Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
MAL-2026-3248NoneMalicious code in pwn-control (PyPI)
Malicious code in pwn-control (PyPI)
CVE-2026-7597Medium· 6.3mem0ai mem0 has an Improper Input Validation Issue
mem0ai mem0 has an Improper Input Validation Issue
RUSTSEC-2026-0120NoneNSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses
NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses
RUSTSEC-2026-0119NoneCPU exhaustion during message encoding due to O(n²) name compression
CPU exhaustion during message encoding due to O(n²) name compression
RUSTSEC-2026-0118NoneNSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses
NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses
CVE-2026-43003High· 8.0An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a mal…
CVE-2026-7579High· 7.3AstrBot Makes Use of Hard-coded Password
AstrBot Makes Use of Hard-coded Password
CVE-2026-43001High· 8.0OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation (CVE-2026-4…
A flaw was found in OpenStack Keystone. An attacker holding an unrestricted application credential could exploit a vulnerability in the POST /v3/credentials endpoint where the caller-supplied project_id for an EC2-type credential was not v…
CVE-2026-41016Medium· 5.9apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
CVE-2026-7246High· 7.2Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pa…
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
CVE-2026-40171High· 8.8Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
CVE-2025-13030High· 7.1All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lack…
CVE-2026-41654MediumWeblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
CVE-2026-42032MediumCKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`
CKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`
CVE-2026-41519Medium· 4.2Weblate Doesn't Invalidate API Token on Password Change
Weblate Doesn't Invalidate API Token on Password Change
CVE-2026-42254HighHickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation
Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation
CVE-2026-40280Critical· 9.3PoCGotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection
Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection
CVE-2026-42559High· 8.8PoCDNS rebinding vulnerability in rmcp Streamable HTTP server transport
DNS rebinding vulnerability in rmcp Streamable HTTP server transport
CVE-2026-41643High· 7.5GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
CVE-2026-41132MediumCKAN has no certificate validation on STMP connection
CKAN has no certificate validation on STMP connection
CVE-2026-41255Medium· 6.1CKAN has CSRF exemption primed by anonymous requests
CKAN has CSRF exemption primed by anonymous requests
CVE-2026-42352High· 8.6pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
CVE-2026-42031HighPoCCKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
CVE-2026-42351High· 7.5pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider
pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider
CVE-2026-7404High· 7.3mcpo-simple-server has a Path Traversal issue
mcpo-simple-server has a Path Traversal issue
CVE-2026-32934High· 7.5CoreDNS' DoQ worker pool does not bound stream backlog
CoreDNS' DoQ worker pool does not bound stream backlog
CVE-2026-30246Medium· 6.5Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters
Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters
MAL-2026-3129NoneMalicious code in supertag (crates.io)
Malicious code in supertag (crates.io)
MAL-2026-3126NoneMalicious code in lsh (crates.io)
Malicious code in lsh (crates.io)
CVE-2026-7159High· 7.3mkdocs-mcp-plugin has a Path Traversal issue
mkdocs-mcp-plugin has a Path Traversal issue