Tagged “osv”
CVEs tagged osv, newest first.
7206 CVEsRSS
CVE-2025-61782Medium· 5.4OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callbac…
CVE-2026-22041Lowloggingredactor converts non-string types to string types in logs
loggingredactor converts non-string types to string types in logs
CVE-2026-21441High· 7.5urllib3 is an HTTP client library for Python
urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urll…
MAL-2026-96NoneMalicious code in pycolorom (PyPI)
Malicious code in pycolorom (PyPI)
CVE-2025-69225Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the …
CVE-2025-69227High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If …
CVE-2025-69229Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an applicat…
CVE-2025-69230Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an a…
CVE-2026-21851Medium· 5.3MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download
MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download
CVE-2026-21883MediumBokeh server applications have Incomplete Origin Validation in WebSockets
Bokeh server applications have Incomplete Origin Validation in WebSockets
CVE-2025-69228High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an applic…
MAL-2026-42NoneMalicious code in pyrogrom (PyPI)
Malicious code in pyrogrom (PyPI)
CVE-2026-21439Lowbadkeys vulnerable to ASCII control character injection on console via malformed input
badkeys vulnerable to ASCII control character injection on console via malformed input
CVE-2025-69224Medium· 6.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version …
CVE-2025-69226Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files mea…
CVE-2025-69223High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that …
CVE-2026-21445HighPoCLangflow Missing Authentication on Critical API Endpoints
Langflow Missing Authentication on Critical API Endpoints
CVE-2025-68131MediumCBORDecoder reuse can leak shareable values across decode calls
CBORDecoder reuse can leak shareable values across decode calls
MAL-2025-193011NoneMalicious code in requeses (PyPI)
Malicious code in requeses (PyPI)
MAL-2025-193010NoneMalicious code in pyrogrqm (PyPI)
Malicious code in pyrogrqm (PyPI)
MAL-2025-193008NoneMalicious code in telegreph (PyPI)
Malicious code in telegreph (PyPI)
MAL-2025-193007NoneMalicious code in aiogrem (PyPI)
Malicious code in aiogrem (PyPI)
MAL-2025-192991NoneMalicious code in pyrogrem (PyPI)
Malicious code in pyrogrem (PyPI)
CVE-2025-69277Medium· 4.5libsodium has Incomplete List of Disallowed Inputs
libsodium has Incomplete List of Disallowed Inputs
CVE-2025-34469High· 7.5PoCCowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability in the emulated shell implementation of wget and curl
Cowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability in the emulated shell implementation of wget and curl. In the default emulated shell configuration, these command emulations perform real outbound …
CVE-2025-69257High· 7.3theshit vulnerable to unsafe loading of user-owned Python rules when running as root
theshit vulnerable to unsafe loading of user-owned Python rules when running as root
CVE-2025-68939High· 8.2Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
MAL-2025-192943NoneMalicious code in telegrem (PyPI)
Malicious code in telegrem (PyPI)
MAL-2025-192942NoneMalicious code in telebot-bot (PyPI)
Malicious code in telebot-bot (PyPI)
CVE-2025-67729High· 8.8LMDeploy is a toolkit for compressing, deploying, and serving LLMs
LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where torch.load() is called without the weights_only=True parameter when loading m…