Tagged “osv”
CVEs tagged osv, newest first.
7182 CVEsRSS
CVE-2026-24009High· 8.1PoCdocling-core vulnerable to Remote Code Execution via unsafe PyYAML usage
docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage
CVE-2025-71176Medium· 6.8pytest has vulnerable tmpdir handling
pytest has vulnerable tmpdir handling
CVE-2026-24130LowMoonraker affected by LDAP search filter injection
Moonraker affected by LDAP search filter injection
CVE-2026-1260High· 7.8Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.
Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.
CVE-2026-24049High· 7.1PoCwheel is a command line tool for manipulating Python wheel files, as defined in PEP 427
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after e…
MAL-2026-441Critical⚠ ExploitedMalicious code in spellcheckpy (PyPI)
Malicious code in spellcheckpy (PyPI)
CVE-2026-23990Medium· 5.3Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims
Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims
CVE-2026-23849Medium· 5.3File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login
File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login
CVE-2026-23968Medium· 5.5Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false
Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false
CVE-2026-23877MediumSwing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user
Swing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user
CVE-2026-23996Low· 3.7FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection
FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection
CVE-2026-23833MediumESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component
ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component
CVE-2026-23986High· 7.1Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true
Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true
CVE-2026-23946Medium· 6.8Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization
Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization
CVE-2026-22807High· 8.8PoCvLLM is an inference and serving engine for large language models (LLMs)
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_…
MAL-2026-375Critical⚠ ExploitedMalicious code in spellcheckerpy (PyPI)
Malicious code in spellcheckerpy (PyPI)
CVE-2026-23644Highesm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages
esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages
CVE-2026-23842High· 7.5PoCChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion
ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion
CVE-2026-22219High· 7.7Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend
Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled…
MAL-2026-326NoneMalicious code in urlssser (PyPI)
Malicious code in urlssser (PyPI)
MAL-2026-325NoneMalicious code in marshel (PyPI)
Malicious code in marshel (PyPI)
CVE-2025-68675High· 7.5In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefo…
CVE-2025-68438High· 7.5In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI
In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of…
CVE-2026-23528MediumDask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard
Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard
CVE-2026-23535High· 8.0Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command
Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command
CVE-2026-23490High· 7.5PoCpyasn1 is a generic ASN.1 library for Python
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.
CVE-2026-23519HighNon-constant-time code generation on ARM32 targets
Non-constant-time code generation on ARM32 targets
CVE-2025-69725Medium· 4.7chi has an open redirect vulnerability in the RedirectSlashes middleware
chi has an open redirect vulnerability in the RedirectSlashes middleware
CVE-2025-68492Medium· 4.2Chainlit contains an authorization bypass vulnerability
Chainlit contains an authorization bypass vulnerability
CVE-2026-22779MediumBlackSheep's ClientSession is vulnerable to CRLF injection
BlackSheep's ClientSession is vulnerable to CRLF injection