Tagged “osv”
CVEs tagged osv, newest first.
7204 CVEsRSS
CVE-2025-53010LowMaterialX Null Pointer Dereference in getShaderNodes due to Unchecked nodeGraph->getOutput return
MaterialX Null Pointer Dereference in getShaderNodes due to Unchecked nodeGraph->getOutput return
CVE-2025-54576High· 7.4github.com/oauth2-proxy/oauth2-proxy: OAuth2-Proxy authentication bypass (CVE-2025-54576)
An authentication bypass flaw was found in the OAuth2-Proxy project. This bypass affects systems that have configured their deployment to skip authentication on endpoints that match a deployment-defined regular expression. HTTP parameters …
CVE-2021-21411Medium· 5.5OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0
OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0
CVE-2025-54381Critical· 9.9PoCBentoML SSRF Vulnerability in File Upload Processing
BentoML SSRF Vulnerability in File Upload Processing
CVE-2025-54433HighBugsink path traversal via event_id in ingestion
Bugsink path traversal via event_id in ingestion
CVE-2025-54423Medium· 5.4copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata
copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata
CVE-2025-54412HighSkops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution
Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution
CVE-2025-55013Medium· 4.2Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code
Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code
CVE-2025-54413HighSkops may allow MethodNode to access unexpected object fields through dot notation, leading to arbitrary code execution at load time
Skops may allow MethodNode to access unexpected object fields through dot notation, leading to arbitrary code execution at load time
CVE-2025-54379High· 9.8eKuiper API endpoints handling SQL queries with user-controlled table names.
eKuiper API endpoints handling SQL queries with user-controlled table names.
CVE-2025-7404MediumPoCCalibre Web and Autocaliweb have OS Command Injection vulnerability
Calibre Web and Autocaliweb have OS Command Injection vulnerability
CVE-2025-6998HighPoCCalibre Web and Autocaliweb have a ReDoS vulnerability
Calibre Web and Autocaliweb have a ReDoS vulnerability
CVE-2025-54365HighFastAPI Guard has a regex bypass
FastAPI Guard has a regex bypass
CVE-2025-51481Medium· 6.6Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read a…
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookD…
CVE-2025-51464MediumAim vulnerable to Cross-site Scripting
Aim vulnerable to Cross-site Scripting
CVE-2025-54140High· 7.5`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write
`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write
CVE-2025-54121Medium· 5.3Starlette has possible denial-of-service vector when parsing large files in multipart forms
Starlette has possible denial-of-service vector when parsing large files in multipart forms
CVE-2025-53901Low· 3.3Host panic with `fd_renumber` WASIp1 function
Host panic with `fd_renumber` WASIp1 function
CVE-2025-22868High· 7.5golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
CVE-2025-54059Medium· 4.4melange's world-writable permissions expose SBOM files to potential image tampering
melange's world-writable permissions expose SBOM files to potential image tampering
CVE-2025-3415Medium· 4.3PoCGrafana's insecure DingDing Alert integration exposes sensitive information
Grafana's insecure DingDing Alert integration exposes sensitive information
CVE-2025-53893HighFile Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing
File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing
CVE-2025-53826HighFile Browser’s insecure JWT handling can lead to session replay attacks after logout
File Browser’s insecure JWT handling can lead to session replay attacks after logout
RUSTSEC-2025-0172None`zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead
`zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead
CVE-2025-53890Critical· 9.8pyLoad vulnerable to XSS through insecure CAPTCHA
pyLoad vulnerable to XSS through insecure CAPTCHA
CVE-2025-29606Medium· 4.3py-libp2p is vulnerable to DoS attacks through use of large RSA keys
py-libp2p is vulnerable to DoS attacks through use of large RSA keys
CVE-2025-53640MediumPoCIndico vulnerability allows attackers to bulk dump user details
Indico vulnerability allows attackers to bulk dump user details
CVE-2025-53643Low· 3.7aiohttp: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643)
A request smuggling flaw was found in the aiohttp python library. If a pure Python version of aiohttp is installed, without the usual C extensions, for example, or if AIOHTTP_NO_EXTENSIONS is enabled, an attacker can execute a request smug…
CVE-2025-53549Nonematrix-sdk-sqlite: SQL injection vulnerability in `SqliteEventCacheStore::find_event_with_relations`
matrix-sdk-sqlite: SQL injection vulnerability in `SqliteEventCacheStore::find_event_with_relations`
CVE-2025-7453Low· 3.7ZPan Uses Hard-Coded Password
ZPan Uses Hard-Coded Password