Tagged “osv”
CVEs tagged osv, newest first.
7204 CVEsRSS
CVE-2025-49652Critical· 9.8PoCMissing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.
Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.
CVE-2025-49653High· 8.0BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
CVE-2025-49651High· 8.1Backend.AI Missing Authorization vulnerability
Backend.AI Missing Authorization vulnerability
CVE-2024-47081Medium· 5.3Requests vulnerable to .netrc credentials leak via malicious URLs
Requests vulnerable to .netrc credentials leak via malicious URLs
CVE-2025-49619High· 8.5PoCSkyvern has a Jinja runtime leak
Skyvern has a Jinja runtime leak
CVE-2025-5791High· 7.1Users: `root` appended to group listings
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in …
CVE-2025-48432Medium· 4.0Django Improper Output Neutralization for Logs vulnerability
Django Improper Output Neutralization for Logs vulnerability
CVE-2025-1793Critical· 9.8llama_index vulnerable to SQL Injection
llama_index vulnerable to SQL Injection
CVE-2025-48995MediumSignXML's signature verification with HMAC is vulnerable to a timing attack
SignXML's signature verification with HMAC is vulnerable to a timing attack
CVE-2025-48994MediumSignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack
SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack
CVE-2025-48957High· 7.5AstrBot Has Path Traversal Vulnerability in /api/chat/get_file
AstrBot Has Path Traversal Vulnerability in /api/chat/get_file
CVE-2025-30167High· 7.3Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
CVE-2025-48935None--allow-read / --allow-write permission bypass in `node:sqlite`
--allow-read / --allow-write permission bypass in `node:sqlite`
RUSTSEC-2025-0173None`PamHandle::get_user` can cause an authentication bypass
`PamHandle::get_user` can cause an authentication bypass
CVE-2025-3260High· 8.3A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions
A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers…
CVE-2025-1750Critical· 9.8LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
CVE-2025-1792Low· 3.1Mattermost fails to properly enforce access controls for guest users
Mattermost fails to properly enforce access controls for guest users
CVE-2025-3611Low· 3.1Mattermost fails to properly enforce access control restrictions for System Manager roles
Mattermost fails to properly enforce access control restrictions for System Manager roles
CVE-2025-48912HighApache Superset: Improper authorization bypass on row level security via SQL Injection
Apache Superset: Improper authorization bypass on row level security via SQL Injection
CVE-2025-5320Low· 3.7Gradio CORS Origin Validation Bypass Vulnerability
Gradio CORS Origin Validation Bypass Vulnerability
CVE-2025-5321Medium· 6.3Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution
Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution
CVE-2025-47933Critical· 9.0Argo CD allows cross-site scripting on repositories page
Argo CD allows cross-site scripting on repositories page
CVE-2025-48887Medium· 6.5vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`
vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`
CVE-2025-46722Medium· 4.2vLLM has a Weakness in MultiModalHasher Image Hashing Implementation
vLLM has a Weakness in MultiModalHasher Image Hashing Implementation
CVE-2025-48943Medium· 6.5vLLM allows clients to crash the openai server with invalid regex
vLLM allows clients to crash the openai server with invalid regex
CVE-2025-48942Medium· 6.5vLLM DOS: Remotely kill vllm over http with invalid JSON schema
vLLM DOS: Remotely kill vllm over http with invalid JSON schema
CVE-2025-46570Low· 2.6Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching
Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching
CVE-2025-48944Medium· 6.5vLLM Tool Schema allows DoS via Malformed pattern and type Fields
vLLM Tool Schema allows DoS via Malformed pattern and type Fields
CVE-2025-5279High· 7.5Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin
Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin
CVE-2025-1753High· 7.8llama-index: Command Injection in LLama-Index CLI in run-llama/llama_index (CVE-2025-1753)
A flaw was found in the LLama-Index CLI component. This vulnerability allows arbitrary code execution via unsanitized input to the --files argument, which is directly passed to os.system without proper validation or escaping. An attacker w…