Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2026-2256Medium· 6.5PoCMS-Agent vulnerable to Command Injection
MS-Agent vulnerable to Command Injection
CVE-2026-28352Medium· 6.5Indico has a missing access check in the event series management API
Indico has a missing access check in the event series management API
CVE-2026-27966Critical· 9.8PoCLangflow has Remote Code Execution in CSV Agent
Langflow has Remote Code Execution in CSV Agent
GHSA-747p-wmpv-9c78Medium· 5.9AWS CLI: cli_history database does not restrict file permissions on Unix systems
AWS CLI: cli_history database does not restrict file permissions on Unix systems
CVE-2026-28231Critical· 9.1pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the en…
pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by provid…
CVE-2025-13327Medium· 6.3uv has ZIP payload obfuscation through parsing differentials
uv has ZIP payload obfuscation through parsing differentials
CVE-2026-28351Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF with RunLengthDecode filter (CVE-2026-28351)
A flaw was found in pypdf, a free and open-source pure-python PDF library. An attacker can exploit this vulnerability by crafting a malicious PDF file that, when parsed, leads to excessive memory consumption. This occurs specifically when …
CVE-2026-22728Medium· 4.9Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotat…
Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations
CVE-2026-27941Critical· 9.9PoCOpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repo…
OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from fork…
CVE-2026-27835Medium· 4.3wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
CVE-2026-27888Medium· 5.3pypdf: pypdf: Denial of Service via crafted PDF (CVE-2026-27888)
A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF document. When a user processes this specially crafted PDF, it can lead to excessive memory consumption, resulting in a Denial of Servi…
CVE-2026-27457Medium· 4.3Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
CVE-2026-27735Mediummcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
CVE-2026-27839Medium· 4.3wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
CVE-2026-27948Medium· 5.4Copyparty vulnerable to reflected XSS via setck parameter
Copyparty vulnerable to reflected XSS via setck parameter
CVE-2026-27838Low· 3.1wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data
wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data
CVE-2026-27809Mediumpsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps
psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps
CVE-2026-27641Critical· 9.8PoCFlask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection
Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection
CVE-2026-27614Critical· 9.3Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
CVE-2026-26717Medium· 4.8PoCOpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function
OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function
CVE-2026-25733High· 7.3Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
CVE-2026-27645Medium· 6.1PoCchangedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
CVE-2026-27794Medium· 6.6langgraph-checkpoint: LangGraph Checkpoint: Remote Code Execution via insecure deserialization in caching layer (CVE-2026-27794)
A flaw was found in LangGraph Checkpoint. This vulnerability allows a remote attacker with write access to the cache backend to achieve remote code execution. This occurs when applications enable cache backends that inherit from `BaseCache…
CVE-2026-25734Medium· 6.1Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata
Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata
CVE-2026-25136High· 8.1Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
CVE-2026-25736Medium· 6.1Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute
Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute
CVE-2026-25735Medium· 6.1Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name
Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name
CVE-2026-27695Medium· 4.3zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service
zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service
CVE-2026-27696High· 8.6changedetection.io is Vulnerable to SSRF via Watch URLs
changedetection.io is Vulnerable to SSRF via Watch URLs
CVE-2026-25138Medium· 5.3Rucio WebUI has Username Enumeration via Login Error Message
Rucio WebUI has Username Enumeration via Login Error Message