Tagged “osv”
CVEs tagged osv, newest first.
7182 CVEsRSS
MAL-2026-3429Critical⚠ ExploitedMalicious code in openai-spellchecker (PyPI)
Malicious code in openai-spellchecker (PyPI)
CVE-2026-44477Critical· 9.9CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE
CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE
CVE-2026-7813Critical· 9.9pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debu…
pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules
CVE-2026-41018Medium· 6.5Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL
Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL
CVE-2026-45017High· 7.5python-liquid: Absolute paths escape filesystem loader search path
python-liquid: Absolute paths escape filesystem loader search path
RUSTSEC-2026-0234NoneInsufficient archive validation can cause out-of-bounds reads in archives containing hash tables
Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables
RUSTSEC-2026-0233NoneCrafted archives can cause a use-after-free during deserialization
Crafted archives can cause a use-after-free during deserialization
CVE-2026-8276Low· 3.7bettercap Has an Integer Coercion Error in modules/mysql_server/mysql_server.go
bettercap Has an Integer Coercion Error in modules/mysql_server/mysql_server.go
CVE-2026-45022Highgo-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
CVE-2026-42595High· 8.6Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass
Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass
CVE-2026-56400High· 8.3Open WebUI has a CORS misconfiguration and session validation issue
Open WebUI has a CORS misconfiguration and session validation issue
CVE-2026-40217High· 8.8PoCLiteLLM has a sandbox escape in custom-code guardrail
LiteLLM has a sandbox escape in custom-code guardrail
CVE-2026-7817Medium· 6.5pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities
pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities
CVE-2026-31246Medium· 6.5GPT-Pilot contains a command injection vulnerability in the Executor.run() method
GPT-Pilot contains a command injection vulnerability in the Executor.run() method
CVE-2026-44972Medium· 5.0GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
CVE-2026-44569High· 7.1Open WebUI's Insecure Message Access Breaks Authorization
Open WebUI's Insecure Message Access Breaks Authorization
CVE-2026-44571Medium· 6.5Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission
Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission
CVE-2026-7816High· 8.8pgAdmin 4: OS command injection vulnerability in Import/Export query export
pgAdmin 4: OS command injection vulnerability in Import/Export query export
CVE-2026-44565High· 8.1Open WebUI Arbitrary File Write, Delete via Path Traversal
Open WebUI Arbitrary File Write, Delete via Path Traversal
CVE-2026-7820Medium· 6.5pgAdmin 4: Improper restriction of excessive authentication attempts
pgAdmin 4: Improper restriction of excessive authentication attempts
CVE-2026-7819High· 8.1pgAdmin 4 File Manager has symbolic-link path traversal
pgAdmin 4 File Manager has symbolic-link path traversal
CVE-2026-7815High· 8.8SQL injection vulnerability in pgAdmin 4 Maintenance Tool
SQL injection vulnerability in pgAdmin 4 Maintenance Tool
CVE-2026-44570High· 8.3Open WebUI has inconsistent authorization controls within memories API
Open WebUI has inconsistent authorization controls within memories API
CVE-2026-44339High· 8.6PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute
PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute
CVE-2026-43979Medium· 5.0local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)
local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)
CVE-2026-31247High· 7.5Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks
Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks
CVE-2026-8319Medium· 5.3aiwaves-cn agents is vulnerable to resource consumption in the recall_relevant_memories_to_working_memory function
aiwaves-cn agents is vulnerable to resource consumption in the recall_relevant_memories_to_working_memory function
CVE-2026-44340High· 7.5PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
CVE-2026-31248High· 7.5Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks
Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks
CVE-2026-31253High· 7.3flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism
flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism