Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
GHSA-5r2p-pjr8-7fh7HighSageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality
SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality
CVE-2025-69534High· 7.5Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception,…
CVE-2026-29790Lowdbt-common's commonprefix() doesn't protect against path traversal
dbt-common's commonprefix() doesn't protect against path traversal
CVE-2025-45691High· 7.5RAGAS has an Arbitrary File Read vulnerability
RAGAS has an Arbitrary File Read vulnerability
CVE-2026-25048Highxgrammar vulnerable to DoS via multi-layer nesting
xgrammar vulnerable to DoS via multi-layer nesting
CVE-2026-29787Medium· 5.3mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
CVE-2026-29780Medium· 5.5PoCeml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write
eml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write
CVE-2026-0847High· 8.6PoCNLTK has a Path Traversal issue
NLTK has a Path Traversal issue
CVE-2026-29038Medium· 6.1changedetection.io has Reflected XSS in its RSS Tag Error Response
changedetection.io has Reflected XSS in its RSS Tag Error Response
CVE-2026-29039Highchangedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()
changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()
CVE-2026-29065Highchangedetection.io has Zip Slip vulnerability in the backup restore functionality
changedetection.io has Zip Slip vulnerability in the backup restore functionality
CVE-2026-28681High· 8.1IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links
IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links
CVE-2026-28518High· 7.8PoCOpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory
OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious…
CVE-2026-28222Medium· 6.1Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes
Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes
CVE-2026-28223Medium· 6.1Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface
Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface
CVE-2026-25674Low· 3.7Django has a Race Condition vulnerability
Django has a Race Condition vulnerability
CVE-2026-27905High· 7.8BentoML is a Python library for building online serving systems optimized for AI apps and model inference
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safe_extract_tarfile() function validates that each tar member's path is within the destination directory, bu…
CVE-2026-27622High· 8.4OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned in…
CVE-2026-25673High· 7.5Django vulnerable to Uncontrolled Resource Consumption
Django vulnerable to Uncontrolled Resource Consumption
CVE-2021-25320Critical· 9.9Rancher cloud credentials can be used through proxy API by users without access
Rancher cloud credentials can be used through proxy API by users without access
CVE-2022-21951Medium· 6.8Rancher's weave CNI password is not configured when a cluster is created from an RKE template
Rancher's weave CNI password is not configured when a cluster is created from an RKE template
CVE-2023-22648High· 8.0Rancher's Azure AD permission changes are not reflected on active sessions
Rancher's Azure AD permission changes are not reflected on active sessions
CVE-2021-36783Critical· 9.9Rancher doesn't properly sanitize credentials in cluster template answers
Rancher doesn't properly sanitize credentials in cluster template answers
CVE-2022-31247Critical· 9.1Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)
Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)
CVE-2026-56315Critical· 9.8PickleScan has multiple stdlib modules with direct RCE not in blocklist
PickleScan has multiple stdlib modules with direct RCE not in blocklist
CVE-2026-28350Medium· 6.1lxml-html-clean has <base> tag injection through default Cleaner configuration
lxml-html-clean has <base> tag injection through default Cleaner configuration
CVE-2026-27932High· 7.5joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)
joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)
CVE-2026-28795HighOpenChatBI has a Path Traversal Vulnerability in save_report Tool
OpenChatBI has a Path Traversal Vulnerability in save_report Tool
CVE-2026-28348Medium· 6.1lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes
lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes
CVE-2026-28438HighCocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements
CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements