← All tracked CVEs
Updated 17:00
1007 fixed in the last 30 days
| CVE | Status | Severity | Summary | Distribution | Fixed |
|---|---|---|---|---|---|
| Fixed | High | cpio vulnerability allows remote arbitrary file overwrite via symlinks in RPM packages (2007.05.10, 2010.07.28, others) | secure-packages-26.05 | Sep 30, 2026 | |
| Fixed | Medium | NLnet Labs Unbound ≤1.26.0 vulnerable to ReTrap DNSSEC algorithmic complexity DoS via multiple traps | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Medium | Unbound 1.12–1.26 DoH use-after-free in libnghttp2 builds causes session-wide DoS | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Critical | Unbound ≤1.26.0 CNAME synthesis TTL enforcement leads to heap corruption, possible RCE | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Critical | Unbound <=1.26.0 DNSSEC DNSKEY compression pointer digest buffer overflow enabling DoS and potential RCE | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | High | Unbound ≤1.26.0 RRSet canonicalization heap buffer overflow via 255-byte qname TCP response | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Medium | Unbound <=1.26.0: unlimited TCP/DoT reads enable service degradation via event loop starvation | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Medium | Unbound 1.22–1.26.1 DoQ use-after-free with libngtcp2 after RESET_STREAM causes crash | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Medium | Unbound 1.13.2–1.26.1 ZONEMD sub-TA zones serve/store tampered data before check; persists on disk | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Low | Unbound 1.20–1.26 serve-expired double-decrements per-client wait-limit, enabling DNSBomb protection bypass | secure-packages-25.11 | Sep 30, 2026 | |
| Fixed | Medium | PerlMagick Layer heap-use-after-free DoS in ImageMagick <7.1.2-30, 6.9.x <6.9.13-55 via crafted images | secure-packages-26.05 | Sep 23, 2026 | |
| Fixed | Low | ImageMagick pre-7.1.2-30/6.9.13-55 TOCTOU in video decoder bypasses path policy via symlink swaps | secure-packages-26.05 | Sep 23, 2026 | |
| Fixed | Medium | Heap-use-after-free in ImageMagick PerlMagick GetList triggers denial-of-service crash pre-7.1.2-30/6.9.13-55 | secure-packages-26.05 | Sep 23, 2026 | |
| Fixed | Low | ImageMagick <7.1.2-30 Windows TOCTOU symlink race bypasses path policy read/write restrictions | secure-packages-26.05 | Sep 23, 2026 | |
| Fixed | Medium | ImageMagick MSL image decoder memory leak pre-7.1.2-30/6.9.13-55 enables DoS via memory exhaustion | secure-packages-26.05 | Sep 23, 2026 | |
| Fixed | Medium | ImageMagick pre-7.1.2-30/6.9.13-55 memory budget not lowered on OpenPixelCache failure causes DoS | secure-packages-26.05 | Sep 23, 2026 | |
| Fixed | Medium | Skia improper state validation allows cross-origin data exfiltration in Chrome <153.0.8010.52 | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Medium | Google Chrome WebAppInstalls UI misrepresentation enables social-engineered UI spoofing via crafted HTML pre-153.0.8010.52 | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Medium | Chrome Paint sensitive data disclosure before 153.0.8010.52 via crafted HTML; remote attacker | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Low | SSRF in Chrome Android Omnibox pre-153.0.8010.52 allows bypassing system access restrictions via crafted traffic | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Medium | Chrome <153.0.8010.52 Permissions bug leaks cross-origin data via crafted HTML pages | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | High | Use-after-free in Chrome PDFium (<153.0.8010.52) enables remote sandboxed RCE via crafted HTML | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | High | PDFium buffer overflow allows sandboxed code execution with crafted PDF in Chrome <153.0.8010.52 on Windows | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Low | Chrome <153 FileSystem race lets compromised renderer bypass system access via crafted HTML | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Medium | Incorrect ORB authorization in Chrome <153.0.8010.52 enables site isolation bypass via crafted HTML | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Low | Missing Storage authorization in Chrome pre-153 allows renderer-compromised site isolation bypass via PDF | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | High | V8 type confusion in Chrome <153.0.8010.52 enables sandboxed RCE via crafted HTML | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Medium | Chrome pre-153.0.8010.52 DataTransfer OOB read allows local attacker to read memory outside sandbox | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | High | Chrome Windows Tracing reference resolution flaw allows local RCE outside sandbox pre-153.0.8010.52 | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Critical | Use-after-free in Dawn on Chrome Android enables RCE outside sandbox via crafted HTML (pre-153.0.8010.52) | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Critical | Use-after-free in Chrome Extensions before 153.0.8010.52 allows remote sandbox-escape RCE | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Critical | Critical WebGL buffer overflow in Chrome Android allows remote code execution outside sandbox pre-153.0.8010.52 | secure-packages-rolling | Sep 22, 2026 | |
| Fixed | Medium | Skia state validation bug in Chrome before 153.0.8010.52 enables cross-origin data exfiltration | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Medium | Chrome WebAppInstalls UI misrepresentation pre-153.0.8010.52 enables HTML spoofing via social engineering | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Medium | Chrome Paint sensitive info leak via crafted HTML in versions before 153.0.8010.52 | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Low | SSRF in Chrome Android Omnibox before 153.0.8010.52 bypasses system access restrictions via crafted traffic | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Medium | Chrome pre-153.0.8010.52 Permissions info leak lets remote attackers exfiltrate cross-origin data via HTML | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | High | High-severity use-after-free in PDFium enables sandboxed RCE via crafted HTML in Chrome <153.0.8010.52 | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | High | Chrome Windows PDFium buffer overflow pre-153.0.8010.52 enables remote sandboxed code execution via crafted PDF | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Low | Chrome <153.0.8010.52 FileSystem race enables privilege bypass via crafted HTML after renderer compromise | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Medium | ORB auth flaw in Chrome <153.0.8010.52 allows site isolation bypass via crafted HTML High severity | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Low | Google Chrome <153.0.8010.52 Storage auth flaw allows compromised-renderer PDF to bypass site isolation | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | High | Chrome <153.0.8010.52 V8 type confusion allows sandboxed RCE via crafted HTML | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Medium | Out-of-bounds read in Chrome DataTransfer enables local memory access beyond sandbox (pre-153.0.8010.52) | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | High | Pre-153.0.8010.52 Chrome Windows Tracing reference resolution bug enables local sandbox escape, arbitrary code | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Critical | Critical use-after-free in Dawn on Android Chrome <153.0.8010.52 enables RCE outside sandbox | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Critical | Use-after-free in Google Chrome Extensions enables remote code execution outside sandbox via crafted extension (pre-153.0.8010.52) | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Critical | Android Chrome WebGL buffer overflow pre-153.0.8010.52 enables sandbox escape RCE via crafted HTML Critical | secure-packages-26.05 | Sep 22, 2026 | |
| Fixed | Medium | Chrome Skia improper state validation allows cross-origin data leak via crafted HTML (pre-153.0.8010.52) | secure-packages-25.11 | Sep 22, 2026 | |
| Fixed | Medium | UI misrepresentation vulnerability in Chrome WebAppInstalls pre-153.0.8010.52 allows UI spoofing via crafted HTML | secure-packages-25.11 | Sep 22, 2026 |