Tagged “osv”
CVEs tagged osv, newest first.
7206 CVEsRSS
CVE-2025-55304LowExiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata
Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata
CVE-2025-58068MediumEventlet affected by HTTP request smuggling in unparsed trailers
Eventlet affected by HTTP request smuggling in unparsed trailers
CVE-2025-54080LowExiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file
CVE-2025-58050Critical· 9.1The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow re…
The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the han…
CVE-2025-48956High· 7.5vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests (CVE-2025-48956)
A flaw was found in vLLM. A denial of service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large X-Forwarded-For header to an HTTP endpoint. This results in server memory exhaustion, potential…
CVE-2025-11058Highxml2rfc has an arbitrary file read vulnerability
xml2rfc has an arbitrary file read vulnerability
CVE-2025-5302High· 8.6LlamaIndex affected by a Denial of Service (DOS) in JSONReader
LlamaIndex affected by a Denial of Service (DOS) in JSONReader
GHSA-63cx-g855-hvv4Mediummitmproxy binaries embed a vulnerable python-hyper/h2 dependency
mitmproxy binaries embed a vulnerable python-hyper/h2 dependency
CVE-2025-57804Mediumh2 allows HTTP Request Smuggling due to illegal characters in headers
h2 allows HTTP Request Smuggling due to illegal characters in headers
CVE-2025-57809High· 7.5xgrammar: XGrammar affected by Denial of Service by infinite recursion grammars (CVE-2025-57809)
A flaw was found in xgrammar. Recursive grammar definitions could trigger infinite recursion during parsing in GrammarMatcherBase::ExpandEquivalentStackElements, leading to unbounded stack growth and a segmentation fault. This vulnerabilit…
CVE-2025-57760High· 8.8Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)
Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)
CVE-2025-57751HighDenial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
CVE-2025-9141High· 8.8vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder
vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder
CVE-2025-55214MediumCopier's safe template has filesystem write access outside destination path
Copier's safe template has filesystem write access outside destination path
CVE-2025-55201HighCopier's safe template has arbitrary filesystem read/write access
Copier's safe template has arbitrary filesystem read/write access
CVE-2025-55675MediumApache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
CVE-2025-55674MediumApache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
CVE-2025-55672MediumApache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
CVE-2025-55673MediumApache Superset data query improperly discloses database schema information to low-privileged guest user
Apache Superset data query improperly discloses database schema information to low-privileged guest user
CVE-2025-54791Medium· 5.3OMERO.web displays unecessary user information when requesting password reset
OMERO.web displays unecessary user information when requesting password reset
CVE-2025-55197MediumPyPDF's Manipulated FlateDecode streams can exhaust RAM
PyPDF's Manipulated FlateDecode streams can exhaust RAM
CVE-2025-55159NoneOut-of-bounds access in `get_disjoint_mut` due to incorrect bounds check
Out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check
CVE-2025-5187Medium· 6.7kubernetes: kube-apiserver: Nodes can delete themselves by adding an OwnerReference (CVE-2025-5187)
A vulnerability was found in the kube-apiserver's NodeRestriction admission controller, where node users can delete their corresponding node object by setting their own OwnerReference to a cluster-scoped resource. This flaw allows an attac…
CVE-2025-8747High· 8.8Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
CVE-2025-55156HighPyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
CVE-2025-55149MediumTinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)
TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)
CVE-2025-54951Critical· 9.8ExecuTorch vulnerable to Heap-based Buffer Overflow
ExecuTorch vulnerable to Heap-based Buffer Overflow
CVE-2025-54949Critical· 9.8ExecuTorch heap buffer overflow vulnerability
ExecuTorch heap buffer overflow vulnerability
CVE-2025-54950Critical· 9.8ExecuTorch out-of-bounds access vulnerability
ExecuTorch out-of-bounds access vulnerability
CVE-2025-30405Critical· 9.8ExecuTorch integer overflow vulnerability
ExecuTorch integer overflow vulnerability