← All tracked CVEs
Updated 16:00
1007 fixed in the last 30 days
| CVE | Status | Severity | Summary | Distribution | Fixed |
|---|---|---|---|---|---|
| Fixed | High | libcharon use-after-free in strongSwan 6.0.0–6.0.7 during IKEv2 rekeying collision handling | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | strongSwan 5.1.3–6.0.7: Infinite loop in x509 attribute certificate parser (ietfAttrSyntax) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Low | Memory leak in strongSwan x509 attribute certificate parser (versions 4.2.0–6.0.7) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | strongSwan x509 plugin attribute certificate parser NULL pointer dereference (4.2.0–6.0.7) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | strongSwan 4.6.2–6.0.7 PKCS#5 decryption infinite loop bug | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Low | strongSwan libcharon 4.1.2–6.0.7: memory leak in IKE message parser | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | strongSwan 4.1.10–6.0.7 eap-aka plugin NULL pointer dereference | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Low | strongSwan openssl plugin PKCS#7 certificate enumeration memory leak (5.0.2–6.0.7) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | strongSwan 5.0.2–6.0.7 OpenSSL plugin: expired pointer dereference in PKCS#7 parsing | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | Unbound ZONEMD zones below trust anchors can temporarily serve and persist tampered data. | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Low | Unbound 1.20–1.26 serve-expired double-decrements wait-limit, letting attackers bypass DNSBomb countermeasures | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | GStreamer avidemux AVI strd FUJIFILM parsing underflow causing heap OOB read/write, info leak, crash | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | Heap buffer overflow in binutils XCOFF linker allows local RCE or DoS | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | pyasn1 <0.6.4 REAL float conversion CPU/memory exhaustion via huge exponent | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | pyasn1 <0.6.4 OID/RELATIVE-OID decode/encode quadratic complexity enables CPU DoS attacks | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | pyasn1 <0.6.4 BER/CER/DER unbounded long-form tag parsing DoS; Py3.11 ValueError crash | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | GNU Bison: attacker-supplied %output/%header paths allow arbitrary file overwrites | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | GNU Bison --html arbitrary command execution via %define tool.xsltproc; 3.8.2 vulnerable | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | dhcpcd ≤10.3.2 control socket heap use-after-free when privsep disabled, local exploit | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | dhcpcd <=10.3.2 IPv6 RA Route Information memory leak allows DoS via crafted advertisements | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | dhcpcd <=10.3.2 DHCPv6 ADVERTISE triggers OPTION_PD_EXCLUDE one-byte stack OOB write | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | dhcpcd ≤10.3.2 heap UAF crash from DHCPv6 RENEW with RFC6603 PD_EXCLUDE zero lifetimes | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | OpenEXR 3.4.0–3.4.11 HTJ2K ht_undo_impl heap read overflow on mismatched line width | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | Integer overflow in OpenEXR HTJ2K decode enables heap out-of-bounds write (3.4.0–3.4.11) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Critical | SimpleEval <1.0.5 sandbox escape via object attribute leakage and callback-passed dangerous functions | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | giflib 5.2.2 EGifGCBToExtension buffer overflow enables remote DoS via unchecked GCE size | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | Hard-to-trigger double-free in giflib from GifMakeSavedImage shallow copy and incorrect error handling | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | ovpn-dco-win 2.0.0–2.8.3 epoch key buffer miscalc enables remote kernel heap overflow DoS | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Critical | tarfile erroneously converts AREGTYPE to DIRTYPE during GNU longname/longlink, misinterpreting crafted archives | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | GIFLIB v5.2.2 gif2rgb heap buffer overflow vulnerability | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Low | Zulip ≤6.1 invite flow allows setting streams without stream-add permission | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Low | Unauthorized account creation via external backend with ZulipLDAPAuthBackend when invitations not required | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | Stack overflow in libsass 3.6.5-8-g210218 ast_selectors.cpp has_real_parent_ref causes DoS; affects sassc 3.6.2 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | RubyGems.org bug lets attackers change emails to unowned addresses, enabling account hijacking | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | Zulip go-camo bypass via crafted image URL exposes viewer IP and fingerprinting | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | Zulip Mobile <=27.189: crafted message link can disclose user credentials when followed | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | Zulip Server ≤5.4 privilege escalation lets members grant admin to their bots via API | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Critical | Zulip <4.9 exposes RabbitMQ port 25672; weak cookie enables RCE and data exfiltration | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | Zulip expired email invitation keys allowed registration due to missing expiration check in /accounts/register | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | Admin-configured linkifier regex enables DoS; validation regex itself vulnerable to ReDoS | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | Improper access control vulnerability in zulip/zulip before 4.10 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | Stored XSS in GitHub zulip/zulip after 44f9356 and before 3eb2791 | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | Zstandard CLI <1.4.1 creates output files with default permissions until completion, exposing unintended access | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | Zstandard <1.3.8 one-pass compression race allows OOB write with small output buffer | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | libplist plist.c: plist_free_data invalid free when integer node treated as PLIST_KEY, causing DoS | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | libplist DoS via zero offset size causing large memory allocation and crash | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | libplist bplist.c parse_dict_node out-of-bounds heap read causes DoS via crafted file | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | Deactivated users could access messages in Zulip <1.3.12 with SSO enabled | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | Zulip <1.3.12 exposed bot API keys to other users in the same realm | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | High | Remote DoS in ClamAV libclamav on Cisco ESA/WSA via crafted document causes AMP restart | secure-packages-26.05 | Sep 30, 2026 |