Tagged “osv”
CVEs tagged osv, newest first.
7107 CVEsRSS
MAL-2026-18164Critical⚠ ExploitedMalicious code in phonemeprobe (PyPI)
Malicious code in phonemeprobe (PyPI)
MAL-2026-18163Critical⚠ ExploitedMalicious code in phonemeforge (PyPI)
Malicious code in phonemeforge (PyPI)
MAL-2026-18162Critical⚠ ExploitedMalicious code in modelworks (PyPI)
Malicious code in modelworks (PyPI)
MAL-2026-18161Critical⚠ ExploitedMalicious code in evalstream (PyPI)
Malicious code in evalstream (PyPI)
MAL-2026-18160Critical⚠ ExploitedMalicious code in benchworks (PyPI)
Malicious code in benchworks (PyPI)
MAL-2026-18159Critical⚠ ExploitedMalicious code in benchbridge (PyPI)
Malicious code in benchbridge (PyPI)
MAL-2026-18158Critical⚠ ExploitedMalicious code in audiokit (PyPI)
Malicious code in audiokit (PyPI)
MAL-2026-18157Critical⚠ ExploitedMalicious code in asrloom (PyPI)
Malicious code in asrloom (PyPI)
MAL-2026-18156Critical⚠ ExploitedMalicious code in asrdock (PyPI)
Malicious code in asrdock (PyPI)
MAL-2026-18155Critical⚠ ExploitedMalicious code in acoustichub (PyPI)
Malicious code in acoustichub (PyPI)
MAL-2026-18154Critical⚠ ExploitedMalicious code in pipegrip (PyPI)
Malicious code in pipegrip (PyPI)
MAL-2026-18153Critical⚠ ExploitedMalicious code in hookgantry (PyPI)
Malicious code in hookgantry (PyPI)
MAL-2026-18152Critical⚠ ExploitedMalicious code in acousticpack (PyPI)
Malicious code in acousticpack (PyPI)
CVE-2026-114665Medium· 6.5Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a …
CVE-2026-115324High· 8.1mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or messag…
CVE-2026-96637High· 6.5Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
CVE-2026-96640High· 8.2PoCPillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
CVE-2026-96639Critical· 9.8Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
CVE-2026-96638Medium· 6.5Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
CVE-2026-96641Medium· 6.5PoCPillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
CVE-2026-96644High· 8.1PoCPillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
CVE-2026-96643High· 6.5Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
CVE-2026-96778High· 7.7PoCPillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
CVE-2026-113721Medium· 4.5virtualenv: Generated files can follow existing destination links
virtualenv: Generated files can follow existing destination links
RUSTSEC-2026-0384NoneRace condition in `tokio::time::Interval` on Tokio v1.54.0
Race condition in `tokio::time::Interval` on Tokio v1.54.0
MAL-2026-18151Critical⚠ ExploitedMalicious code in zennittts (PyPI)
Malicious code in zennittts (PyPI)
MAL-2026-18150Critical⚠ ExploitedMalicious code in voxilaratts (PyPI)
Malicious code in voxilaratts (PyPI)
MAL-2026-18149Critical⚠ ExploitedMalicious code in vellutts (PyPI)
Malicious code in vellutts (PyPI)
MAL-2026-18148Critical⚠ ExploitedMalicious code in tessivatts (PyPI)
Malicious code in tessivatts (PyPI)
MAL-2026-18147Critical⚠ ExploitedMalicious code in solivoxtts (PyPI)
Malicious code in solivoxtts (PyPI)