Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2026-4506Medium· 6.3MindSQL is vulnerable to Code Injection through its ask_db function
MindSQL is vulnerable to Code Injection through its ask_db function
CVE-2026-33419CriticalMinIO LDAP login brute-force via user enumeration and missing rate limit
MinIO LDAP login brute-force via user enumeration and missing rate limit
CVE-2026-33022Medium· 6.5github.com/tektoncd/pipeline: Tekton Pipelines: Denial of Service via long resolver names (CVE-2026-33022)
A denial of service flaw was found in Tekton Pipelines. Any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. …
RUSTSEC-2026-0049NoneCRLs not considered authoritative by Distribution Point due to faulty matching logic
CRLs not considered authoritative by Distribution Point due to faulty matching logic
CVE-2026-32711High· 7.8pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root
pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root
CVE-2026-33123Medium· 4.3pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF (CVE-2026-33123)
A flaw was found in pypdf, a pure-python PDF library. An attacker can craft a malicious PDF file that, when processed, leads to excessive resource consumption, causing long runtimes and high memory usage. This can result in a Denial of Ser…
CVE-2026-33154High· 7.5PoCdynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection (CVE-2026-33154)
A flaw was found in dynaconf, a Python configuration management tool. This Server-Side Template Injection (SSTI) vulnerability occurs due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is installed. A remote a…
CVE-2026-33230Medium· 6.1nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser (CVE-2026-33230)
A flaw was found in NLTK (Natural Language Toolkit), a suite of open source Python modules for Natural Language Processing. The `nltk.app.wordnet_app` component contains a reflected cross-site scripting (XSS) vulnerability. A remote attack…
CVE-2026-32889Medium· 6.5tinytag: tinytag: Denial of Service via malicious MP3 file parsing (CVE-2026-32889)
A flaw was found in tinytag, a Python library for reading audio file metadata. An attacker who can supply specially crafted MP3 files for parsing can trigger a non-terminating loop within the library. This can cause the parsing operation t…
CVE-2026-33236High· 8.1NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the…
CVE-2026-33231High· 7.5PoCNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthentic…
CVE-2026-33509High· 7.5pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
CVE-2026-33322CriticalMinIO has JWT Algorithm Confusion in OIDC Authentication
MinIO has JWT Algorithm Confusion in OIDC Authentication
CVE-2026-33320Medium· 6.2PoCDasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
CVE-2026-26933Medium· 5.7Packetbeat does not properly validate an array index in multiple protocol parser components
Packetbeat does not properly validate an array index in multiple protocol parser components
CVE-2026-26931Medium· 5.7Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation (CAPEC-130).
Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation (CAPEC-130).
CVE-2026-33332Medium· 5.3NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
CVE-2025-15031High· 8.1Arbitrary file write via tar traversal in mlflow
Arbitrary file write via tar traversal in mlflow
CVE-2026-27953High· 7.1ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor
ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor
CVE-2026-3029MediumPyMuPDF has a path traversal in _main_.py
PyMuPDF has a path traversal in _main_.py
CVE-2026-33310High· 8.8PoCIntake has a Command Injection via shell() Expansion in Parameter Defaults
Intake has a Command Injection via shell() Expansion in Parameter Defaults
CVE-2026-33203High· 7.5SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass
SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass
CVE-2026-33194Medium· 6.8SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)
SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)
CVE-2026-32761Medium· 6.5File Browser has an Authorization Policy Bypass in Public Share Download Flow
File Browser has an Authorization Policy Bypass in Public Share Download Flow
CVE-2026-8630MediumJustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)
JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)
CVE-2026-32874High· 7.5UltraJSON has a Memory Leak parsing large integers allows DoS
UltraJSON has a Memory Leak parsing large integers allows DoS
CVE-2026-33125High· 7.1Frigte has broken access control viewer user can delete admin and other users account
Frigte has broken access control viewer user can delete admin and other users account
CVE-2026-33139HighPySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution
PySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution
CVE-2026-30922High· 7.5PoCpyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x3…
CVE-2026-32875High· 7.5UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop