← All tracked CVEs
Updated 15:01
972 in progress
| CVE | Status | Severity | Summary | Distribution |
|---|---|---|---|---|
| In progress | Medium | Linux ksmbd: tree connection leak on ksmbd_iov_pin_rsp failure in smb2_tree_connect | secure-packages-25.11 | |
| In progress | Medium | smb2_tree_connect leaks tree connection when ksmbd_iov_pin_rsp fails; missing disconnect | secure-packages-26.05 | |
| In progress | Medium | ksmbd: tree connection leak when ksmbd_iov_pin_rsp fails in smb2_tree_connect | secure-packages-rolling | |
| In progress | High | Linux cgroup iterators reference zero-refcount dying tasks, causing use-after-free race | secure-packages-25.11 | |
| In progress | High | cgroup iterator race resurrects zero-refcount tasks, triggering Linux kernel use-after-free | secure-packages-26.05 | |
| In progress | High | Hugging Face Transformers <=5.8.0.dev0 path traversal arbitrary file write via chat_template in save_pretrained | secure-packages-26.05 | |
| In progress | High | GHSA-rpj2-4hq8-938g: vcrpy loads cassettes with unsafe PyYAML Loader, enabling arbitrary code execution on load | secure-packages-26.05 | |
| In progress | High | GHSA-x9r9-c232-4q39: Hugging Face Transformers load_custom_generate writes remote Python before trust check, persisting unauthorized disk cache (v4.49–5.8.1) | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-2109: AIOHTTP pre-3.14.1 DigestAuthMiddleware sends auth digest after cross-origin redirect | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-2323: Zeep <4.3.3 ignores forbid_external; SSRF via WSDL/XSD imports and DTDs | secure-packages-26.05 | |
| In progress | High | GHSA-63hw-fmq6-xxg2: aiohttp C HTTP parser max_line_size bypass allows oversized lines causing memory DoS | secure-packages-26.05 | |
| In progress | Medium | GHSA-9x8q-7h8h-wcw9: aiohttp payload resources leak when client disconnects mid-write, causing temporary resource starvation | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-4183: PyJWT <2.15.0 OKP private JWK x/d mismatch enables sender-constrained token misuse | secure-packages-26.05 | |
| In progress | High | GHSA-p58f-9548-mpm2: virtualenv bash/zsh and fish activate scripts double-quote shlex.quote, enabling path-based command injection | secure-packages-rolling | |
| In progress | High | GHSA-x78j-v8h9-3j2q: virtualenv Windows activate.bat executes arbitrary commands from unescaped prompt input | secure-packages-rolling | |
| In progress | Medium | GHSA-qwm4-qh6w-59xr: pip mishandles doubly-encoded package URLs, enabling arbitrary file writes via malicious indexes during wheel installs | secure-packages-rolling | |
| In progress | High | GHSA-94p9-xgh2-xp45: No sha256 verification for network-fetched wheels; virtualenv may cache and seed tampered wheels | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-3943: WebOb Location normalization allows off-host redirects via leading space/C0 control stripping mismatch | secure-packages-rolling | |
| In progress | Medium | GHSA-x33g-cr3x-6449: PyJWT accepts inconsistent OKP JWKs: mismatched x and d allow DPoP binding bypass | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-4141: PyJWT deeply nested payload triggers uncaught RecursionError pre-verification, causing request-level DoS | secure-packages-rolling | |
| In progress | High | PYSEC-2026-4183: PyJWT 2.1.0–2.15.0 OKPAlgorithm.from_jwk x/d mismatch enables stolen token misuse | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-3721: pip arbitrary file write via doubly-encoded index URLs, affecting --only-binary wheel downloads | secure-packages-rolling | |
| In progress | Medium | GHSA-6hr6-w5qg-qmwg: h2 <=4.4.0 forwards multiple Host headers, enabling HTTP/1.1 downgrade request smuggling | secure-packages-rolling | |
| In progress | High | PYSEC-2026-4013: Double-quoted shlex placeholders in activate/activate.fish allow execution via path metacharacters | secure-packages-rolling | |
| In progress | Medium | GHSA-9h9j-4vrj-gf7g: Newline injection via virtualenv prompt overrides pyvenv.cfg home and interpreter metadata | secure-packages-rolling | |
