Tagged “osv”
CVEs tagged osv, newest first.
6857 CVEsRSS
MAL-2026-18343Critical⚠ ExploitedMalicious code in numprint (PyPI)
Malicious code in numprint (PyPI)
GHSA-wf6j-7hvr-gr93High· 7.8Hydra legacy target blacklist permits unsafe PyYAML loading
Hydra legacy target blacklist permits unsafe PyYAML loading
MAL-2026-18336Critical⚠ ExploitedMalicious code in h13t0ry-hello-demo (PyPI)
Malicious code in h13t0ry-hello-demo (PyPI)
CVE-2026-27975Critical· 9.8Ajenti has potential Remote Code Execution
Ajenti has potential Remote Code Execution
CVE-2026-34157HighPoCWails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
CVE-2026-48705Critical· 9.3MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
CVE-2026-49272High· 8.5OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
GHSA-hhww-mrg2-969hMedium· 6.8LiteLLM vulnerable to reflected XSS in /sso/debug/callback
LiteLLM vulnerable to reflected XSS in /sso/debug/callback
GHSA-g5ff-637f-6q2mHigh· 8.1LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
GHSA-763v-5pjm-fx36MediumStrands Agents: Default FileSessionManager storage is world-readable on shared systems
Strands Agents: Default FileSessionManager storage is world-readable on shared systems
GHSA-3w55-933p-8pv5High· 7.1Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
CVE-2026-116589High· 8.2Datadog dd-trace-py: IAST instrumentation can lead to application DOS
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
CVE-2026-116588High· 8.7Datadog dd-trace-py: ReDoS in URL query string obfuscation
Datadog dd-trace-py: ReDoS in URL query string obfuscation
CVE-2026-116591High· 8.7compress zstd: Panic on two-block frames
compress zstd: Panic on two-block frames
GHSA-h2v8-394m-p7vvLow· 3.7Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
GHSA-c8m5-c952-6cm4Medium· 4.0Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs
Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs
GHSA-w44r-93j7-qv28Low· 3.7rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share
rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share
GHSA-vp88-798v-h67fLow· 2.3rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert
CVE-2026-115924High· 8.6Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
CVE-2026-83813Low· 3.1Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
CVE-2026-114620Medium· 5.4Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
CVE-2026-114619Medium· 4.6Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
CVE-2026-114618Medium· 6.8Authlib: Default JWT bearer grant accepts assertions for the wrong audience
Authlib: Default JWT bearer grant accepts assertions for the wrong audience
CVE-2026-114617Medium· 4.2⚖ disputedAuthlib: ID token can disable its own nonce validation via the nonce_supported claim
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
CVE-2026-114616High· 7.4Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
CVE-2026-114615High· 7.4Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
CVE-2026-114614Low· 2.6Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback…
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
CVE-2026-114613High· 7.5MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
CVE-2026-114612Critical· 9.9PoCLiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
CVE-2026-114610Medium· 6.5fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'