← All tracked CVEs
Updated 00:01
1155 fixed in the last 30 days
| CVE | Status | Severity | Summary | Distribution | Fixed |
|---|---|---|---|---|---|
| Fixed | Medium | Chrome Android <153.0.8010.47 missing authorization leaks sensitive data via local co-installed app | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Critical | Chrome pre-153.0.8010.47 Auth use-after-free allows remote code execution outside sandbox | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | ServiceWorker type confusion permits sandboxed code execution via crafted HTML in Chrome <153.0.8010.47 | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | Google Chrome pre-153.0.8010.47 font rendering discrepancy allows crafted HTML sensitive data leak via social engineering | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | Missing authorization in Chrome before 153.0.8010.47 enables compromised renderer to spoof UI via crafted HTML | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | Google Chrome Mac Extensions race condition enables sandbox escape and RCE pre-153.0.8010.47 | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | Chrome ServiceWorker out-of-bounds write before 153.0.8010.47 allows sandboxed RCE via crafted HTML | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Critical | Pre-153.0.8010.47 Chrome WebAppInstalls use-after-free allows RCE outside sandbox via crafted HTML | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | Chrome ServiceWorker type confusion allowed sandboxed RCE via crafted HTML (pre-153.0.8010.47) | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Low | Chrome <153.0.8010.47 network race condition leaks cross-origin data from compromised renderer process | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Critical | PLY 3.11 PyPI: Undocumented yacc() picklefile enables RCE via unsafe pickle deserialization | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GitPython <3.1.60 ReDoS via Actor.name_email_regex on malformed commit author fields causing CPU exhaustion | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GitPython 3.1.59 diff API allows --no-index Boolean oracle, arbitrary file disclosure | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GitPython <3.1.60 git directory impersonation enables pre-commit hook RCE via tracked files | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GitPython <3.1.59 arbitrary file read via Repo.blame() missing --contents/-S denylist | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GitPython <3.1.59: separate_git_dir allows arbitrary git directory creation and hook execution | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Critical | GitPython <3.1.59 multi-line config write bug enables directive injection and hook RCE | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GitPython before 3.1.59 discloses local files via malicious .gitmodules include directives | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | PYSEC-2026-2293: ujson.dump memory leak on failed file-like object writes prior to 5.12.1 | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-c38f-wx89-p2xg: ujson.dump memory leak when write() fails due to missing Py_DECREF of serialized string | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | libcurl LDAP SASL negotiation flaw misinterprets incomplete handshake, enabling MITM peer validation bypass | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | PYSEC-2026-3923: sqlparse ReindentFilter CPU DoS when reindent=True processes large crafted tuple-list SQL | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | PYSEC-2026-3699: sqlparse CPU DoS via O(n*depth) TokenList.__init__ flattening on nested groups | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | PYSEC-2026-3698: sqlparse ReDoS: dollar-quoted backreference and multiline comments cause quadratic CPU exhaustion | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | PYSEC-2026-3697: Quadratic parsing of comment-only SQL in sqlparse group_comments enables DoS; token cap bypassed | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | PYSEC-2026-3696: sqlparse Python/PHP output modes improperly escape quotes, enabling snippet injection via backslashes | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | PYSEC-2026-3072: Soupsieve CSS parser ReDoS via catastrophic backtracking on unterminated quoted attribute values | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | PYSEC-2026-3071: Unbounded memory allocation in soupsieve compiling large comma-separated CSS selector lists (DoS) | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | PYSEC-2026-2292: ujson 5.10–5.11.0 indent overflow/underflow triggers crash or infinite loop DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | PYSEC-2026-2291: ujson 5.4.0–5.11.0 memory leak parsing large integers enables DoS on untrusted input | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | PYSEC-2026-142: urllib3 2.6.x partial reads may fully decompress responses, causing high CPU/memory use | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | PYSEC-2026-141: urllib3 ProxyManager cross-origin redirects leak sensitive headers when assert_same_host=False (1.23–<2.7.0) | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-wgvc-ghv9-3pmm: ujson 5.4–5.11 accumulating memory leak parsing large integers permits DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-qccp-gfcp-xxvc: urllib3 <2.7.0 ProxyManager-created HTTPConnection cross-origin redirects forward Authorization/Cookie/Proxy-Authorization headers | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-pwgv-4x5q-6m9f: sqlparse parsing DoS: TokenList.__init__ O(n*depth) work on deeply nested SQL | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-prg7-hcfm-mfcr: ReDoS via backreferenced dollar-quote and multiline comment regexes in sqlparse lexer | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-mf9v-mfxr-j63j: urllib3 <2.7.0 may fully decompress on Brotli second read or drain_conn, causing resource exhaustion | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-f2ff-p2ww-7p4p: sqlparse group_comments O(n^2) on comment-only input, bypasses token cap, causing DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | GHSA-cfqr-cjx5-5jcm: sqlparse ReindentFilter CPU DoS from repeated offset calculations on large tuple lists | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-c8rr-9gxc-jprv: ujson.dumps integer overflow/underflow with large or negative indent leads crash/loop DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Critical | Undocumented PLY 3.11 yacc() 'picklefile' enables RCE through unsafe pickle deserialization | secure-packages-rolling | Sep 18, 2026 | |
| Fixed | High | GHSA-836r-79rf-4m37: soupsieve CSS attribute VALUE regex catastrophic backtracking on unterminated quotes enables ReDoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | GHSA-3496-9g83-7v6x: sqlparse Python/PHP output formats vulnerable to code injection via improper backslash-quote escaping | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-2wc2-fm75-p42x: Soupsieve/Beautiful Soup CSS parser allocates unbounded memory for large comma-separated selectors causing DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | libcurl+libpsl fails PSL enforcement: public-suffix host cookies become wildcard, leak cross-subdomains | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | libcurl wolfSSL with CA caching reinstalls cached store after SSL_CTX callback, accepting untrusted certificates | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | curl ignores Secure attribute if preceded by tab in Set-Cookie, sending cookie over HTTP | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | libcurl erroneously reuses HTTPS connections across different CURLSSLOPT_NATIVE_CA settings for same host | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | libcurl ignores CURLOPT_PINNEDPUBLICKEY when verification disabled and server presents no certificate | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | libcurl multi/OpenSSL 3: pooled TLS outlives easy handle, dangling libctx leads to UAF | secure-packages-26.05 | Sep 18, 2026 |