← All tracked CVEs
Updated 07:01
972 in progress
| CVE | Status | Severity | Summary | Distribution |
|---|---|---|---|---|
| In progress | High | virtualenv <21.7.12 Windows activation yields command injection via attacker-controlled prompt | secure-packages-rolling | |
| In progress | High | virtualenv pre-21.7.12 cmd.exe prompt injection via activate.bat enables arbitrary command execution | secure-packages-26.05 | |
| In progress | High | virtualenv pre-21.7.12 Windows prompt quote handling allows activation command injection | secure-packages-25.11 | |
| In progress | Medium | virtualenv pre-21.7.11 prompt injection alters pyvenv.cfg keys, hijacking base interpreter | secure-packages-rolling | |
| In progress | Medium | virtualenv <=21.7.10 prompt injection allows pyvenv.cfg key spoofing, base interpreter hijack | secure-packages-26.05 | |
| In progress | Medium | virtualenv pre-21.7.11 pyvenv.cfg injection via prompt enables base interpreter hijack | secure-packages-25.11 | |
| In progress | Medium | Mako Windows path mismatch allows directory traversal, file disclosure via attacker-controlled template URIs pre-1.4.2 | secure-packages-rolling | |
| In progress | Medium | Mako <1.4.2 Windows path traversal via posixpath/ntpath mismatch enables file disclosure, template execution | secure-packages-26.05 | |
| In progress | High | pypdf _page_labels.py DoS via oversized Roman page labels causing memory exhaustion | secure-packages-26.05 | |
| In progress | High | pypdf <6.18.0 DoS via long indirect-object/generation-number tokens without whitespace | secure-packages-26.05 | |
| In progress | High | pypdf pre-6.18.1 /ToUnicode oversized tokens in parse_bfchar cause memory exhaustion | secure-packages-26.05 | |
| In progress | High | pypdf <6.18.1 excessive memory from oversized simple font /Widths during text extraction | secure-packages-26.05 | |
| In progress | High | pypdf <6.18.1 DoS via padded malformed FlateDecode triggering inefficient bytewise decompression | secure-packages-26.05 | |
| In progress | High | pypdf <6.19.0: crafted form fields with flattening trigger appearance-stream loop DoS | secure-packages-26.05 | |
| In progress | High | pypdf <6.19.0 attachment lookups reparse full embedded-file list, causing long runtimes | secure-packages-26.05 | |
| In progress | High | pypdf pre-6.19.0: crafted PDFs cause unbounded page-label strings, leading to memory exhaustion | secure-packages-26.05 | |
| In progress | Medium | PyJWT 2.11–2.13 options mutation persists disabled claim validation after verify_signature false | secure-packages-26.05 | |
| In progress | High | Jinja2 template injection in fsspec ReferenceFileSystem enables RCE via Kerchunk reference JSON | secure-packages-26.05 | |
| In progress | Medium | multidict C items-view union/subtraction leak references, causing unbounded memory growth (6.7–6.9.1) | secure-packages-rolling | |
| In progress | Medium | Multidict C extension items-view union/subtraction reference leak causes unbounded memory DoS (6.7.0–6.9.1) | secure-packages-26.05 | |
| In progress | Medium | Chrome <155.0.8059.39 WebAppInstalls UI misrepresentation enables remote UI spoofing via crafted HTML (Low severity) | secure-packages-rolling | |
| In progress | Low | Animation timing side-channel in Chrome <155.0.8059.39 leaks cross-origin data | secure-packages-rolling | |
| In progress | Medium | DevTools reference resolution bug exposes sensitive data via crafted HTML in compromised renderer | secure-packages-rolling | |
| In progress | Medium | Chrome <155.0.8059.39 Paint UI misrepresentation allows remote UI spoofing via crafted HTML | secure-packages-rolling | |
| In progress | Medium | Missing authorization in Chrome Chromoting on Windows pre-155.0.8059.39 enables remote info disclosure | secure-packages-rolling | |
