Tagged “osv”
CVEs tagged osv, newest first.
7206 CVEsRSS
CVE-2025-62370High· 7.5Alloy Core libraries at the root of the Rust Ethereum ecosystem
Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash(). Sof…
CVE-2025-62375Mediumgo-witness and witness are Go modules for generating attestations
go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can…
CVE-2025-62379Low· 3.1reflex-dev/reflex has an Open Redirect vulnerability
reflex-dev/reflex has an Open Redirect vulnerability
CVE-2025-62172HighHome Assistant is open source home automation software that puts local control and privacy first
Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject…
CVE-2025-7707High· 7.8The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt…
CVE-2025-11579Medium· 5.3PoCgithub.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory…
github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory…
CVE-2025-59530Medium· 5.3⚖ disputedgithub.com/quic-go/quic-go: quic-go Crash Due to Premature HANDSHAKE_DONE Frame (CVE-2025-59530)
A denial of service flaw has been discovered in the quic-go golang library. A misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. …
CVE-2025-61911Mediumpython-ldap has sanitization bypass in ldap.filter.escape_filter_chars
python-ldap has sanitization bypass in ldap.filter.escape_filter_chars
CVE-2025-61920High· 7.5Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
CVE-2025-61912Mediumpython-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
CVE-2025-62706Medium· 6.5Authlib : JWE zip=DEF decompression bomb enables DoS
Authlib : JWE zip=DEF decompression bomb enables DoS
CVE-2025-10284Critical· 9.6BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.
BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.
CVE-2025-10283Critical· 9.6BBOT's gitdumper module could be abused to execute commands through a malicious git repository.
BBOT's gitdumper module could be abused to execute commands through a malicious git repository.
CVE-2025-61783MediumPython Social Auth is a social authentication/registration mechanism
Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to …
CVE-2025-10282Medium· 4.7BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.
BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.
CVE-2025-61773High· 8.1pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters
pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters
CVE-2025-10281Medium· 4.7BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.
BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.
CVE-2025-61672MediumSynapse is an open source Matrix homeserver implementation
Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, un…
CVE-2025-61670Low· 3.3Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref`…
Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAssembly values. This is caused by a regression introduced during the development…
CVE-2025-59425High· 7.5vllm: Timing Attack in vLLM API Token Verification Leading to Authentication Bypass (CVE-2025-59425)
A flaw was found in vLLM’s API token authentication logic, where token comparisons were not performed in constant time. This weakness could allow an attacker to exploit timing differences to guess valid tokens and bypass authentication.
CVE-2025-61620Medium· 6.5vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server
vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server
CVE-2025-61784High· 7.6LLaMA-Factory is a tuning library for large language models
LLaMA-Factory is a tuning library for large language models. Prior to version 0.9.4, a Server-Side Request Forgery (SSRF) vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to …
CVE-2025-6242High· 7.1vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class
vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class
CVE-2025-6985High· 7.5langchain-text-splitters: XXE Vulnerability in langchain-text-splitters (CVE-2025-6985)
An XML external entity reference vulnerability has been discovered in the python langchain-text-splitters package. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed using lxml.etree.…
CVE-2025-59152High· 7.5Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion
Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion
CVE-2025-61765Medium· 6.4PoCpython-socketio is a Python implementation of the Socket.IO realtime client and server
python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious…
CVE-2025-8406Medium· 6.3ZenML is vulnerable to Path Traversal through its `PathMaterializer` class
ZenML is vulnerable to Path Traversal through its `PathMaterializer` class
CVE-2025-8917Medium· 5.8A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function
A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory,…
CVE-2025-53354Medium· 6.1NiceGUI is a Python-based UI framework
NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into the DOM using ui.html(). NiceGUI did not enforce HTML or JavaScript sanitizatio…
CVE-2025-61677Low· 2.5DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data
DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from e…