← All tracked CVEs
Updated 16:00
972 in progress
| CVE | Status | Severity | Summary | Distribution |
|---|---|---|---|---|
| In progress | High | PYSEC-2026-3787: GitPython <3.1.59 allows --separate-git-dir abuse, arbitrary directory creation and hook execution | secure-packages-rolling | |
| In progress | High | GHSA-g5vv-9gxw-82hx: GitPython catastrophic backtracking ReDoS in Actor.name_email_regex on malformed author header | secure-packages-rolling | |
| In progress | Medium | GHSA-xpv3-w29h-x7cv: oauthlib PKCE timing side-channel: code_challenge_method_plain uses == for verifier comparison | secure-packages-rolling | |
| In progress | High | GHSA-xf7x-x43h-rpqh: SchemaRepairer.resolve_schema circular $ref causes unbounded CPU loop DoS | secure-packages-rolling | |
| In progress | High | GHSA-8mcc-hrx5-hvxc: GitPython clone options denylist omits --separate-git-dir, enabling .git escape to arbitrary path | secure-packages-rolling | |
| In progress | High | PYSEC-2026-3804: Hugging Face Accelerate <=1.14.0 path traversal in checkpoint loading enables arbitrary file read, DoS | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-3716: Arbitrary file read via path traversal in Datasets <=5.0.0 folder-based builders | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-3837: GitPython TagReference.create positional reference bypasses unsafe-option guard; arbitrary file read | secure-packages-rolling | |
| In progress | Medium | GHSA-3wxw-xv34-2frg: GitPython TagReference.create positional reference bypasses unsafe guard enabling arbitrary file read | secure-packages-rolling | |
| In progress | High | GHSA-4j2p-28q2-5m79: Hugging Face Accelerate ≤1.14.0 path traversal via weight_map enables arbitrary file read, DoS via pipes | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-4114: OAuthlib PKCE verifier comparison uses '==' causing timing side-channel in authorization code flow | secure-packages-rolling | |
| In progress | Low | GHSA-wwv5-g3v4-889x: Tornado set_cookie kwargs capitalization regression bypasses validation, enabling cookie attribute injection | secure-packages-rolling | |
| In progress | Medium | GHSA-54p9-h82j-f925: multidict 6.7–6.9 C items-view union/subtraction ref leak allows remote unreclaimable memory growth | secure-packages-rolling | |
| In progress | Critical | PYSEC-2026-3786: GitPython <3.1.59 config write corrupts multi-line values, enabling directive injection and RCE via hooks | secure-packages-rolling | |
| In progress | Low | GHSA-g98v-hv3f-hcfr: Windows: atty may dereference unaligned pointer; crate unmaintained with stale fix PR | secure-packages-25.11 | |
| In progress | Medium | GHSA-q445-7m23-qrmw: MemBio::get_buf passed null pointer to slice::from_raw_parts, causing UB and debug assertions. | secure-packages-25.11 | |
| In progress | Low | GHSA-mj6p-44ch-cq69: uutils mkdir -m sets mode via chmod after creation, briefly exposing umask perms to others | secure-packages-25.11 | |
| In progress | Medium | GHSA-p52g-cm5j-mjv4: OpenSSL RSA decryption timing leak enables remote Bleichenbacher attack recovering TLS pre-master secrets | secure-packages-25.11 | |
| In progress | Medium | RUSTSEC-2026-0045: Timing side-channel in AWS-LC EVP AES-CCM decryption leaks tag validity | secure-packages-26.05 | |
| In progress | Low | GHSA-2w8r-9xj7-69j5: uutils mktemp mishandles empty TMPDIR, uses CWD instead of /tmp, risking data exposure | secure-packages-25.11 | |
| In progress | Low | GHSA-4q83-7cq4-p6wg: Tokio ReadHalf::unsplit violates Pin contract causing soundness bug under io-util with !Unpin | secure-packages-25.11 | |
| In progress | Medium | GHSA-3v7f-55p6-f55p: picomatch POSIX_REGEX_SOURCE method injection allows malformed POSIX classes to alter glob matching | secure-packages-26.05 | |
| In progress | Medium | GHSA-434x-w66g-qw3r: Unchecked overflow in BytesMut::reserve corrupts capacity, causing OOB UB in release builds | secure-packages-26.05 | |
| In progress | Low | GHSA-xgp8-3hg3-c2mh: Wildcard DNS names bypass permitted subtree checks in X.509 name constraints | secure-packages-26.05 | |
| In progress | Medium | GHSA-chgr-c6px-7xpp: PyCFunction::new_closure lacks Sync bound, enabling data races under free-threaded or concurrent Python execution | secure-packages-25.11 | |