| In progress | Medium | Chrome <155.0.8059.39 Media uninitialized resource enabled remote cross-origin data leak via crafted HTML | secure-packages-rolling | |
| In progress | Medium | Chrome <155.0.8059.39 Viz input validation allows compromised renderer to bypass system access via crafted HTML | secure-packages-rolling | |
| In progress | High | Chrome Windows CredentialProvider uncontrolled search path enables local code execution outside sandbox pre-155.0.8059.39 | secure-packages-rolling | |
| In progress | Medium | Missing authorization in Chrome Permissions pre-155.0.8059.39 allows compromised renderer to spoof UI | secure-packages-rolling | |
| In progress | High | Confused deputy in Android Chrome SignIn pre-155.0.8059.39 enables remote privileged page access | secure-packages-rolling | |
| In progress | High | iOS Chrome Reader Mode code injection enables origin policy bypass via crafted HTML pre-155.0.8059.39 | secure-packages-rolling | |
| In progress | High | Chrome Media use-after-free enables sandboxed RCE via crafted HTML prior to 155.0.8059.39 | secure-packages-rolling | |
| In progress | High | Missing Actor authorization allows sandbox escape via crafted HTML in Chrome <155.0.8059.39 | secure-packages-rolling | |
| In progress | Medium | Chrome iOS <155.0.8059.39 local physical-access information leak vulnerability | secure-packages-rolling | |
| In progress | High | Chrome Parser use-after-free allows sandboxed RCE via crafted HTML prior to 155.0.8059.39 | secure-packages-rolling | |
| In progress | High | Missing authorization in Chrome WebAppInstalls enables sandbox escape RCE via crafted HTML pre-155.0.8059.39 | secure-packages-rolling | |
| In progress | Critical | Chromoting authorization bug in Mac Chrome allowed remote system access bypass via crafted traffic pre-155.0.8059.39 | secure-packages-rolling | |
| In progress | High | iOS Chrome pre-155.0.8059.39 missing navigation authorization enables origin bypass via crafted HTML to privileged page | secure-packages-rolling | |
| In progress | Critical | Critical Chrome Browser use-after-free allows RCE outside sandbox pre-155.0.8059.39 via crafted HTML | secure-packages-rolling | |
| In progress | High | Chrome <155.0.8059.39 FileSystem auth flaw enables renderer-compromised web origin policy bypass via crafted HTML page | secure-packages-rolling | |
| In progress | High | Chrome Android <155.0.8059.39 Actor auth bug allows compromised renderer to bypass site isolation | secure-packages-rolling | |
| In progress | High | Use-after-free in Chrome Track pre-155.0.8059.39 allows sandboxed RCE via crafted HTML | secure-packages-rolling | |
| In progress | High | V8 race condition in Chrome pre-155.0.8059.39 allows remote sandboxed code execution via crafted HTML | secure-packages-rolling | |
| In progress | Medium | Chrome Windows ANGLE uninitialized resource enables remote out-of-sandbox memory read via crafted HTML | secure-packages-rolling | |
| In progress | High | Pre-155.0.8059.39 Chrome for iOS Autofill cleanup flaw enabled exfiltration via socially engineered HTML | secure-packages-rolling | |
| In progress | High | Use-after-free in Chrome PDF allows sandboxed RCE before 155.0.8059.39 | secure-packages-rolling | |
| In progress | High | Android Chrome <155.0.8059.39 Passwords auth flaw allows site isolation bypass after renderer compromise | secure-packages-rolling | |
| In progress | Medium | iOS Chrome <155.0.8059.39 input validation flaw leaks data via crafted network traffic | secure-packages-rolling | |
| In progress | High | V8 race condition in Chrome <155.0.8059.39 enables remote code execution in renderer sandbox via HTML | secure-packages-rolling | |
| In progress | Medium | Chrome <155.0.8059.39 API authorization bug leaks data via crafted extension, social engineering | secure-packages-rolling |