Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2026-31253High· 7.3flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism
flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism
CVE-2026-44338High· 7.3PoCPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
CVE-2026-7814Medium· 4.8pgAdmin 4: Stored cross-site scripting (XSS) vulnerability in Browser Tree and Explain Visualizer modules
pgAdmin 4: Stored cross-site scripting (XSS) vulnerability in Browser Tree and Explain Visualizer modules
CVE-2026-2393High· 7.1MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability
MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability
CVE-2026-44971High· 8.2GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
CVE-2026-7818High· 7.0pgAdmin 4 has deserialization of untrusted data in its FileBackedSessionManager
pgAdmin 4 has deserialization of untrusted data in its FileBackedSessionManager
CVE-2026-44337Medium· 6.3PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries
PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries
CVE-2026-6815Medium· 5.9PoCCasdoor: Arbitrary file write possible through Local File System storage provider
Casdoor: Arbitrary file write possible through Local File System storage provider
CVE-2026-8212Medium· 5.3OSGeo gdal has a heap-based buffer overflow
OSGeo gdal has a heap-based buffer overflow
MAL-2026-3411NoneMalicious code in web3-py-checksum (PyPI)
Malicious code in web3-py-checksum (PyPI)
CVE-2026-42308Medium· 6.2Pillow: Pillow: Denial of Service via integer overflow in font processing (CVE-2026-42308)
A flaw was found in Pillow, a Python imaging library. If a font advances for each glyph by an exceeding large amount, an integer overflow can occur when Pillow tracks the current position. This could lead to a denial of service (DoS) condi…
CVE-2026-8213Medium· 5.5A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4…
A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of the component Grid File Handler. The manipulation leads to heap-based buffer ove…
CVE-2026-44897Medium· 6.1Mistune Heading ID Attribute has Injection XSS
Mistune Heading ID Attribute has Injection XSS
CVE-2026-42310Medium· 4.0Pillow: Pillow: Denial of Service via malicious PDF processing (CVE-2026-42310)
A flaw was found in Pillow, a Python imaging library. A remote attacker could supply a specially crafted malicious PDF file, causing the application to hang indefinitely and consume 100% CPU. This vulnerability leads to a Denial of Service…
CVE-2026-42301High· 7.3pyp2spec: pyp2spec: Arbitrary command execution via unescaped RPM macro directives (CVE-2026-42301)
A flaw was found in pyp2spec, a tool that generates Fedora RPM spec files for Python projects. This vulnerability allows a malicious Python Package Index (PyPI) package to execute arbitrary commands on a build machine. This occurs because …
CVE-2026-42311High· 7.8Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing (CVE-2026-42311)
A flaw was found in Pillow, a Python imaging library. An attacker could exploit this vulnerability by tricking a user into processing a specially crafted malicious PSD file. This could lead to memory corruption, potentially causing the app…
CVE-2025-55449High· 7.3PoC⚖ disputedAstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.
AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.
RUSTSEC-2026-0146None`InterfaceAccount` allows account substitution between unexpected types
`InterfaceAccount` allows account substitution between unexpected types
CVE-2026-44309Medium· 5.3gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
CVE-2026-44310Medium· 5.4gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
CVE-2026-44896Medium· 6.1Mistune has XSS via unescaped figclass/figwidth in Figure directive
Mistune has XSS via unescaped figclass/figwidth in Figure directive
CVE-2026-38360Critical· 9.8PoCdash-uploader has a directory traversal vulnerability
dash-uploader has a directory traversal vulnerability
CVE-2026-41506Medium· 6.5golang: github.com/go-git/go-git: go-git: Information disclosure of HTTP authentication credentials via redirects (CVE-2026-41506)
A flaw was found in go-git, an extensible Git implementation library for Go. This vulnerability allows an attacker to potentially obtain sensitive HTTP authentication credentials. This can occur when go-git follows redirects during smart-H…
CVE-2026-44564Medium· 5.4Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO
Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO
CVE-2026-44563Medium· 5.4Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show
Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show
CVE-2026-44562Medium· 6.5Open WebUI's Model Import Overwrites Any Model Without Ownership Check
Open WebUI's Model Import Overwrites Any Model Without Ownership Check
CVE-2026-40214Medium· 6.3OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer
OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer
CVE-2026-40213High· 7.4OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints
OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints
CVE-2026-44549High· 7.3Open WebUI has stored XSS in Excel file preview
Open WebUI has stored XSS in Excel file preview
CVE-2026-44550Medium· 5.0Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts
Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts