Tagged “osv”
CVEs tagged osv, newest first.
7206 CVEsRSS
CVE-2025-66423High· 7.1Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
CVE-2025-66422Medium· 4.3Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
CVE-2025-66424Medium· 6.5Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
CVE-2025-66221Medium· 5.3Werkzeug is a comprehensive WSGI web application library
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are imp…
CVE-2025-66371Medium· 5.0Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration
Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.
CVE-2025-34351CriticalRay's New Token Authentication is Disabled By Default
Ray's New Token Authentication is Disabled By Default
MAL-2025-191534Critical⚠ ExploitedMalicious code in tablates (PyPI)
Malicious code in tablates (PyPI)
CVE-2025-62593High· 8.8CISA KEVPoCRay is an AI compute engine
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient gu…
CVE-2021-4472Medium· 6.5OpenStack's Mistral Client has a local file inclusion vulnerability
OpenStack's Mistral Client has a local file inclusion vulnerability
MAL-2025-191535Critical⚠ ExploitedMalicious code in tableate (PyPI)
Malicious code in tableate (PyPI)
CVE-2025-65965HighGrype has a credential disclosure vulnerability in its JSON output
Grype has a credential disclosure vulnerability in its JSON output
CVE-2025-65942Low· 2.7VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM
VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM
CVE-2025-62703High· 8.8Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
CVE-2025-64761HighOpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation
OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation
CVE-2025-66019Mediumpypdf's LZWDecode streams be manipulated to exhaust RAM
pypdf's LZWDecode streams be manipulated to exhaust RAM
MAL-2025-191875NoneMalicious code in speed-testing-vps (PyPI)
Malicious code in speed-testing-vps (PyPI)
CVE-2025-65106High· 8.2langchain-core: LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates (CVE-2025-65106)
A template-injection vulnerability in LangChain's prompt template system allowed untrusted template strings to access Python object internals through attribute traversal and indexing. By crafting malicious template expressions, an attacker…
CVE-2025-62426Medium· 6.5vllm: vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` (CVE-2025-624…
A vulnerability in vLLM allows an authenticated user to trigger unintended tokenization during chat template processing by supplying crafted chat_template_kwargs to the /v1/chat/completions or /tokenize endpoints. By forcing the server to …
CVE-2025-64751MediumOpenFGA Improper Policy Enforcement
OpenFGA Improper Policy Enforcement
CVE-2025-62372Medium· 6.5vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs
vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs
CVE-2025-62164High· 8.8vLLM deserialization vulnerability leading to DoS and potential RCE
vLLM deserialization vulnerability leading to DoS and potential RCE
CVE-2025-64521Medium· 4.8authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_se…
authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account for the provider. In previous authent…
CVE-2025-65015Criticaljoserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
CVE-2025-64076High· 7.5Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (s…
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds Read (CWE-191, CWE-125): An incorre…
CVE-2025-60455CriticalModular Max Serve has Unsafe Deserialization vulnerability
Modular Max Serve has Unsafe Deserialization vulnerability
CVE-2025-65073High· 7.5OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.
OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.
MAL-2026-18443Critical⚠ ExploitedMalicious code in wallet-tracking (PyPI)
Malicious code in wallet-tracking (PyPI)
MAL-2025-191533Critical⚠ ExploitedMalicious code in spellcheckers (PyPI)
Malicious code in spellcheckers (PyPI)
CVE-2025-47913High· 7.5golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913)
A flaw in golang.org/x/crypto/ssh/agent causes the SSH agent client to panic when a peer responds with the generic SSH_AGENT_SUCCESS (0x06) message to requests expecting typed replies (e.g., List, Sign). The unmarshal layer produces an une…
CVE-2025-64509High· 7.5Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)
Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)