← All tracked CVEs
Updated 12:00
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| In progress | Tianocore EDK2 Reclaim buffer overflow pre-SVN 16280 enables local privilege escalation via long variable name | secure-packages-rolling | — | |
| In progress | EDK2 Reclaim buffer overflow pre-SVN 16280 allows physically proximate privilege escalation via long variable name | secure-packages-26.05 | — | |
| In progress | Zulip pre-1.3.12 exposed bot API keys to other users in the same realm | secure-packages-rolling | — | |
| In progress | xdg-email in xdg-utils 1.1.0-rc1+ allows mailto attachment injection, leaking sensitive files | secure-packages-rolling | — | |
| In progress | xdg-email vulnerability auto-attaches local files via mailto URIs, risking sensitive data exposure | secure-packages-26.05 | — | |
| In progress | Stored cross-site scripting vulnerability in zulip/zulip from 44f935695d452cc3fb16845a0c6af710438b153d to before 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6 | secure-packages-rolling | — | |
| In progress | Zulip linkifier regex allows admin-triggered ReDoS; validation regex also vulnerable to ReDoS. | secure-packages-rolling | — | |
| In progress | Zulip: Registration accepts expired invitation keys due to missing /accounts/register validation | secure-packages-rolling | — | |
| In progress | Zulip Mobile <=27.189: Crafted message links can disclose user credentials | secure-packages-rolling | — | |
| In progress | Zulip remote image proxy bypass leaks viewer IP/fingerprint via crafted message URLs | secure-packages-rolling | — | |
| In progress | Ittiam libmpeg2 overlapping memcpy in impeg2_mc_fullx_fully_8x8 before 2022-07-27 | secure-packages-rolling | — | |
| In progress | Overlapping memcpy in impeg2_mc_fullx_fully_8x8 (Ittiam libmpeg2 before 2022-07-27) | secure-packages-26.05 | — | |
| In progress | ReDoS vulnerability claim in py <=1.11.0 via Subversion info parsing (disputed) | secure-packages-rolling | — | |
| In progress | py library <=1.11.0 remote ReDoS via crafted SVN info; InfoSvnCommand mishandling disputed | secure-packages-26.05 | — | |
| In progress | libmemcached-awesome can return previous request’s data after timeout with low POLL_TIMEOUT | secure-packages-26.05 | — | |
| In progress | YASM v1.3.0 heap overflow via handle_dot_label in nasm/nasm-token.re; disputed | secure-packages-rolling | — | |
| In progress | YASM 1.3.0 heap overflow via handle_dot_label in nasm-token.re; security impact disputed | secure-packages-26.05 | — | |
| In progress | Artifex Software jbig2dec v0.20 SEGV vulnerability in jbig2_error (jbig2.c) | secure-packages-rolling | — | |
| In progress | SEGV vulnerability in Artifex jbig2dec v0.20 via jbig2_error in jbig2.c | secure-packages-26.05 | — | |
| In progress | REXML <3.2.6 DoS vulnerability parsing untrusted XML with many '<' in attributes | secure-packages-rolling | — | |
| In progress | REXML gem <3.3.1 DoS vulnerabilities when parsing untrusted XML containing many '<', '0', '%>' characters | secure-packages-rolling | — | |
| In progress | GHSA-fh3h-vg37-cc95: Open redirect in WebOb Location normalization via whitespace-induced protocol-relative URL (CVE-2024-42353) | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-251: WebOb <1.8.10 open redirect; CR/LF/TAB stripping bypasses CVE-2024-42353 fix | secure-packages-26.05 | — | |
| In progress | REXML <3.3.6 DoS parsing untrusted XML with deep repeated element names (tree parser) | secure-packages-rolling | — | |
