Skip to content
← All tracked CVEs

Updated 04:00

last 30 days

933 fixed within SLA

CVEStatusSeveritySummaryReleaseClock startedDeadlineFixedTime to fix
Fixed within SLAHighFFmpeg 7.0–8.1.2 vf_quirc heap OOB write via mismatched PGS/SUP frame dimensionssecure-packages-26.05Aug 11, 2026Aug 26, 2026Aug 15, 20263 days
Fixed within SLAHighHeap OOB write in FFmpeg PNG/APNG encoders <=8.1.2 via malicious eXIf chunk, RCEsecure-packages-26.05Aug 11, 2026Aug 26, 2026Aug 15, 20263 days
Fixed within SLAHighFFmpeg ≤8.1.2 MACE6 signed integer overflow leads to heap OOB write via CAFsecure-packages-26.05Aug 11, 2026Aug 26, 2026Aug 15, 20263 days
Fixed within SLAHighFFmpeg <=8.1.2 LCL/ZLIB decoder info leak via short zlib decompressionsecure-packages-26.05Aug 11, 2026Aug 26, 2026Aug 15, 20263 days
Fixed within SLAHighFFmpeg ≤8.1.2 IAMF demuxer OOM via crafted count_label during format probingsecure-packages-26.05Aug 11, 2026Aug 26, 2026Aug 15, 20263 days
Fixed within SLAHighFFmpeg <=8.1.2 vf_hqdn3d heap out-of-bounds write with -reinit_filter 0 and growing framessecure-packages-26.05Aug 11, 2026Aug 26, 2026Aug 15, 20263 days
Fixed within SLAHighFFmpeg 3.0–8.1.2 vf_swaprect OOB write on NV12 odd-width frames causes heap corruptionsecure-packages-26.05Aug 11, 2026Aug 26, 2026Aug 15, 20263 days
Fixed within SLAHighFFmpeg 3.4-8.1.2 vf_floodfill OOB write on dynamic frames with -reinit_filter 0secure-packages-26.05Aug 11, 2026Aug 26, 2026Aug 15, 20263 days
Fixed within SLAHighFFmpeg <=8.1.2 OOB write via crafted ffconcat (-safe 0) in TY demuxersecure-packages-26.05Aug 11, 2026Aug 26, 2026Aug 15, 20263 days
Fixed within SLAHighFFmpeg 2.7–8.1.2 TDSC decoder OOB write on frame dimension changes enables RCEsecure-packages-26.05Aug 11, 2026Aug 26, 2026Aug 15, 20263 days
Fixed within SLAHighHigh severity use-after-free in Aura allows sandbox escape on Chrome Linux <151.0.7922.109secure-packages-rollingAug 12, 2026Aug 27, 2026Aug 14, 20262 days
Fixed within SLAHighUse-after-free in Chrome HTML before 151.0.7922.109 enables remote heap corruptionsecure-packages-rollingAug 12, 2026Aug 27, 2026Aug 14, 20262 days
Fixed within SLAHighUse-after-free in Chrome Views pre-151.0.7922.109 allows remote heap corruption via crafted HTMLsecure-packages-rollingAug 12, 2026Aug 27, 2026Aug 14, 20262 days
Fixed within SLAHighAura use-after-free in Chrome Linux pre-151.0.7922.109 enables sandbox escape via HTML from compromised renderersecure-packages-26.05Aug 12, 2026Aug 27, 2026Aug 14, 20262 days
Fixed within SLAHighUse-after-free in Chrome HTML enables remote heap corruption before 151.0.7922.109secure-packages-26.05Aug 12, 2026Aug 27, 2026Aug 14, 20262 days
Fixed within SLAHighChrome Views use-after-free before 151.0.7922.109 allows heap corruption via crafted HTML and gesturessecure-packages-26.05Aug 12, 2026Aug 27, 2026Aug 14, 20262 days
Fixed within SLAMediumlm90_alert lacks hwmon_lock; race with sysfs re-enables alert, causing interrupt stormsecure-packages-25.11Aug 12, 2026Sep 26, 2026Aug 14, 20262 days
Fixed within SLAMediumiwlwifi mld: Potential NULL pointer dereference in iwl_mld_remove_link storing link->fw_idsecure-packages-25.11Aug 12, 2026Sep 26, 2026Aug 14, 20262 days
Fixed within SLAHighmlx5e XSK: Unprotected ICOSQ IRQ triggering races with NAPI, causing ICOSQ CQE errorssecure-packages-25.11Aug 12, 2026Aug 27, 2026Aug 14, 20262 days
Fixed within SLAMediumMode change race memsetting team->ops leads to NULL deref in team_xmitsecure-packages-25.11Aug 12, 2026Sep 26, 2026Aug 14, 20262 days
Fixed within SLAHighType mismatch in nx_crypto_ctx_exit triggers kernel oops via nx_crypto_ctx_shash_exitsecure-packages-25.11Aug 4, 2026Aug 19, 2026Aug 14, 202610 days
Fixed within SLAHighfbdev omap2: omapfb_mmap use-after-free race with OMAPFB_SETUP_PLANE mapping freed memorysecure-packages-25.11Aug 4, 2026Aug 19, 2026Aug 14, 202610 days
Fixed within SLAMediumMSM DRM recover_worker skips recovery when idle, leaving hung GPU state and repeated timeoutssecure-packages-25.11Aug 4, 2026Sep 18, 2026Aug 14, 202610 days
Fixed within SLAHighf2fs: Race reading nat_entry flags causes incorrect inode dentry mark and fsck inconsistency after checkpointsecure-packages-25.11Aug 4, 2026Aug 19, 2026Aug 14, 202610 days
