Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2026-7212High· 7.3notes-mcp has a Path Traversal issue
notes-mcp has a Path Traversal issue
CVE-2026-7206High· 7.3sqlite-mcp has an Injection issue
sqlite-mcp has an Injection issue
CVE-2026-42510Medium· 6.6OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
RUSTSEC-2026-0113None`unpack_in` can chmod arbitrary directories by following symlinks
`unpack_in` can chmod arbitrary directories by following symlinks
RUSTSEC-2026-0112NonePAX Header Desynchronization in astral-tokio-tar
PAX Header Desynchronization in astral-tokio-tar
MAL-2026-3103NoneMalicious code in amzn_codewhisperer_streaming_client (crates.io)
Malicious code in amzn_codewhisperer_streaming_client (crates.io)
MAL-2026-3102NoneMalicious code in semantic_search_client (crates.io)
Malicious code in semantic_search_client (crates.io)
MAL-2026-3101NoneMalicious code in amzn_consolas_client (crates.io)
Malicious code in amzn_consolas_client (crates.io)
CVE-2026-7141Medium· 5.6vLLM makes Use of Uninitialized Resource
vLLM makes Use of Uninitialized Resource
CVE-2026-7142Medium· 6.3Wooey has an Incorrect Privilege Assignment issue
Wooey has an Incorrect Privilege Assignment issue
CVE-2026-7150Medium· 6.3auto-favicon has a Server-Side Request Forgery issue
auto-favicon has a Server-Side Request Forgery issue
CVE-2026-7149High· 7.3kaggle-mcp has a Path Traversal issue
kaggle-mcp has a Path Traversal issue
CVE-2026-6357Medium· 5.8pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation (CVE-2026-6357)
A flaw was found in pip. Prior to version 26.1, pip's self-update check functionality would execute after installing wheel packages. This process involved importing newly installed Python modules. A malicious actor could craft a specially …
CVE-2026-7158High· 7.3mcp-url-downloader has a Server-Side Request Forgery issue
mcp-url-downloader has a Server-Side Request Forgery issue
CVE-2026-7020Medium· 5.6PoCOllama is Vulnerable to Path Traversal
Ollama is Vulnerable to Path Traversal
CVE-2026-6993Medium· 5.3go-kratos: go-kratos kratos: Information disclosure via unintended HTTP server intermediary (CVE-2026-6993)
A flaw was found in go-kratos kratos. A remote attacker could exploit a vulnerability in the HTTP server's `NewServer` function, specifically within the `http.DefaultServeMux Fallback Handler`. This manipulation creates an unintended inter…
CVE-2026-6984Medium· 4.7AstrBot has Incomplete Filtering of Special Elements
AstrBot has Incomplete Filtering of Special Elements
CVE-2026-41481Medium· 6.5langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass (CVE-2026-41481)
A flaw was found in LangChain and langchain-text-splitters. This vulnerability, a Server-Side Request Forgery (SSRF) bypass, allows a remote attacker to redirect a seemingly safe URL to internal network resources. By exploiting unvalidated…
CVE-2026-41327Critical· 9.1Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
CVE-2026-41492Critical· 9.8PoCDgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars
Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars
CVE-2026-40912High· 8.2Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync
Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync
CVE-2026-42203HighPoCLiteLLM: Server-Side Template Injection in /prompts/test endpoint
LiteLLM: Server-Side Template Injection in /prompts/test endpoint
CVE-2026-40690Medium· 4.3The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of D…
The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of D…
CVE-2026-6550Medium· 4.7AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache
AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache
CVE-2026-38743Medium· 4.3The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (includin…
The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (includin…
CVE-2026-41486HighRay: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
CVE-2026-42150Medium· 5.1wlc: print_html outputs API data without HTML escaping
wlc: print_html outputs API data without HTML escaping
CVE-2026-41140High· 8.7poetry: Poetry: Path traversal vulnerability allows arbitrary file write via malicious package extraction (CVE-2026-41140)
A flaw was found in Poetry, a dependency manager for Python. This vulnerability allows a remote attacker to perform a path traversal attack. By crafting a malicious software package, the `extractall()` function in Poetry can be tricked int…
CVE-2026-41328Critical· 9.1Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
CVE-2026-40886High· 7.7Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller