← All tracked CVEs
Updated 01:01
1177 fixed in the last 30 days
| CVE | Status | Severity | Summary | Distribution | Fixed |
|---|---|---|---|---|---|
| Fixed | High | PYSEC-2026-2292: ujson 5.10–5.11.0 indent overflow/underflow triggers crash or infinite loop DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | PYSEC-2026-2291: ujson 5.4.0–5.11.0 memory leak parsing large integers enables DoS on untrusted input | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | PYSEC-2026-142: urllib3 2.6.x partial reads may fully decompress responses, causing high CPU/memory use | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | PYSEC-2026-141: urllib3 ProxyManager cross-origin redirects leak sensitive headers when assert_same_host=False (1.23–<2.7.0) | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-wgvc-ghv9-3pmm: ujson 5.4–5.11 accumulating memory leak parsing large integers permits DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-qccp-gfcp-xxvc: urllib3 <2.7.0 ProxyManager-created HTTPConnection cross-origin redirects forward Authorization/Cookie/Proxy-Authorization headers | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-pwgv-4x5q-6m9f: sqlparse parsing DoS: TokenList.__init__ O(n*depth) work on deeply nested SQL | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-prg7-hcfm-mfcr: ReDoS via backreferenced dollar-quote and multiline comment regexes in sqlparse lexer | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-mf9v-mfxr-j63j: urllib3 <2.7.0 may fully decompress on Brotli second read or drain_conn, causing resource exhaustion | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-f2ff-p2ww-7p4p: sqlparse group_comments O(n^2) on comment-only input, bypasses token cap, causing DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | GHSA-cfqr-cjx5-5jcm: sqlparse ReindentFilter CPU DoS from repeated offset calculations on large tuple lists | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-c8rr-9gxc-jprv: ujson.dumps integer overflow/underflow with large or negative indent leads crash/loop DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Critical | Undocumented PLY 3.11 yacc() 'picklefile' enables RCE through unsafe pickle deserialization | secure-packages-rolling | Sep 18, 2026 | |
| Fixed | High | GHSA-836r-79rf-4m37: soupsieve CSS attribute VALUE regex catastrophic backtracking on unterminated quotes enables ReDoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | GHSA-3496-9g83-7v6x: sqlparse Python/PHP output formats vulnerable to code injection via improper backslash-quote escaping | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GHSA-2wc2-fm75-p42x: Soupsieve/Beautiful Soup CSS parser allocates unbounded memory for large comma-separated selectors causing DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | libcurl+libpsl fails PSL enforcement: public-suffix host cookies become wildcard, leak cross-subdomains | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | libcurl wolfSSL with CA caching reinstalls cached store after SSL_CTX callback, accepting untrusted certificates | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | curl ignores Secure attribute if preceded by tab in Set-Cookie, sending cookie over HTTP | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | libcurl erroneously reuses HTTPS connections across different CURLSSLOPT_NATIVE_CA settings for same host | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | libcurl ignores CURLOPT_PINNEDPUBLICKEY when verification disabled and server presents no certificate | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | libcurl multi/OpenSSL 3: pooled TLS outlives easy handle, dangling libctx leads to UAF | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | gst-plugins-good avidemux vprp parsing OOB read causes crash via crafted AVI | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | Soupsieve <2.8.4 regex catastrophic backtracking via unterminated attribute selector causes DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | soupsieve pre-2.8.4 CSS selector parser unbounded memory allocation DoS via crafted selectors | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | MP4 parsing DoS: GStreamer isomp4 qtdemux_audio_caps divide-by-zero from unvalidated atoms (<1.28.2) | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Medium | GStreamer gst-plugins-good <1.28.2 isomp4 qtdemux_parse_trak divide-by-zero DoS on MP4 audio | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Critical | libcurl reuses Negotiate-auth HTTP connection after empty creds, leaking requests across users | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Critical | Use-after-free in libcurl cleanup when sharing connections during HTTP/2 Server Push | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | Use-after-free RCE in GStreamer rtpsbcdepay RTP payload handling (ZDI-CAN-29787) | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GStreamer PNG parser heap overflow allows RCE via malicious PNG; user interaction required | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GStreamer OGG parser stack-based buffer overflow allows remote code execution; user interaction required | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GStreamer MRF parsing heap buffer overflow enables RCE via crafted file (ZDI-CAN-29608) | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | GStreamer MRF parser out-of-bounds write enables remote code execution (ZDI-CAN-29510) | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | High | Valkey clusterbus ping extension parsing out-of-bounds read causes crash | secure-packages-rolling | Sep 17, 2026 | |
| Fixed | High | Valkey Lua null-byte error handling bug allows response stream injection and cross-user data tampering | secure-packages-rolling | Sep 17, 2026 | |
| Fixed | Critical | Redis Lua GC use-after-free allows authenticated RCE in versions <=8.2.1; fixed 8.2.2 | secure-packages-rolling | Sep 17, 2026 | |
| Fixed | Medium | PYSEC-2026-1999: urllib3 PoolManager retries ignored; cannot disable redirects globally, posing SSRF risk | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | High | PYSEC-2026-1998: urllib3 ≤2.5.0 unbounded decompression chain enables resource exhaustion via chained Content-Encoding | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | High | PYSEC-2026-1996: urllib3 ≤2.6.2 decompresses redirect bodies during streaming, enabling decompression bombs and resource exhaustion | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | Medium | PYSEC-2026-1995: urllib3 fails to strip Proxy-Authorization on cross-origin redirects without ProxyManager, potential credential leak | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | High | PYSEC-2026-1994: Resource exhaustion via over-decompression in urllib3 streaming compressed responses (<=2.5.0) | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | Medium | PYSEC-2026-141: urllib3 1.23 to <2.7.0 leaks sensitive headers on cross-origin redirects via ProxyManager | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | High | GHSA-qccp-gfcp-xxvc: urllib3 pre-2.7.0 ProxyManager.connection_from_url urlopen forwards sensitive headers on cross-origin redirects | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | Medium | GHSA-pq67-6m6q-mj2v: urllib3 PoolManager retries ignored; redirects not disabled, causing potential SSRF exposure | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | High | GHSA-gm62-xv2j-4w53: urllib3 ≤2.5.0 unbounded content-encoding chain allows CPU and memory exhaustion DoS | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | High | GHSA-38jv-5279-wg99: urllib3 decompresses redirect bodies with preload_content=False, ignoring read limits; decompression bomb risk | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | Medium | GHSA-34jh-p97f-mpxf: Proxy-Authorization header may leak on cross-origin redirects when not using urllib3 proxy support | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | High | GHSA-2xpw-w6gg-jr37: urllib3 <=2.5.0 streaming decompression over-decodes compressed responses, causing excessive CPU/memory usage | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | High | PYSEC-2026-3457: pyasn1 <0.6.4 REAL float conversion CPU/memory exhaustion via huge exponents in encoded data | secure-packages-25.11 | Sep 16, 2026 |