Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2026-27199MediumPoCWerkzeug safe_join() allows Windows special device names
Werkzeug safe_join() allows Windows special device names
CVE-2026-27017LowuTLS has a fingerprint vulnerability from GREASE ECH mismatch for Chrome parrots
uTLS has a fingerprint vulnerability from GREASE ECH mismatch for Chrome parrots
MAL-2026-937NoneMalicious code in telebot-infee (PyPI)
Malicious code in telebot-infee (PyPI)
MAL-2026-935NoneMalicious code in telebot-infoo (PyPI)
Malicious code in telebot-infoo (PyPI)
MAL-2026-934NoneMalicious code in telebot-infoe (PyPI)
Malicious code in telebot-infoe (PyPI)
CVE-2026-2654Medium· 6.3Hugging Face Smolagents has a Server-Side Request Forgery issue
Hugging Face Smolagents has a Server-Side Request Forgery issue
CVE-2025-33253High· 7.8NVIDIA NeMo Framework Deserializes Untrusted Data
NVIDIA NeMo Framework Deserializes Untrusted Data
CVE-2025-33245High· 8.0NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution
NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution
CVE-2025-14009High· 8.8A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions
A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This a…
CVE-2026-25087High· 7.0Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering
Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering
MAL-2026-931NoneMalicious code in telebot-infe (PyPI)
Malicious code in telebot-infe (PyPI)
MAL-2026-930NoneMalicious code in telebot-info (PyPI)
Malicious code in telebot-info (PyPI)
CVE-2026-26057Medium· 6.5Skill-scanner Unsecured Network Binding Vulnerability
Skill-scanner Unsecured Network Binding Vulnerability
CVE-2026-25739Medium· 5.4Indico Affected by Cross-Site-Scripting via material uploads
Indico Affected by Cross-Site-Scripting via material uploads
CVE-2026-25738MediumIndico has Server-Side Request Forgery (SSRF) in multiple places
Indico has Server-Side Request Forgery (SSRF) in multiple places
CVE-2026-24126Medium· 6.6PoCWeblate has an argument injection in management console
Weblate has an argument injection in management console
GHSA-27jp-wm6q-gp25Mediumsqlparse: formatting list of tuples leads to denial of service
sqlparse: formatting list of tuples leads to denial of service
CVE-2025-67860Low· 3.8NeuVector scanner insecurely handles passwords as command arguments
NeuVector scanner insecurely handles passwords as command arguments
CVE-2026-21438Medium· 5.3webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map
webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map
MAL-2025-193013Critical⚠ ExploitedMalicious code in tablixs (PyPI)
Malicious code in tablixs (PyPI)
CVE-2026-26190Critical· 9.8PoCMilvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
CVE-2026-26013Low· 3.7LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
CVE-2026-1669High· 7.5Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras …
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras …
CVE-2025-69872Critical· 9.8PoCDiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default
DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.
CVE-2026-25990High· 7.5Pillow is a Python imaging library
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
CVE-2026-21531Critical· 9.8PoCAzure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE
Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE
CVE-2026-25890High· 8.1PoCFile Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL
File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL
CVE-2026-2303Medium· 6.5mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling
mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling
CVE-2026-25577High· 7.5Emmett-Core: Unhandled CookieError Exception Causing Denial of Service
Emmett-Core: Unhandled CookieError Exception Causing Denial of Service
CVE-2026-26007Medium· 6.5cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), l…