Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2025-66630CriticalFiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
CVE-2026-25934Medium· 4.3go-git/go-git: go-git: Data integrity issue due to improper verification of pack and index files (CVE-2026-25934)
A flaw was found in go-git, a library for Git implementation in Go. This vulnerability allows a remote attacker to provide specially crafted Git pack or index files that are not properly verified for data integrity. Successful exploitation…
CVE-2026-22922Medium· 6.5Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to up…
CVE-2026-24098Medium· 6.5Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to
Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to up…
CVE-2026-25480Medium· 6.5Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
CVE-2026-25528Medium· 5.8LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
CVE-2026-25905Medium· 5.8MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability
MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability
CVE-2026-25479Medium· 6.5Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns
Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns
CVE-2026-25904Medium· 5.8MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access
MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access
CVE-2026-25478High· 7.4Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins
Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins
MAL-2025-193012Critical⚠ ExploitedMalicious code in gridifies (PyPI)
Malicious code in gridifies (PyPI)
CVE-2026-25793HighBlocklist Bypass possible via ECDSA Signature Malleability
Blocklist Bypass possible via ECDSA Signature Malleability
GHSA-4f84-67cv-qrv3CriticalA single post-release of dydx-v4-client contained obfuscated multi-stage loader
A single post-release of dydx-v4-client contained obfuscated multi-stage loader
CVE-2026-25650HighMCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token
MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token
CVE-2025-68121NoneUnexpected session resumption in crypto/tls
Unexpected session resumption in crypto/tls
CVE-2026-25516Medium· 6.1NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
CVE-2026-25198Medium· 4.7web2py has an Open Redirect Vulnerability
web2py has an Open Redirect Vulnerability
CVE-2026-1707High· 7.4pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability
pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability
MAL-2026-738Critical⚠ ExploitedMalicious code in tablescene (PyPI)
Malicious code in tablescene (PyPI)
MAL-2026-732Critical⚠ ExploitedMalicious code in gridifys (PyPI)
Malicious code in gridifys (PyPI)
CVE-2026-25632Critical· 10.0PoCEPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
CVE-2026-24513Low· 3.1ingress-nginx has Improper Check for Unusual or Exceptional Conditions
ingress-nginx has Improper Check for Unusual or Exceptional Conditions
CVE-2026-25145Medium· 5.5melange has a path traversal in license-path which allows reading files outside workspace
melange has a path traversal in license-path which allows reading files outside workspace
CVE-2026-24514Medium· 6.5PoCingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling
ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling
MAL-2026-700Critical⚠ ExploitedMalicious code in tabulapys (PyPI)
Malicious code in tabulapys (PyPI)
MAL-2026-698Critical⚠ ExploitedMalicious code in tableshow (PyPI)
Malicious code in tableshow (PyPI)
MAL-2026-686Critical⚠ ExploitedMalicious code in tableapys (PyPI)
Malicious code in tableapys (PyPI)
CVE-2026-25541NonePoCInteger overflow in `BytesMut::reserve`
Integer overflow in `BytesMut::reserve`
CVE-2026-25122Medium· 5.5apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
CVE-2026-25121High· 7.5apko has a path traversal in apko dirFS which allows filesystem writes outside base
apko has a path traversal in apko dirFS which allows filesystem writes outside base