Fixed within SLAHighFFmpeg vf_quirc heap out-of-bounds write via crafted PGS/SUP with mismatched frame dimensionssecure-packages-25.11Aug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg ≤8.1.2 PNG/APNG encoder eXIf handling causes heap OOB write, crash/RCEsecure-packages-25.11Aug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg ≤8.1.2 MACE6 CAF signed integer overflow causes heap OOB write, RCE risksecure-packages-25.11Aug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg ≤8.1.2 LCL/ZLIB decoder information disclosure: short inflate leaks uninitialized heapsecure-packages-25.11Aug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg ≤8.1.2 IAMF demuxer OOM via crafted count_label causing massive allocation during probingsecure-packages-25.11Aug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg <=8.1.2 vf_hqdn3d heap OOB write on resolution increase with -reinit_filter 0 disabledsecure-packages-25.11Aug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg 3.0–8.1.2 vf_swaprect OOB write with odd-width NV12 frames causes heap corruptionsecure-packages-25.11Aug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg 3.4–8.1.2 OOB write in vf_floodfill with -reinit_filter 0secure-packages-25.11Aug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg <=8.1.2 OOB write processing ffconcat -safe 0 via TY demuxersecure-packages-25.11Aug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg 2.7–8.1.2 TDSC decoder out-of-bounds write via crafted AVI frame dimension changessecure-packages-25.11Aug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighfbdev omap2: omapfb_mmap race with OMAPFB_SETUP_PLANE causes use-after-freesecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 12, 20268 days
Fixed within SLAMediumath11k: memory leaks in beacon template setup error paths (EMA/MBSSID)secure-packages-26.05Jul 27, 2026Sep 10, 2026Aug 12, 202616 days
Fixed within SLAMediumBPF local storage deletion in NMI or reentrant contexts may deadlock via RCU freeingsecure-packages-26.05Jul 27, 2026Sep 10, 2026Aug 12, 202616 days
Fixed within SLAMediummt76 wifi driver memory leak on sta_wed_update/sta_key_tlv failures after skb allocationsecure-packages-26.05Jul 23, 2026Sep 6, 2026Aug 12, 202620 days
Fixed within SLAMediumLinux f2fs data loss when new-file fsync races with checkpoint nat_entry flagssecure-packages-26.05Jul 20, 2026Sep 3, 2026Aug 12, 202623 days
Fixed within SLAMediumLinux kernel af_alg AEAD AD length arithmetic overflow during TX buffer size checksecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 12, 20268 days
Fixed within SLAMediumdrm/ttm: Infinite LRU walk restoring bulk_move after ttm_bo_swapout() swapout failuresecure-packages-26.05Jul 16, 2026Aug 30, 2026Aug 12, 202627 days
Fixed within SLAMediumio_uring zcrx post-open error handling prematurely frees ctx; page pools may persistsecure-packages-26.05Aug 11, 2026Sep 25, 2026Aug 12, 20261 day
Fixed within SLAHighfbdev omap2 omapfb_mmap race with OMAPFB_SETUP_PLANE leads to use-after-freesecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 12, 20268 days
Fixed within SLAMediumLinux wifi ath11k: memory leaks in beacon template setup error paths (EMA/MBSSID)secure-packages-rollingJul 27, 2026Sep 10, 2026Aug 12, 202616 days
Fixed within SLAMediumLinux kernel: Deadlock deleting BPF local storage in NMI due to RCU deferralsecure-packages-rollingJul 27, 2026Sep 10, 2026Aug 12, 202616 days
Fixed within SLAMediumLinux mt76 WiFi driver leaks skb on error path before mt76_mcu_skb_send_msgsecure-packages-rollingJul 23, 2026Sep 6, 2026Aug 12, 202620 days
Fixed within SLAMediumf2fs data loss when fsync of new file races with checkpoint due to nat flagssecure-packages-rollingJul 20, 2026Sep 3, 2026Aug 12, 202623 days
Fixed within SLAMediumLinux kernel af_alg AEAD AD length overflow when checking TX buffer sizesecure-packages-rollingAug 10, 2026Sep 24, 2026Aug 12, 20262 days
Fixed within SLAMediumdrm/ttm: Infinite LRU loop on ttm_bo_swapout when swapout failssecure-packages-rollingJul 16, 2026Aug 30, 2026Aug 12, 202627 days
Fixed within SLAMediumsecure-packages-rollingAug 11, 2026Sep 25, 2026Aug 12, 20261 day