflow causes heap buffer overflow with large -t values | secure-packages-25.11 | Oct 4, 2026 | |
| Fixed | dhcpcd ≤10.3.2 DHCPv6 RENEW PD_EXCLUDE use-after-free enables unauthenticated same-link crash | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Zstandard <1.4.1 output files default permissions until completion, allowing unintended access | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | libplist bplist.c parse_dict_node out-of-bounds heap read causes DoS crash via crafted file | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks, causing use-after-free vulnerability | secure-packages-25.11 | Oct 3, 2026 | |
| Fixed | libxml2 XInclude fails to propagate parseFlags pre-2.15.4, bypassing XML_PARSE_NONET and enabling XXE/SSRF/DoS | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | libxml2 xmlIO before 2.15.4 passes negative write lengths due to integer overflow | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | libxml2 <2.15.4: heap-based buffer overflow in xmlXPtrEvalXPtrPart via xpointer length saturation | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | Integer overflow in libxml2 xmlURIEscapeStr (uri.c) before 2.15.4 | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | libxml2 <2.15.4: xmlDictAddQString integer overflow and heap buffer overflow in dict.c | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | dhcpcd <=10.3.2 stack OOB write via RFC6603 OPTION_PD_EXCLUDE in dhcp6_makemessage | secure-packages-rolling | Oct 3, 2026 | |
| Fixed | Unbound ≤1.26.0 vulnerable to DNSSEC ReTrap algorithmic complexity DoS (Tag/Delegation/NSEC/Additional) | secure-packages-rolling | Oct 1, 2026 | |
| Fixed | Unbound DoH libnghttp2 use-after-free causes session DoS in 1.12.0–1.26.0 | secure-packages-rolling | Oct 1, 2026 | |
| Fixed | NLnetLabs Unbound <=1.26.0 DoT/TCP read loop lacks limits; attacker monopolizes worker event loop causing DoS | secure-packages-rolling | Oct 1, 2026 | |
| Fixed | Unbound 1.22.0–1.26.1 DoQ RESET_STREAM retransmission use-after-free with libngtcp2 crashes server | secure-packages-rolling | Oct 1, 2026 | |
| Fixed | Tampered zone data served/written before ZONEMD check below trust anchor in Unbound 1.13.2–1.26.1 | secure-packages-rolling | Oct 1, 2026 | |
| Fixed | gst-plugins-good avidemux vprp parsing miscalculation causes out-of-bounds reads and crash | secure-packages-rolling | Oct 1, 2026 | |
| Fixed | nghttpx ≤1.69.0 forwards Upgrade+Content-Length on keep-alive backends; smuggling and response-queue poisoning | secure-packages-rolling | Oct 1, 2026 | |
| Fixed | ovpn-dco-win 2.0.0-2.8.3 epoch key buffer miscalc enables authenticated remote kernel heap overflow, DoS | secure-packages-rolling | Oct 1, 2026 | |
| Fixed | PYSEC-2026-3927: Apache Thrift Python: certificate host mismatch validation vulnerability before 0.24.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | GHSA-hwrj-9rr4-24xh: Apache Thrift Python bindings host mismatch certificate validation vulnerability before 0.24.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Improper certificate host mismatch validation in Apache Thrift Python before 0.24.0, replaces CVE-2026-41603 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Buffer over-read vulnerability in Apache Thrift C++ bindings before version 0.24.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Excessive size memory allocation vulnerability in Apache Thrift prior to 0.23.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Out-of-bounds read vulnerability in Apache Thrift prior to 0.23.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Uncontrolled recursion vulnerability in Apache Thrift prior to 0.23.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | PYSEC-2026-69: Password resets don't revoke sessions due to persistent cookie secret in Jupyter Server <=2.17.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | PYSEC-2026-67: Jupyter Server <=2.17.0 login 'next' parameter open redirect enables phishing | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | PYSEC-2026-3472: jupyter-server CORS origin validation bypass via re.match in allow_origin_pat (1.12–2.17) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | PYSEC-2026-2532: Path traversal allows unauthorized sibling directory access in jupyter-server 2.17.0 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | PYSEC-2026-2294: UltraJSON <5.13.0 accepts malformed UTF-8 when reject_bytes=False, enabling validation bypass/data integrity issues | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | GHSA-qh7q-6qm3-653w: Open redirect via ?next in Jupyter Server <=2.17.0 enables external phishing redirects | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | GHSA-3j69-69wj-xqx2: ujson reject_bytes=False rewrites malformed UTF-8 bytes, enabling validation bypass and data corruption | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | xmlXIncludeProcess/Tree in libxml2 <2.15.4 ignore parseFlags, bypassing XML_PARSE_NONET; XXE/SSRF/DoS | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | libxml2 xmlIO lacks integer overflow check, negative lengths passed to write callbacks pre-2.15.4 security risk | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | libxml2 <2.15.4 heap buffer overflow in xmlXPtrEvalXPtrPart via xpointer length saturation | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Integer overflow in libxml2 xmlURIEscapeStr (uri.c) before 2.15.4 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | libxml2 <2.15.4 xmlDictAddQString integer overflow causes heap-based buffer overflow | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | ReTrap DNSSEC algorithmic-complexity DoS bugs in Unbound ≤1.26.0: TagTrap, DelegationTrap, NsecTrap, AdditionalTrap | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Unbound 1.12–1.26 DoH libnghttp2 use-after-free on failure paths causes DoS | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Unbound <=1.26.0 TCP/DoT unbounded reads let attackers monopolize single worker event loop | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Use-after-free in Unbound DoQ with ngtcp2 on RESET_STREAM leads to crash (1.22.0–1.26.1) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | strongSwan libcharon 5.9.7-6.0.7 IKEv2 state machine mishandles CREATE_CHILD_SA enabling auth bypass | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | strongSwan 4.6.2–6.0.7 PKCS#5 decryption infinite loop bug | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | strongSwan 4.1.10–6.0.7 eap-aka plugin NULL pointer dereference | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | strongSwan 5.0.2–6.0.7 OpenSSL plugin: expired pointer dereference in PKCS#7 parsing | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Unbound ZONEMD zones below trust anchors can temporarily serve and persist tampered data. | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | GStreamer avidemux AVI strd FUJIFILM parsing underflow causing heap OOB read/write, info leak, crash | secure-packages-26.05 | Sep 30, 2026 |