| In progress | Medium | GHSA-42vr-xj54-vc7v: Deeply nested JWT JSON payload triggers uncaught RecursionError pre-verification, causing DoS in PyJWT 2.x | secure-packages-rolling | |
| In progress | Critical | PYSEC-2026-132: SimpleEval pre-1.0.5 allows dangerous module access via object attributes and callbacks | secure-packages-rolling | |
| In progress | Critical | GHSA-44vg-5wv2-h2hg: SimpleEval allows access to os/sys via attribute chains on passed names and callbacks | secure-packages-rolling | |
| In progress | High | GHSA-c3jg-qh8m-j3h2: CairoSVG path parsing and marker handling are O(n^2), enabling DoS on large SVGs | secure-packages-rolling | |
| In progress | High | GHSA-mpf4-983q-p7j4: Tornado urlencoded parsing without max_num_fields allows single-request event-loop DoS | secure-packages-rolling | |
| In progress | Medium | GHSA-3hv7-mjh2-fv65: HTTPServerRequest query parsing missing field-count limit; enables DoS via many query parameters. | secure-packages-rolling | |
| In progress | High | GHSA-c2m8-h5v5-343r: Tornado StaticFileHandler symlink traversal allows unauthenticated arbitrary file read via symlinks in static root | secure-packages-rolling | |
| In progress | High | PYSEC-2026-3928: parse_qs without max_num_fields stalls Tornado event loop with massive form fields | secure-packages-rolling | |
| In progress | High | GHSA-chx6-46f5-w4vp: Unbounded decompressed response accumulation in Tornado CurlAsyncHTTPClient triggers OOM DoS | secure-packages-rolling | |
| In progress | High | PYSEC-2026-3785: GitPython <3.1.59 exposes sensitive files via .gitmodules [include] when accessing repo.submodules | secure-packages-rolling | |
| In progress | Medium | GHSA-6hx8-3wjj-gr8g: WebOb open redirect: leading whitespace/C0 controls bypass guards; urljoin strips, off-host redirects | secure-packages-rolling | |
| In progress | Medium | GHSA-8423-8fgw-73vq: parse_multipart_form_data splits before max_parts check, causing pre-auth memory amplification DoS | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-3628: h2 <=4.4.0 forwards multiple Host headers; HTTP/2 to HTTP/1.1 downgrade enables request smuggling | secure-packages-rolling | |
| In progress | High | GHSA-7833-fr7j-v32q: GitPython repo.submodules reads .gitmodules includes, leaking arbitrary local file first line via exception | secure-packages-rolling | |
| In progress | High | PYSEC-2026-3984: Regex DoS in GitPython <3.1.60 parsing malformed commit author with unterminated bracket | secure-packages-rolling | |
| In progress | Medium | GHSA-379c-qx7v-6h59: Path traversal in folder-based dataset builders via unvalidated file_name, allowing arbitrary file reads through v5.0.0 | secure-packages-rolling | |
| In progress | High | PYSEC-2026-3788: GitPython <3.1.59 unsafe_git_revision_options omits --contents/-S, enabling arbitrary file read via Repo.blame | secure-packages-rolling | |
| In progress | Medium | GHSA-hj66-6f7g-4r5v: oauthlib RevocationEndpoint JSONP callback unvalidated enables arbitrary JavaScript injection in responses | secure-packages-rolling | |
| In progress | Medium | GHSA-5639-2j2p-m4mx: Windows: Drive-letter URIs bypass Mako TemplateLookup directory traversal guard; arbitrary file read | secure-packages-rolling | |
| In progress | Critical | GHSA-284h-m62q-gf8w: GitPython writer splits decoded multiline config into new directive, enabling core.hooksPath RCE | secure-packages-rolling | |
| In progress | Medium | GHSA-4xgf-cpjx-pc3j: pydantic-settings NestedSecretsSettingsSource follows symlinks, allowing out-of-tree reads and size cap bypass | secure-packages-rolling | |
| In progress | Medium | GHSA-59cr-6r3x-644w: GitPython 3.1.61: Submodule.update() uses unchecked .gitmodules path, enabling repository escape | secure-packages-rolling | |
| In progress | Medium | GHSA-5xxx-qhh7-9287: GitPython Repo.blame option gap allows arbitrary local file read via --contents/-S | secure-packages-rolling | |
| In progress | High | PYSEC-2026-3982: GitPython <3.1.60 gitdir spoofing enables malicious pre-commit hook execution on index.commit() | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-4113: oauthlib RevocationEndpoint JSONP reflects unsanitized callback, enabling arbitrary JavaScript injection | secure-packages-rolling |