| In progress | Medium | GHSA-2frx-2596-x5r6: gitoxide uses SHA-1 without collision detection, enabling collision attacks and breaking Git object integrity | secure-packages-25.11 | |
| In progress | Low | GHSA-8fgc-7cc6-rx7x: Webpack buildHttp allowedUris bypass via userinfo, enabling build-time SSRF and untrusted content inclusion | secure-packages-25.11 | |
| In progress | Medium | GHSA-hhw4-xg65-fp2x: serde_yml::ser::Serializer.emitter unsound; can cause segfault; crate archived | secure-packages-25.11 | |
| In progress | Medium | RUSTSEC-2026-0067: tar-rs ≤0.4.44 unpack_dir symlink bug allows chmod of directories outside extraction root | secure-packages-26.05 | |
| In progress | Medium | GHSA-xx64-wwv2-hcqq: astral-tokio-tar <=0.6.0 unpack_in can change permissions of directories outside archive | secure-packages-26.05 | |
| In progress | Low | GHSA-cq8v-f236-94qc: rand unsound: reentrant ThreadRng in custom logger triggers UB via aliased mutable borrow | secure-packages-26.05 | |
| In progress | Low | GHSA-965h-392x-2mh5: Library ignores URI name constraints; restricted certificates accepted; exploit requires misissuance after signature verification. | secure-packages-25.11 | |
| In progress | Medium | GHSA-7gcf-g7xr-8hxj: serde_with KeyValueMap serializer panics on empty entry due to len-1 preallocation | secure-packages-26.05 | |
| In progress | Medium | GHSA-3cv2-h65g-fgmm: astral-tokio-tar pre-0.6.2 misapplies PAX headers, desynchronizing streams and enabling smuggled files | secure-packages-26.05 | |
| In progress | Medium | GHSA-qx2v-qp2m-jg93: PostCSS v8.5.5 doesn't escape </style> when stringifying, enabling XSS in <style> tags | secure-packages-26.05 | |
| In progress | Medium | GHSA-mh29-5h37-fv8m: Prototype pollution in js-yaml <4.1.1/3.14.2 when parsing untrusted YAML | secure-packages-26.05 | |
| In progress | Low | GHSA-xgp8-3hg3-c2mh: Wildcard DNS SANs bypass permitted subtree NameConstraints in X.509 certificate validation | secure-packages-25.11 | |
| In progress | Medium | GHSA-w9m9-85wc-3x92: Uncontrolled recursion in postcss-selector-parser AST toString leads remote DoS (pre-6.1.3/7.1.1) | secure-packages-26.05 | |
| In progress | Medium | GHSA-2vh6-hw4j-32ww: gix-packetline panics on empty side-band payload enabling pre-auth remote DoS | secure-packages-26.05 | |
| In progress | Medium | GHSA-4gg8-gxpx-9rph: uv <0.11.15 writes entry point executables outside env, enabling PATH hijack and code execution | secure-packages-25.11 | |
| In progress | Medium | GHSA-6gx3-4362-rf54: Malformed PAX extensions skipped in astral-tokio-tar <=0.5.6, enabling parser differential attacks | secure-packages-26.05 | |
| In progress | Medium | RUSTSEC-2026-0067: tar-rs <=0.4.44 unpack_dir symlink bug allows chmod outside extraction root | secure-packages-25.11 | |
| In progress | Medium | GHSA-p52g-cm5j-mjv4: OpenSSL RSA decryption timing leak enables remote Bleichenbacher attack recovering TLS pre-master secrets | secure-packages-25.11 | |
| In progress | Medium | GHSA-h395-gr6q-cpjc: jsonwebtoken 10.2.0: FailedToParse treated as NotPresent lets string nbf/exp bypass validation | secure-packages-26.05 | |
| In progress | Medium | GHSA-qj8w-gfj5-8c6v: serialize-javascript DoS: CPU exhaustion when serializing crafted array-like object with huge length | secure-packages-26.05 | |
| In progress | Medium | GHSA-9857-6mw7-fq2m: gitoxide gix-transport curl backend leaks credentials after redirect due to original-URL auth check | secure-packages-26.05 | |
| In progress | Medium | GHSA-7rrj-xr53-82p7: pipe_mode call resets reject_remote_clients in Tokio Windows named pipes, allowing remote clients | secure-packages-25.11 | |
| In progress | Medium | GHSA-6gx3-4362-rf54: astral-tokio-tar <=0.5.6 silently skips malformed PAX extensions, enabling parser differentials | secure-packages-25.11 | |
| In progress | Medium | GHSA-rr8g-9fpq-6wmg: Broadcast channel clones with only Send bound, causing unsoundness for Send + !Sync Clone types | secure-packages-26.05 | |
| In progress | Low | GHSA-mj6p-44ch-cq69: uutils mkdir -m sets mode via chmod after creation, briefly exposing umask perms to others | secure-packages-25.11 |