← All tracked CVEs
Updated 13:01
972 in progress
| CVE | Status | Severity | Summary | Distribution |
|---|---|---|---|---|
| In progress | High | FFmpeg 3.4-8.1.2 vf_floodfill OOB write with -reinit_filter 0, heap corruption | secure-packages-rolling | |
| In progress | High | FFmpeg 3.0-8.1.2 vf_swaprect OOB write on odd-width NV12 frames causing heap corruption | secure-packages-rolling | |
| In progress | High | Out-of-bounds heap read in PyTorch torchvision GIF decoder enables DoS/info leak (≤0.28.0) | secure-packages-rolling | |
| In progress | Medium | Hugging Face Datasets ≤5.0.0 path traversal via file_name allows arbitrary file exposure | secure-packages-rolling | |
| In progress | Medium | Directory traversal in folder-based dataset builders via file_name leaks local files on save/push | secure-packages-26.05 | |
| In progress | High | FFmpeg ≤8.1.2 vf_hqdn3d heap OOB write when -reinit_filter 0 and resolution increases | secure-packages-rolling | |
| In progress | High | FFmpeg ≤8.1.2 IAMF demuxer uncontrolled allocation from 17-byte input via count_label | secure-packages-rolling | |
| In progress | High | FFmpeg up to 8.1.2 LCL/ZLIB decoder leaks uninitialized heap; short inflate enables ASLR bypass | secure-packages-rolling | |
| In progress | High | FFmpeg <=8.1.2 MACE6 CAF bytes_per_packet integer overflow causes heap OOB write, RCE | secure-packages-rolling | |
| In progress | High | Heap out-of-bounds write in FFmpeg PNG/APNG encoder eXIf handling (≤8.1.2) | secure-packages-rolling | |
| In progress | High | FFmpeg 7.0–8.1.2 vf_quirc heap OOB write via crafted PGS/SUP subtitles mismatched dimensions | secure-packages-rolling | |
| In progress | Medium | Apache Thrift Python bindings: improper TLS certificate host mismatch validation vulnerability before 0.24.0 | secure-packages-rolling | |
| In progress | Critical | import_module_class logic flaw bypasses trust_remote_code in sentence-transformers, enabling local RCE | secure-packages-26.05 | |
| In progress | High | Hugging Face Accelerate ≤1.14.0 path traversal in checkpoint loading allows file read/DoS | secure-packages-rolling | |
| In progress | High | Accelerate ≤1.14.0 path traversal in load_checkpoint_* via unsanitized weight_map enables file read/DoS | secure-packages-26.05 | |
| In progress | Medium | AIOHTTP pre-3.14.2 WebSocket upgrade request smuggling from premature protocol switch with body | secure-packages-26.05 | |
| In progress | High | AIOHTTP pre-3.14.3 heap out-of-bounds read DoS via malformed responses in C parser | secure-packages-26.05 | |
| In progress | High | cryptography pkcs7_decrypt* side-channel enables Bleichenbacher oracle via error/timing distinctions (44.0.0-49.x) | secure-packages-26.05 | |
| In progress | Medium | cryptography 45–48: wildcard SAN bypasses DNS name constraints; invalid certificates accepted | secure-packages-26.05 | |
| In progress | High | Duplicate self-signed certs trigger exponential chain recursion DoS in python-cryptography 42–48 | secure-packages-26.05 | |
| In progress | High | FFmpeg <9.0 DVB subtitle parser signed integer overflow via WTV causes heap overflow | secure-packages-rolling | |
| In progress | Medium | FFmpeg 3.0–<9.0 RSCC decoder uninitialized heap read leaks memory on undersized tile decompression | secure-packages-rolling | |
| In progress | Medium | Uninitialized heap read in FFmpeg Screenpresso decoder leaks memory via incomplete zlib output (3.0–<9.0) | secure-packages-rolling | |
| In progress | Medium | FFmpeg <9.0 TIFF decoder uninitialized heap memory disclosure via tiff_unpack_zlib memcpy | secure-packages-rolling | |