| In progress | PyTorch 2.6.0 torch.jit.script critical memory corruption; local exploit publicly disclosed | secure-packages-26.05 | — | |
| In progress | Pytest ≤9.0.2 UNIX /tmp/pytest-of-{user} tmpdir allows local DoS/privilege escalation | secure-packages-rolling | — | |
| In progress | Pytest ≤9.0.2 UNIX temp dir /tmp/pytest-of-{user} allows local DoS/privilege escalation | secure-packages-26.05 | — | |
| In progress | UNIX pytest <=9.0.2 predictable /tmp/pytest-of-{user} dirs allow local DoS/privilege escalation | secure-packages-25.11 | — | |
| In progress | ReDoS vulnerability in Yarn <=1.22.22 explodeHostedGitFragment (hosted-git-resolver.js), remotely exploitable | secure-packages-rolling | — | |
| In progress | Yarn <=1.22.22 ReDoS from inefficient regex in explodeHostedGitFragment | secure-packages-26.05 | — | |
| In progress | Yarn <=1.22.22 setOptions in request-manager.js ReDoS via inefficient regex; local access | secure-packages-rolling | — | |
| In progress | Inefficient regex in Yarn <=1.22.22 setOptions (src/util/request-manager.js) enables local ReDoS unsupported versions only | secure-packages-26.05 | — | |
| In progress | Linux kernel BPF vulnerability: BPF_REFCOUNT not marked as a unique field | secure-packages-25.11 | — | |
| In progress | Linux kernel BPF: BPF_REFCOUNT field not marked unique, causing vulnerability | secure-packages-26.05 | — | |
| In progress | rtl8723bs: mgmt TX leaks in issue_beacon/probersp/asocrsp cause pool exhaustion | secure-packages-25.11 | — | |
| In progress | rtl8723bs mgmt-frame error paths leak xmit_frame/xmit_buf, exhausting TX pools | secure-packages-26.05 | — | |
| In progress | Linux drm/msm retires hung submit before GPU recovery, freeing BOs causing pagefaults | secure-packages-25.11 | — | |
| In progress | drm/msm retires hung submit before GPU recovery, freeing BOs and causing GPU pagefaults | secure-packages-26.05 | — | |
| In progress | iwlwifi MEI bug: q_head passed instead of cldev to iwl_mei_write_cyclic_buf | secure-packages-25.11 | — | |
| In progress | Incorrect argument passed to iwl_mei_write_cyclic_buf in iwlwifi mei (q_head vs cldev) | secure-packages-26.05 | — | |
| In progress | UCSI debugfs entries persist after unregister, causing duplicate directory errors on re-registration | secure-packages-25.11 | — | |
| In progress | UCSI debugfs entries persist after unregister, causing duplicate directory errors on re-registration | secure-packages-26.05 | — | |
| In progress | Hugo 0.75–0.165.x stored XSS via unescaped lineAnchors in Chroma code highlighting | secure-packages-25.11 | — | |
| In progress | Hugo 0.75.0-0.165.x syntax highlighter stored XSS via unescaped lineAnchors in Chroma | secure-packages-26.05 | — | |
| In progress | Hugo v0.56.0-0.165.x text/org renders unescaped HTML, enabling XSS via content/adapters | secure-packages-25.11 | — | |
| In progress | Hugo text/org content renders unescaped HTML enabling XSS in v0.56.0–v0.165.x | secure-packages-26.05 | — | |
| In progress | PyJWT <2.14.0 uncaught RecursionError on deeply nested JWT header causes HTTP 500s | secure-packages-26.05 | — | |
| In progress | PyJWT <2.14.0 signature decoding accepts non-Base64URL chars, bypassing raw-token revocation | secure-packages-26.05 | — | |
| In progress | PyJWT pre-2.14.0 is_pem_format ReDoS: unbounded regex backtracking on malformed PEM | secure-packages-26.05 | — | |
| In progress | Pre-3.1.9 Werkzeug safe_join allows NUL: ADS paths on Windows, causing read hangs | secure-packages-rolling | — |