← All tracked CVEs
Updated 10:00
1007 fixed in the last 30 days
| CVE | Status | Severity | Summary | Distribution | Fixed |
|---|---|---|---|---|---|
| Fixed | Medium | Remote info disclosure via SVG in Chrome <154.0.8037.97 through crafted HTML | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Critical | Chrome Windows FileSystem auth bug enables sandbox escape and RCE via crafted HTML page | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | V8 type confusion in Chrome <154.0.8037.97 enables remote sandboxed RCE via crafted HTML | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | Chrome Windows pre-154.0.8037.97: UAF in Contextual Tasks enables sandbox escape RCE | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | Chrome MediaStream use-after-free enables remote code execution in sandbox (pre-154.0.8037.97) | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | Use-after-free in Chrome SVG <154.0.8037.97 enables sandboxed RCE via crafted HTML | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Medium | Chrome pre-154.0.8037.97 Compositing integer overflow enables remote cross-origin data leak via crafted HTML | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Medium | High-severity Chrome WebGPU uninitialized resource allowed cross-origin data exfiltration (pre-154.0.8037.92) | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | PyJWT PyJWKSet fails on malformed RSA JWK, causing authentication failures/DoS before 2.14.0 | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | PyJWT 2.13.x HMAC key guard flaw accepts public JWK, allowing token forgery | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | PyJWT 2.13.0-2.14.0 BOM JWK parsing flaw enables HMAC misuse, token forgery | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | PyJWT 2.4.0–2.13.x: DER public key accepted as HMAC secret enables JWT forgery | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Medium | PyJWT <2.14.0 is_pem_format regex backtracking causes CPU DoS on malformed PEM input | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Medium | PyJWT <2.14.0 signature decoding accepts non-Base64URL chars, causing equivalent-token revocation bypass | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Critical | PyJWT pre-2.14.0 PEM detection bug allows HMAC token forgery with public keys | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Critical | PyJWT <2.14.0 PyJWKClient follows unvalidated JWKS redirects, allowing key substitution and credential disclosure | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Critical | PyJWT 2.13–2.14 HMAC from_jwk skips prepare_key; empty 'k' enables zero-key JWT forgery | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Medium | PyJWT 2.13.x: deeply nested token header triggers unhandled RecursionError, causing HTTP 500 | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | PyJWT pre-2.14.0: unknown kid forces JWKS refresh, enabling outbound request amplification | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Medium | Hugo text/org content renders unescaped HTML, enabling XSS in v0.56.0–v0.165.x | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | Mixed-case URL schemes bypass Hugo security.http.urls IP-literal deny in v0.162–0.165 | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | Hugo v0.123.1–v0.165.x: symlinked mount roots expose external files via themes/modules | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Medium | Stored XSS in Hugo 0.75–0.165.x via unescaped lineAnchors in syntax highlighting | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | Hugo v0.161–0.165 Node permission symlink bypass allows reading files outside project mounts | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Medium | UCSI debugfs entries persist after unregister, causing duplicate directory errors on re-registration | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Medium | iwlwifi: MEI passes q_head instead of cldev to iwl_mei_write_cyclic_buf | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Medium | drm/msm: Retiring hung submit before GPU recovery frees BOs, causing GPU page faults | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Medium | rtl8723bs mgmt xmit_frame/xmit_buf leak on error exhausts TX pools, breaking beacons/responses | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Critical | RDMA/srpt: srpt_alloc_rw_ctxs failure leaves stale counters, dangling rw_ctxs, wrong sq_wr_avail accounting | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | Medium | bpf_refcount field not marked unique in Linux kernel BPF subsystem | secure-packages-rolling | Oct 9, 2026 | |
| Fixed | High | Chrome <155.0.8059.39 Fonts race condition enables sandbox escape RCE via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | High | Chrome Media use-after-free <155.0.8059.39 enables sandboxed RCE via crafted HTML page | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | High | Use-after-free in Chrome PDF pre-155.0.8059.39 enables sandboxed RCE via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Chrome Windows pre-155.0.8059.39 API miscalculation enables remote UI spoofing via crafted extension | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Critical | Use-after-free in ANGLE allows remote code execution outside sandbox in Chrome Android <155.0.8059.39 | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Critical | Chrome <155.0.8059.39 Media integer overflow enables remote code execution outside sandbox via HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Chrome <155.0.8059.39 extension code injection enables remote UI spoofing via social engineering | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Remote information leak in Chrome Enterprise before 155.0.8059.39 via crafted HTML page | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Critical | Chrome iOS before 155.0.8059.39 improper input validation enables sandbox escape RCE | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Race condition allows UI spoofing via compromised renderer in Chrome <155.0.8059.39 | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | High | Chrome macOS <155.0.8059.39 Core race enables sandbox escape RCE via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | High | Chrome <155.0.8059.39 Parser use-after-free enables sandboxed RCE via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Chrome <155.0.8059.39 permissions auth flaw lets compromised renderers spoof UI via HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | High | Incorrect reference resolution in WebAppInstalls enables sandbox-escape RCE on Mac Chrome pre-155.0.8059.39 | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Missing authorization in Chrome iOS <155.0.8059.39 enables remote UI spoofing via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Incorrect authorization in Chrome Extensions allowed UI spoofing via crafted extension (pre-155.0.8059.39) | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Critical | Chrome Media out-of-bounds write enables sandbox-escape RCE via crafted HTML (prior to 155.0.8059.39, Medium severity) | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Clickjacking in Chrome Android Messages before 155.0.8059.39 enables UI spoofing via crafted HTML | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Chrome Media authorization flaw leaks cross-origin data via crafted HTML (pre-155.0.8059.39) | secure-packages-26.05 | Oct 9, 2026 | |
| Fixed | Medium | Chrome <155.0.8059.39 Glic cleanup bug leaks cross-origin data via crafted HTML | secure-packages-26.05 | Oct 9, 2026 |