← All tracked CVEs
Updated 10:00
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| Fixed | GNU Bison: attacker-supplied %output/%header paths allow arbitrary file overwrites | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | dhcpcd ≤10.3.2 control socket heap use-after-free when privsep disabled, local exploit | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | dhcpcd <=10.3.2 DHCPv6 ADVERTISE triggers OPTION_PD_EXCLUDE one-byte stack OOB write | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | dhcpcd ≤10.3.2 heap UAF crash from DHCPv6 RENEW with RFC6603 PD_EXCLUDE zero lifetimes | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Hard-to-trigger double-free in giflib from GifMakeSavedImage shallow copy and incorrect error handling | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | ovpn-dco-win 2.0.0–2.8.3 epoch key buffer miscalc enables remote kernel heap overflow DoS | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | GIFLIB v5.2.2 gif2rgb heap buffer overflow vulnerability | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Zulip go-camo bypass via crafted image URL exposes viewer IP and fingerprinting | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Zulip Mobile <=27.189: crafted message link can disclose user credentials when followed | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Zulip expired email invitation keys allowed registration due to missing expiration check in /accounts/register | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Admin-configured linkifier regex enables DoS; validation regex itself vulnerable to ReDoS | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Stored XSS in GitHub zulip/zulip after 44f9356 and before 3eb2791 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Zstandard CLI <1.4.1 creates output files with default permissions until completion, exposing unintended access | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | libplist bplist.c parse_dict_node out-of-bounds heap read causes DoS via crafted file | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Zulip <1.3.12 exposed bot API keys to other users in the same realm | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | NLnet Labs Unbound ≤1.26.0 vulnerable to ReTrap DNSSEC algorithmic complexity DoS via multiple traps | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Unbound 1.12–1.26 DoH use-after-free in libnghttp2 builds causes session-wide DoS | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Unbound <=1.26.0: unlimited TCP/DoT reads enable service degradation via event loop starvation | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Unbound 1.22–1.26.1 DoQ use-after-free with libngtcp2 after RESET_STREAM causes crash | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Unbound 1.13.2–1.26.1 ZONEMD sub-TA zones serve/store tampered data before check; persists on disk | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | PerlMagick Layer heap-use-after-free DoS in ImageMagick <7.1.2-30, 6.9.x <6.9.13-55 via crafted images | secure-packages-26.05 | Sep 23, 2026 | |
| Fixed | Heap-use-after-free in ImageMagick PerlMagick GetList triggers denial-of-service crash pre-7.1.2-30/6.9.13-55 | secure-packages-26.05 | Sep 23, 2026 | |
| Fixed | ImageMagick MSL image decoder memory leak pre-7.1.2-30/6.9.13-55 enables DoS via memory exhaustion | secure-packages-26.05 | Sep 23, 2026 | |
| Fixed | ImageMagick pre-7.1.2-30/6.9.13-55 memory budget not lowered on OpenPixelCache failure causes DoS | secure-packages-26.05 | Sep 23, 2026 | |
| Fixed | Skia improper state validation allows cross-origin data exfiltration in Chrome <153.0.8010.52 | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Google Chrome WebAppInstalls UI misrepresentation enables social-engineered UI spoofing via crafted HTML pre-153.0.8010.52 | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Chrome Paint sensitive data disclosure before 153.0.8010.52 via crafted HTML; remote attacker | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Chrome <153.0.8010.52 Permissions bug leaks cross-origin data via crafted HTML pages | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Incorrect ORB authorization in Chrome <153.0.8010.52 enables site isolation bypass via crafted HTML | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Chrome pre-153.0.8010.52 DataTransfer OOB read allows local attacker to read memory outside sandbox | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Skia state validation bug in Chrome before 153.0.8010.52 enables cross-origin data exfiltration | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Chrome WebAppInstalls UI misrepresentation pre-153.0.8010.52 enables HTML spoofing via social engineering | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Chrome Paint sensitive info leak via crafted HTML in versions before 153.0.8010.52 | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Chrome pre-153.0.8010.52 Permissions info leak lets remote attackers exfiltrate cross-origin data via HTML | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | ORB auth flaw in Chrome <153.0.8010.52 allows site isolation bypass via crafted HTML High severity | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Out-of-bounds read in Chrome DataTransfer enables local memory access beyond sandbox (pre-153.0.8010.52) | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Chrome Skia improper state validation allows cross-origin data leak via crafted HTML (pre-153.0.8010.52) | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | UI misrepresentation vulnerability in Chrome WebAppInstalls pre-153.0.8010.52 allows UI spoofing via crafted HTML | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | Google Chrome Paint info leak pre-153.0.8010.52 via crafted HTML enables remote sensitive data exposure | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | Google Chrome Permissions info leak pre-153.0.8010.52 allows remote cross-origin data leakage | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | Incorrect ORB authorization enables site isolation bypass in Chrome <153.0.8010.52 via crafted HTML | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | Chrome DataTransfer OOB read pre-153.0.8010.52 enables reading memory outside sandbox locally | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | ASoC nau8821 kernel crash on remove with pending jack detection work | secure-packages-25.11 | Sep 21, 2026 | |
| Fixed | secure-packages-25.11 | Sep 21, 2026 | ||
| Fixed | Race in netfilter x_tables leaves table with NULL ops, causing NULL deref on exit | secure-packages-25.11 | Sep 18, 2026 | |
| Fixed | netfs_write_begin() request reference leak on netfs_wait_for_read() error | secure-packages-25.11 | Sep 18, 2026 | |
| Fixed | ath11k EMA/MBSSID beacon template memory leak on parameter setup error paths | secure-packages-25.11 | Sep 18, 2026 | |
| Fixed | Linux mt76 skb memory leak when mt76_connac_mcu_alloc_sta_req fails in wed_update/key_tlv | secure-packages-25.11 | Sep 18, 2026 | |
| Fixed | secure-packages-25.11 | Sep 18, 2026 | ||
| Fixed | secure-packages-25.11 | Sep 18, 2026 |