Tagged “osv”
CVEs tagged osv, newest first.
7204 CVEsRSS
CVE-2026-23949High· 8.6jaraco.context Has a Path Traversal Vulnerability
jaraco.context Has a Path Traversal Vulnerability
CVE-2026-22777High· 7.5PoCComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler
ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler
CVE-2026-22772Medium· 5.8fulcio: Fulcio: Server-Side Request Forgery (SSRF) via unanchored regex in MetaIssuer URL validation (CVE-2026-22772)
A flaw was found in Fulcio, a certificate authority for issuing code signing certificates. A remote attacker could exploit this by bypassing MetaIssuer URL validation due to unanchored regular expressions (regex) in the `metaRegex()` funct…
MAL-2026-237NoneMalicious code in formater (PyPI)
Malicious code in formater (PyPI)
MAL-2026-236NoneMalicious code in graponater (PyPI)
Malicious code in graponater (PyPI)
CVE-2025-14279High· 8.1MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation
MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation
CVE-2026-22251Medium· 5.3Weblate wlc has insecure API key configuration
Weblate wlc has insecure API key configuration
CVE-2026-22033HighLabel Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field
Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field
CVE-2026-22250Low· 2.5Weblate command-line client susceptible to SSL verification skip
Weblate command-line client susceptible to SSL verification skip
CVE-2025-15506Low· 3.3AcademySoftwareFoundation OpenColorIO has an out-of-bounds vulnerability
AcademySoftwareFoundation OpenColorIO has an out-of-bounds vulnerability
CVE-2026-22703Medium· 5.5github.com/sigstore/cosign: Cosign verification accepts any valid Rekor entry under certain conditions (CVE-2026-22703)
A data verification flaw has been discovered in the golang cosign library. A Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key…
CVE-2026-22701Medium· 5.3filelock: filelock Time-of-Check-Time-of-Use (TOCTOU) in SoftFileLock (CVE-2026-22701)
A Time-of-Check-Time-of-Use (TOCTOU) flaw has been discovered in the pypi filelock package. The TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access…
CVE-2025-15504Low· 3.3LIEF is vulnerable to segmentation fault
LIEF is vulnerable to segmentation fault
CVE-2026-22702Medium· 4.5virtualenv: virtualenv: Local attacker can redirect file operations via TOCTOU race condition (CVE-2026-22702)
A flaw was found in virtualenv, a tool for creating isolated virtual Python environments. A local attacker can exploit a Time-of-Check-Time-of-Use (TOCTOU) race condition during directory creation operations. By performing symlink-based at…
CVE-2026-22690Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF with missing /Root object (CVE-2026-22690)
A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF file that omits the /Root entry in the trailer and uses a large /Size value. This can lead to excessively long processing times when th…
CVE-2026-22691Medium· 6.5pypdf: pypdf: Denial of Service via malformed PDF startxref entries (CVE-2026-22691)
A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF file with malformed startxref entries and excessive whitespace characters. This can cause excessively long processing times when rebuil…
CVE-2026-22606HighFickling has a bypass via runpy.run_path() and runpy.run_module()
Fickling has a bypass via runpy.run_path() and runpy.run_module()
CVE-2026-22609HighFickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
CVE-2026-22607HighFickling Blocklist Bypass: cProfile.run()
Fickling Blocklist Bypass: cProfile.run()
CVE-2026-22612HighFickling vulnerable to detection bypass due to "builtins" blindness
Fickling vulnerable to detection bypass due to "builtins" blindness
CVE-2026-22608HighFickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
CVE-2025-68151High· 7.5CoreDNS is a DNS server that chains plugins
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and d…
CVE-2025-66001High· 8.8NeuVector supports login authentication through OpenID Connect
NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the …
CVE-2023-7333Medium· 5.3records-mover Injection vulnerability
records-mover Injection vulnerability
CVE-2026-21874Medium· 5.3NiceGUI has Redis connection leak via tab storage causes service degradation
NiceGUI has Redis connection leak via tab storage causes service degradation
CVE-2026-21873High· 7.2NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
CVE-2026-21872Medium· 6.1NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
CVE-2025-68158Medium· 5.7Authlib is a Python library which builds OAuth and OpenID Connect servers
Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that ha…
CVE-2026-21892Medium· 5.3Parsl is a Python parallel scripting library
Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The application constructs SQL queries using unsafe string formatting (Python % operator…
CVE-2026-21860Medium· 5.3Werkzeug safe_join() allows Windows special device names with compound extensions
Werkzeug safe_join() allows Windows special device names with compound extensions