Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2026-43868Medium· 5.3Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
CVE-2026-41181MediumTraefik's errors middleware forwards Authorization and Cookie headers to separate error page service
Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service
CVE-2026-7482Critical· 9.1PoCOllama contains a heap out-of-bounds read vulnerability in the GGUF model loader
Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader
CVE-2026-42294High· 7.5Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
CVE-2026-42295HighArgo vulnerable to exposure of artifact repository credentials
Argo vulnerable to exposure of artifact repository credentials
CVE-2026-42088High· 8.1OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version …
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and Ruby scripts directly from th…
CVE-2026-42087Critical· 9.6OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.…
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSD…
CVE-2026-42085Medium· 4.3OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions…
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the save_tool_config() function that …
CVE-2026-42084High· 8.1OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions…
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their passwo…
CVE-2025-67796High· 8.1IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users
IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users
CVE-2026-7724Medium· 5.0Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url
Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url
CVE-2026-7723High· 7.3Prefect Unauthenticated Event Injection via /api/events/in WebSocket
Prefect Unauthenticated Event Injection via /api/events/in WebSocket
CVE-2026-7711High· 7.3MindsDB has an Improper Access Control Issue
MindsDB has an Improper Access Control Issue
CVE-2026-7722Medium· 5.3Prefect Auth Bypass via endswith() Health Check Exemption
Prefect Auth Bypass via endswith() Health Check Exemption
CVE-2026-7725Medium· 6.3Prefect Git Argument Injection in GitRepository Pull Steps
Prefect Git Argument Injection in GitRepository Pull Steps
CVE-2026-42309Medium· 5.5Pillow has a heap buffer overflow with nested list coordinates
Pillow has a heap buffer overflow with nested list coordinates
CVE-2026-41888MediumDistribution's tag deletion bypasses `storage.delete.enabled` configuration
Distribution's tag deletion bypasses `storage.delete.enabled` configuration
CVE-2026-37461High· 7.5GoBGP has an out-of-bounds read in the ParseIP6Extended function
GoBGP has an out-of-bounds read in the ParseIP6Extended function
CVE-2026-7737Medium· 5.3GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer
GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-7734Medium· 5.3GoBGP has an Improper Resource Shutdown or Release
GoBGP has an Improper Resource Shutdown or Release
CVE-2026-7736High· 7.3GoBGP has an Integer Underflow Issue
GoBGP has an Integer Underflow Issue
CVE-2026-42601Critical· 9.8ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView
ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView
CVE-2026-42151High· 7.5Prometheus is an open-source monitoring system and time series database
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of…
CVE-2026-7700Medium· 6.3⚖ disputedA weakness has been identified in langflow-ai langflow up to 1.10.2
A weakness has been identified in langflow-ai langflow up to 1.10.2. This affects the function eval of the file src/lfx/src/lfx/components/llm_operations/lambda_filter.py of the component LambdaFilterComponent. Executing a manipulation c…
RUSTSEC-2026-0251Nonesized-chunks is unmaintained
sized-chunks is unmaintained
RUSTSEC-2026-0250Noneim-rc is unmaintained
im-rc is unmaintained
RUSTSEC-2026-0249Nonesmartstring is unmaintained
smartstring is unmaintained
RUSTSEC-2026-0248Noneim is unmaintained
im is unmaintained
RUSTSEC-2026-0247Nonebitmaps is unmaintained
bitmaps is unmaintained
CVE-2026-7669Medium· 5.6PoCSGLang has an Improper Input Validation/Injection Issue
SGLang has an Improper Input Validation/Injection Issue