| In progress | High | FFmpeg <9.0 CFHD decoder OOB heap write via crafted AVI during probing, RCE | secure-packages-rolling | |
| In progress | High | sqlparse pre-0.6.0 quadratic CPU in parse()/format(strip_comments) from group_comments rescans | secure-packages-rolling | |
| In progress | Medium | h2 <=4.4.0 forwards duplicate Host headers, enabling HTTP/1.1 downgrade request smuggling | secure-packages-rolling | |
| In progress | Medium | Duplicate Host headers in h2 up to 4.4.0 enable HTTP/1.1 request smuggling | secure-packages-26.05 | |
| In progress | High | OpenSSL TLS server SSL_set_SSL_CTX() mid-handshake OOB read/write with differing provider sigalgs, DoS | secure-packages-26.05 | |
| In progress | High | OpenSSL TLS server SSL_set_SSL_CTX switch causes OOB read/write when provider sigalgs differ | secure-packages-rolling | |
| In progress | High | JupyterLab ImageViewer SVG blob URL bug allows XSS, server code execution (pre-4.5.10/4.6.2) | secure-packages-26.05 | |
| In progress | Medium | JupyterLab PyPI extension manager blocklist bypass via weak package-name normalization (4.5.0–4.6.1) | secure-packages-26.05 | |
| In progress | High | JupyterLab overrides.json margin settings not validated, enabling code execution via malicious settings import | secure-packages-26.05 | |
| In progress | Medium | Heap OOB read/write and leak via FUJIFILM strd underflow in GStreamer avidemux | secure-packages-25.11 | |
| In progress | Medium | OpenSSL QUIC ignores connection-level flow control; remote peers can force ~100MB memory per connection | secure-packages-26.05 | |
| In progress | Medium | OpenSSL QUIC lacks connection flow control, allowing 100MB per-connection memory exhaustion via streams | secure-packages-rolling | |
| In progress | Medium | OpenSSL CMP client NULL dereference on crafted revocation response with PKCS#10 CSR, DoS | secure-packages-26.05 | |
| In progress | Medium | OpenSSL CMP client NULL pointer dereference on PKCS#10 CSR revocation response causes DoS | secure-packages-rolling | |
| In progress | Medium | DTLS 1.2 AEAD improper length validation allows unauthenticated DoS via short record | secure-packages-rolling | |
| In progress | Medium | DTLS 1.2 AEAD short record causes unauthenticated DoS due to length validation bug | secure-packages-26.05 | |
| In progress | High | Mistune 3.3.0–3.3.2 DoS via nested emphasis causes RecursionError in HTMLRenderer | secure-packages-26.05 | |
| In progress | Low | SM2 signature generation timing leak from non-constant-time operations on secret nonce and private key | secure-packages-26.05 | |
| In progress | Low | SM2 signature generation timing side-channel from non-constant-time secret nonce/private key operations | secure-packages-rolling | |
| In progress | High | GitPython <3.1.59 local file disclosure via .gitmodules include parsing error | secure-packages-rolling | |
| In progress | Critical | GitPython <3.1.59 mis-serializes multi-line config, activating injected directives and RCE | secure-packages-rolling | |
| In progress | High | Omission of --separate-git-dir in GitPython <3.1.59 enables arbitrary dir creation, hook execution | secure-packages-rolling | |
| In progress | High | GitPython <3.1.59 denylist omission allows arbitrary file read via Repo.blame --contents/-S | secure-packages-rolling | |
| In progress | High | GitPython <3.1.59 TagReference.create() arbitrary file read via positional --file reference bypass | secure-packages-rolling | |
| In progress | High | Nokogiri <1.19.3 ReDoS in CSS selector tokenizer affecting Node#css/at_css/search | secure-packages-rolling | |
| In progress | Medium | Nokogiri <1.19.3 XSLT Stylesheet transform null-byte parameter memory leak enables DoS | secure-packages-rolling |