← All tracked CVEs
Updated 14:00
1007 fixed in the last 30 days
| CVE | Status | Severity | Summary | Distribution | Fixed |
|---|---|---|---|---|---|
| Fixed | High | pnpm lockfile parsing path traversal allows write outside node_modules and code execution via lifecycle scripts | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | Nokogiri <1.19.1 canonicalize ignores xmlC14NExecute failures, enabling SAML signature validation bypass | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | Nokogiri <1.19.3: XSLT transform memory leak on null-byte strings enables DoS | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | Nokogiri <1.19.3 ReDoS via adversarial CSS selectors causing exponential regex backtracking | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Critical | Hugo tailwindcss AllowChildProcess bypasses Node permissions, enabling arbitrary code execution during builds | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | torchvision GIF decoder OOB heap read (≤0.28.0) enables DoS/info leak | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | Nokogiri <1.19.4 XInclude use-after-free: Ruby objects reference freed nodes/namespaces | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | Nokogiri <1.19.4 XPathContext use-after-free may segfault when document is garbage-collected | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | Nokogiri <1.19.4 DTD root allowed causes GC heap use-after-free/segfault | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | Nokogiri <1.19.4 use-after-free replacing XML attribute value leads segfault | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | Nokogiri <1.19.4 crash from NULL pointer deref in uninitialized XML::Node wrappers | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | Nokogiri CRuby use-after-free vulnerability in Document#encoding= with invalid encoding (pre-1.19.4) | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | Nokogiri <1.19.4 NodeSet#[] index check bug causes OOB read, CRuby crash; JRuby wrong node | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Low | Nokogiri JRuby pre-1.19.4 doesn't enforce NONET in Schema parsing, enabling SSRF/XXE. | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | pnpm vulnerability: malicious '.'/'..' bin names can remove global bin or parent pre-10.34.2/11.5.3 | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | pnpm vulnerable: committed lockfile bootstrap bypasses resolution, executes attacker-selected bytes during version switch | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | pnpm <10.34.2/11.5.3 runs repo-controlled pacquet from configDependencies during install (RCE risk) | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | pnpm pre-10.34.2/11.5.3 normalizer strips parentheses, enabling locator collisions and attacker-controlled source spoofing | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | pnpm/pacquet expand repo .npmrc/pnpm-workspace.yaml env vars, leaking secrets to attacker-selected registries | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | glibc 2.2+ deprecated ns_printrrf/ns_printrr/fp_nquery ignore buffer length, TSIG out-of-bounds write | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | Starlette pre-1.3.1 ignores form limits for urlencoded bodies, enabling unauthenticated resource exhaustion | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | Starlette <1.3.0 URL reconstruction lets attacker-controlled path spoof request.url hostname | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | python-multipart pre-0.0.30 DoS via quadratic parsing of semicolon-separated form bodies | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Low | Python-Multipart <=0.0.29 uses ';' as field separator, enabling parameter smuggling | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | python-multipart <0.0.30 decodes RFC2231 parameters, enabling multipart filename*/name* smuggling | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | pnpm --frozen-lockfile skips integrity verification if lockfile integrity missing pre-10.34.0/11.4.0 | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | AsyncSSH <2.23.0 %u expansion path traversal enables authentication via attacker-selected authorized_keys | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | twisted.names DoS via crafted TCP DNS compression chain hangs reactor | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | Hugo default code fence renderer fails to escape attribute values, enabling XSS | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | REXML gem before 3.3.9 vulnerable to ReDoS parsing hex char refs; affects Ruby 3.1 | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | DoS vulnerability in REXML <3.3.6 parsing deep XML with same local-name attributes | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | REXML Ruby gem 3.3.2 DoS via XML entity expansion in SAX2/pull parsers | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | REXML <3.3.2 DoS vulnerabilities parsing XML with excessive whitespace, '>]' and ']>' | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | REXML <3.3.1 DoS vulnerability when parsing XML with many '<', '0', '%>' characters | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | Medium | REXML denial-of-service via many '<' in attribute values of untrusted XML | secure-packages-26.05 | Oct 7, 2026 | |
| Fixed | High | Expat ≤2.8.3 DoS: quadratic complexity in storeAtts() attribute handling triggers CPU exhaustion | secure-packages-rolling | Oct 5, 2026 | |
| Fixed | Critical | Perl <=5.43.9 regex alternation >65535 overflows trie field causing silent mismatches | secure-packages-rolling | Oct 5, 2026 | |
| Fixed | High | PCRE2 <10.48 pcre2_jit_match mishandles copied subject context, causing incorrect free | secure-packages-rolling | Oct 5, 2026 | |
| Fixed | Medium | strongSwan libcharon 5.9.7–6.0.7 mishandles IKEv2 CREATE_CHILD_SA, enabling authentication bypass | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | High | strongSwan 4.5.0–6.0.7: eap-ttls/peap incorrect access control via missing/mismatched inner EAP identity | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | High | Use-after-free in libcharon IKEv2 rekeying collision handling (strongSwan 6.0.0–6.0.7) | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | High | strongSwan 4.2.0 through 6.0.7: NULL pointer dereference in x509 attribute certificate parser | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Medium | Infinite loop vulnerability in strongSwan PKCS#5 decryption (versions 4.6.2–6.0.7) | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Low | libcharon memory leak in IKE message parser affects strongSwan 4.1.2–6.0.7 | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Medium | NULL pointer dereference vulnerability in strongSwan eap-aka plugin (4.1.10–6.0.7) | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Low | strongSwan 5.0.2–6.0.7 openssl plugin PKCS#7 enumeration memory leak | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Medium | strongSwan openssl plugin PKCS#7 parsing expired pointer dereference vulnerability (5.0.2–6.0.7) | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Medium | GNU Bison improperly trusts %output/%header paths, overriding caller options and overwriting arbitrary files | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Medium | dhcpcd ≤10.3.2 heap use-after-free in control socket; local unprivileged exploitation | secure-packages-rolling | Oct 4, 2026 | |
| Fixed | Medium | GNU coreutils unexpand integer overflow causes heap buffer overflow with large -t values | secure-packages-25.11 | Oct 4, 2026 |