← All tracked CVEs
Updated 11:00
972 in progress
| CVE | Status | Severity | Summary | Distribution |
|---|---|---|---|---|
| In progress | High | Integer overflow/wraparound in Apache Thrift Go TFramedTransport before 0.23.0 | secure-packages-rolling | |
| In progress | High | Out-of-bounds read vulnerability in Apache Thrift versions before 0.23.0 | secure-packages-rolling | |
| In progress | High | Integer overflow/wraparound vulnerability in Apache Thrift versions prior to 0.23.0 | secure-packages-rolling | |
| In progress | Medium | Uncontrolled recursion vulnerability in Apache Thrift versions prior to 0.23.0 | secure-packages-rolling | |
| In progress | Medium | Out-of-bounds read vulnerability in Apache Thrift before 0.23.0 | secure-packages-rolling | |
| In progress | High | Apache Thrift Python pre-0.24.0 data amplification vulnerability with highly compressed data | secure-packages-rolling | |
| In progress | High | Uncontrolled recursion vulnerability in Apache Thrift Node.js bindings prior to 0.23.0 | secure-packages-rolling | |
| In progress | Medium | OpenSSL QUIC stream reassembly O(n^2) under out-of-order packets enables CPU DoS | secure-packages-26.05 | |
| In progress | Medium | OpenSSL QUIC out-of-order stream reassembly has quadratic complexity, enabling low-bandwidth CPU DoS | secure-packages-rolling | |
| In progress | Medium | Memory allocation excessive size vulnerability in Apache Thrift before 0.23.0 | secure-packages-rolling | |
| In progress | High | Apache Thrift before 0.23.0: improper TLS certificate host mismatch validation | secure-packages-rolling | |
| In progress | High | Multiple vulnerabilities in Apache Thrift before 0.23.0: origin validation, path traversal, CRLF, DoS. | secure-packages-rolling | |
| In progress | High | Infinite loop vulnerability in Apache Thrift Python/Go/PHP/Java bindings before 0.24.0 | secure-packages-rolling | |
| In progress | High | Windows backslash traversal bypass in Mako <1.3.12 enables reading files outside template dir | secure-packages-26.05 | |
| In progress | Low | Paramiko <=4.0.0 pre-a448945 rsakey.py permits insecure SHA-1 algorithm | secure-packages-26.05 | |
| In progress | Low | Paramiko ≤4.0.0 (pre-a448945) rsakey.py allows weak SHA-1 algorithm | secure-packages-25.11 | |
| In progress | Medium | ONNX convert_version null pointer DoS on zero-input Upsample node before 1.22.0 | secure-packages-rolling | |
| In progress | Medium | Null pointer dereference DoS in ONNX convert_version handling zero-input Upsample node | secure-packages-26.05 | |
| In progress | Medium | WebOb <1.8.10 open redirect via Location normalization; control chars bypass CVE-2024-42353 | secure-packages-26.05 | |
| In progress | High | Allocation of Resources Without Limits vulnerability in Apache Thrift Java bindings 0.19.0–0.23.x | secure-packages-rolling | |
| In progress | High | AIOHTTP <3.14.0 leaks per-request cookies on cross-origin redirects | secure-packages-26.05 | |
| In progress | Critical | Apache Thrift c_glib: certificate host mismatch validation vulnerability before 0.24.0 | secure-packages-rolling | |
| In progress | High | Improper certificate hostname validation in Apache Thrift C++ before 0.24.0 | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-4140: CVE-2026-48524: PyJWT PyJWKClient unknown kid triggers unbounded JWKS fetches (DoS) | secure-packages-26.05 | |
| In progress | High | Apache Thrift <0.24.0 data amplification vulnerability from improper handling of highly compressed data across bindings | secure-packages-rolling | |
| In progress | High | Data amplification vulnerability in Apache Thrift Ruby bindings due to compressed data handling pre-0.24.0 | secure-packages-rolling | |
| In progress | Medium | oauthlib RevocationEndpoint reflects unvalidated JSONP callback, enabling arbitrary JavaScript injection | secure-packages-rolling | |
| In progress | Medium | Unvalidated JSONP callback in RevocationEndpoint enables attacker-controlled JavaScript response injection | secure-packages-26.05 | |
| In progress | Medium | Timing side-channel in oauthlib PKCE code_challenge verification using '==' comparison | secure-packages-rolling | |
| In progress | Medium | PKCE timing side-channel (CWE-208) in oauthlib authorization_code via non-constant-time compare | secure-packages-26.05 | |
| In progress | High | AIOHTTP pre-3.14.0 header injection via user-controlled multipart/payload headers | secure-packages-26.05 | |
| In progress | Low | GHSA-p688-r7jv-fm6f: Cargo sparse index URL normalization flaw may send credentials to attacker-controlled .git registry (CVE-2026-5222) | secure-packages-26.05 | |
| In progress | Low | GHSA-p688-r7jv-fm6f: Cargo sparse index URL normalization flaw may send credentials to attacker-controlled .git registry (CVE-2026-5222) | secure-packages-26.05 | |
| In progress | Low | GHSA-p688-r7jv-fm6f: Cargo sparse registry URL normalization leaks credentials to attacker-controlled .git registry (CVE-2026-5222) | secure-packages-25.11 | |
| In progress | Medium | GHSA-jq42-7mfv-hm57: Cargo tarball symlink extraction allows overwriting other crates' cache from same registry (CVE-2026-5223) | secure-packages-26.05 | |
| In progress | Medium | GHSA-jq42-7mfv-hm57: Cargo tarball symlink extraction allows overwriting other crates' cache from same registry (CVE-2026-5223) | secure-packages-26.05 | |
| In progress | Low | python-multipart <0.0.31: negative Content-Length bypasses bounds; parse_form() reads entire body | secure-packages-26.05 | |
| In progress | High | AIOHTTP pre-3.14.1 allows unlimited pipelined requests leading to memory exhaustion DoS | secure-packages-26.05 | |
| In progress | High | AIOHTTP <3.14.1: incomplete WebSocket frames bypass memory-use limits via large payloads | secure-packages-26.05 | |
| In progress | High | AIOHTTP <3.14.1: TLS SNI bypass via connection reuse with varying server_hostname | secure-packages-26.05 | |
| In progress | Medium | AIOHTTP DigestAuthMiddleware leaks auth digest on cross-origin redirects prior to 3.14.1 | secure-packages-26.05 | |
| In progress | High | AIOHTTP pre-3.14.1 C parser bypasses max_line_size; oversized HTTP lines cause DoS | secure-packages-26.05 | |
| In progress | High | AIOHTTP <3.14.1 in-memory decompression during cleanup enables DoS via zip bomb | secure-packages-26.05 | |
| In progress | High | AIOHTTP pre-3.14.1 CookieJar save/load loses host-only cookie flag | secure-packages-26.05 | |
| In progress | High | AIOHTTP <3.14.1 doesn't close payload resources on mid-write disconnect, causing resource starvation | secure-packages-26.05 | |
| In progress | High | sqlparse pre-0.6.0 quadratic CPU in parse/format/split from nested token flattening | secure-packages-rolling | |
| In progress | High | secure-packages-rolling | ||
| In progress | High | sh.py pre-2.2.4 _uid incomplete privilege drop retains privileged supplementary groups on Linux/Unix | secure-packages-26.05 | |
| In progress | Medium | Open redirect in WebOb <1.8.11 via urljoin stripping leading spaces and control chars | secure-packages-rolling | |
| In progress | Medium | WebOb <1.8.11 open redirect via Location/relative URL whitespace normalization bypass | secure-packages-26.05 |