← All tracked CVEs
Updated 13:01
1007 fixed in the last 30 days
| CVE | Status | Severity | Summary | Distribution | Fixed |
|---|---|---|---|---|---|
| Fixed | Low | Chrome <155.0.8059.39: Google Lens missing authorization exposes cross-origin data via compromised renderer | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Android Chrome GPU uninitialized resource enables remote out-of-sandbox memory read via crafted page | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Google Chrome Sync authorization flaw pre-155.0.8059.39 allows remote data disclosure via crafted traffic | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | High | Chrome Android <155 WebAPKs confused deputy enables web origin policy bypass via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | High | Chrome Passwords sensitive data leak before 155.0.8059.39 via crafted HTML page | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Chrome <155.0.8059.39: Google Lens missing auth enables cross-origin data leak via renderer | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | ANGLE uninitialized resource in Chrome <155.0.8059.39 enables remote sandbox memory read on Windows | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | High-severity Chrome Windows proxy info leak pre-155.0.8059.39 via crafted traffic by adjacent attacker | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | High | High-severity Chrome WebRTC buffer overflow allows sandboxed RCE via crafted HTML (pre-154.0.8037.97) | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Critical | Chrome <154.0.8037.97 FedCM use-after-free enables RCE outside sandbox via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Skia integer overflow in Chrome before 154.0.8037.97 leaks cross-origin data via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Critical | Chrome WebGL out-of-bounds write prior to 154.0.8037.97 enables sandbox-escape RCE | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Chrome <154.0.8037.97 SVG sensitive information leak via crafted HTML page | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Critical | Chrome Windows FileSystem auth flaw allowed RCE outside sandbox via crafted HTML pre-154.0.8037.97 | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | High | Chrome V8 type confusion allows sandbox RCE via crafted HTML, high severity (pre-154.0.8037.97) | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | High | Chrome Windows pre-154.0.8037.97 UAF in Contextual Tasks enables RCE outside sandbox | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | High | Use-after-free in Chrome MediaStream before 154.0.8037.97 allows sandboxed remote code execution via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | High | Chrome <154.0.8037.97 SVG use-after-free enables sandboxed RCE via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Chrome <154.0.8037.97 Compositing integer overflow leaks cross-origin data via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Chrome WebGPU uninitialized resource leaks cross-origin data pre-154.0.8037.92 via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | PYSEC-2026-3809: AsyncSSH 2.23.0: CVE-2026-45309 bypass via ~/${ENV} in %u AuthorizedKeysFile expansion | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | PYSEC-2026-3808: AsyncSSH SCP client path traversal (CVE-2019-6111 class) allows arbitrary file overwrite and RCE | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | GHSA-qr67-gv47-xwwh: AsyncSSH 2.23.0: CVE-2026-45309 fix bypass via ~/${ENV} expansion in AuthorizedKeysFile %u | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | GHSA-2wxc-x7rj-hg8f: asyncssh SCP client path traversal allows arbitrary file writes and RCE via malicious server | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | AsyncSSH SCP directory traversal lets malicious server write arbitrary files on client (pre-2.23.1) | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | AsyncSSH 2.23.0 incomplete CVE-2026-45309 fix allows AuthorizedKeysFile escape via ~ and ${ENV} | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | pgvector <0.8.6 IVFFlat index build integer wraparound enables OOB write, 32-bit RCE | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | Graphviz lib/common/shapes.c buffer overflow allows RCE and DoS via crafted file (<= f8b9e035) | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | Format string vulnerability in Graphviz lib/cgraph/scan.l yyerror permits remote exploitation | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | Graphviz 2.20.2 push_subg stack overflow via DOT with many Agraph_t enabling RCE/DoS | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Low | Graphviz before 2.2.1 vulnerable to local temp file symlink attack, arbitrary file overwrite | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | PYSEC-2026-4054: 500 error header logging exposes tokens from Referer in jupyter_server before 2.21.0 | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | PYSEC-2026-2384: AsyncSSH 2.22.0 AuthorizedKeysFile %u path traversal enables unauthorized SSH auth via username | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | PYSEC-2026-160: twisted.names DoS via DNS decompression pointer chain hangs reactor (pre-26.4.0rc2) | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | GHSA-w466-c33r-3gjp: pnpm auto-switch trusts committed env lockfile, enabling malicious package-manager code execution | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | GHSA-vx52-2968-3vc6: pnpm expands env vars in proxy settings from untrusted pnpm-workspace.yaml, leaking secrets | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | GHSA-vq4v-j7r6-jq4m: pnpm isolated-linker path traversal via scoped manifest name enables arbitrary file overwrite | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | GHSA-qrv3-253h-g69c: Malicious pnpm-lock.yaml configDependencies enables symlink path traversal outside node_modules/.pnpm-config | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | GHSA-q6j5-fjx5-2mc3: pnpm integrity bypass: missing lockfile integrity lets tampered packages install with --frozen-lockfile | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | GHSA-gj8w-mvpf-x27x: pnpm executes registry-selected native pacquet from repository configDependencies without trust enforcement | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | GHSA-g794-3fmp-753h: AsyncSSH AuthorizedKeysFile %u path traversal enables SSH public-key authentication bypass | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | GHSA-fr4h-3cph-29xv: GHSA-fr4h-3cph-29xv crafted hoisted alias escapes node_modules and overwrites layout in pnpm/pacquet | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | GHSA-c59q-g84q-2gj5: Unvalidated dp.parse() name allows lockfile path traversal; arbitrary writes during pnpm install | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | GHSA-c3mw-737p-c7g2: 500 error logs leak Referer token in jupyter_server/log.py before 2.21.0 | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | GHSA-72r4-9c5j-mj57: Arbitrary file deletion via pnpm patch-remove path traversal and symlink resolution flaws | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | GHSA-5wx6-mg75-v57r: Opaque locator normalization allows build-approval collisions (peer-suffix stripping, extra-@, semver-tail) GHSA-5wx6-mg75-v57r | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | GHSA-4gxm-v5v7-fqc4: Reserved manifest bin names cause pnpm global remove/update to delete outside global bin directory | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | GHSA-3qhv-2rgh-x77r: Repo .npmrc and workspace.yaml env expansion leaks secrets via registry URLs/auth in pnpm/pacquet | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | Jupyter Server <2.21.0 logs token-bearing Referer on 5xx, exposing auth tokens in logs | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | pnpm pre-10.34.5/11.11.0 path traversal via scoped tarball name enables arbitrary file overwrite and code execution | secure-packages-26.05 | Oct 7, 2026 |