Tagged “osv”
CVEs tagged osv, newest first.
7206 CVEsRSS
CVE-2025-12763Medium· 6.8pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems
pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system command…
CVE-2025-12765High· 7.5pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.
pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.
CVE-2025-64508High· 7.5Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input
Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input
CVE-2025-12764High· 7.5pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amo…
pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amo…
CVE-2025-12967High· 8.0AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance
AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance
CVE-2025-64345Low· 1.8Unsound API access to a WebAssembly shared linear memory
Unsound API access to a WebAssembly shared linear memory
CVE-2025-64324High· 7.7KubeVirt Vulnerable to Arbitrary Host File Read and Write
KubeVirt Vulnerable to Arbitrary Host File Read and Write
CVE-2025-57698HighAstrBot contains a directory traversal vulnerability
AstrBot contains a directory traversal vulnerability
CVE-2025-64512High· 8.6PoCArbitrary Code Execution in pdfminer.six via Crafted PDF Input
Arbitrary Code Execution in pdfminer.six via Crafted PDF Input
CVE-2025-64495High· 8.7PoCOpen WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
CVE-2025-57697MediumAstrBot has an arbitrary file read vulnerability in function _encode_image_bs64
AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64
CVE-2025-70559High· 7.8PoCInsecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
CVE-2025-64496High· 7.3Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
CVE-2025-64436Medium· 5.3KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes
KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes
CVE-2025-64437Medium· 5.0KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
CVE-2025-64458High· 7.5PoCDjango has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
CVE-2025-64439HighLangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer
LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer
CVE-2025-58337MediumApache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode
Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode
RUSTSEC-2025-0154None`replit_ruspty` was removed from crates.io for malicious code
`replit_ruspty` was removed from crates.io for malicious code
MAL-2025-49350NoneMalicious code in replit_ruspty (crates.io)
Malicious code in replit_ruspty (crates.io)
CVE-2025-12695Medium· 5.9DSPy does not properly restrict file reads
DSPy does not properly restrict file reads
CVE-2025-64187MediumOctoPrint vulnerable to XSS in Action Commands Notification and Prompt
OctoPrint vulnerable to XSS in Action Commands Notification and Prompt
CVE-2025-64184High· 8.8Dosage vulnerable to a Directory Traversal through crafted HTTP responses
Dosage vulnerable to a Directory Traversal through crafted HTTP responses
CVE-2025-60787High· 7.2PoCmotionEye vulnerable to RCE via unsanitized motion config parameter
motionEye vulnerable to RCE via unsanitized motion config parameter
MAL-2025-191874NoneMalicious code in speed-testing-nt (PyPI)
Malicious code in speed-testing-nt (PyPI)
CVE-2025-64168High· 7.1Agno session state overwrites between different sessions/users
Agno session state overwrites between different sessions/users
CVE-2025-63675Medium· 6.9cryptidy allows code execution via untrusted data due to pickle.loads
cryptidy allows code execution via untrusted data due to pickle.loads
CVE-2025-6176High· 7.5Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS (CVE-2025-6176)
Scrapy are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash…
CVE-2025-54941Medium· 4.6An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker
An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (…
CVE-2025-50736LowByaidu PDFMathTranslate vulnerable to open redirect
Byaidu PDFMathTranslate vulnerable to open redirect