Tagged “osv”
CVEs tagged osv, newest first.
7204 CVEsRSS
CVE-2025-1753High· 7.8llama-index: Command Injection in LLama-Index CLI in run-llama/llama_index (CVE-2025-1753)
A flaw was found in the LLama-Index CLI component. This vulnerability allows arbitrary code execution via unsanitized input to the --files argument, which is directly passed to os.system without proper validation or escaping. An attacker w…
CVE-2025-48383High· 8.2Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking
Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking
CVE-2025-5173Medium· 5.3HumanSignal label-studio-ml-backend Deserialization of Untrusted Data vulnerability
HumanSignal label-studio-ml-backend Deserialization of Untrusted Data vulnerability
CVE-2025-5148Medium· 5.3FunAudioLLM InspireMusic deserialization vulnerability
FunAudioLLM InspireMusic deserialization vulnerability
CVE-2025-5150Medium· 6.3docarray prototype pollution
docarray prototype pollution
CVE-2025-47277Critical· 9.8vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
CVE-2025-46724Critical· 9.8Langroid has a Code Injection vulnerability in TableChatAgent
Langroid has a Code Injection vulnerability in TableChatAgent
CVE-2025-46725HighLangroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store
Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store
CVE-2025-47273High· 7.1PoCsetuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)
A path traversal vulnerability in the Python setuptools library allows attackers with limited system access to write files outside the intended temporary directory by manipulating package download URLs. This flaw bypasses basic filename sa…
CVE-2025-47285LowVyper's `concat()` builtin may elide side-effects for zero-length arguments
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
CVE-2025-32962Medium· 4.3Flask-AppBuilder open redirect vulnerability using HTTP host injection
Flask-AppBuilder open redirect vulnerability using HTTP host injection
CVE-2025-47287High· 7.5Tornado vulnerable to excessive logging caused by malformed multipart form data
Tornado vulnerable to excessive logging caused by malformed multipart form data
CVE-2025-47774LowVyper's `slice()` may elide side-effects when output length is 0
Vyper's `slice()` may elide side-effects when output length is 0
CVE-2025-47782HighmotionEye vulnerable to RCE in add_camera Function Due to unsafe command execution
motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution
CVE-2025-27696High· 8.8Apache Superset Allows Ownership Takeover
Apache Superset Allows Ownership Takeover
CVE-2025-47278LowFlask uses fallback key instead of current signing key
Flask uses fallback key instead of current signing key
CVE-2025-1752High· 7.5LlamaIndex Vulnerable to Denial of Service (DoS)
LlamaIndex Vulnerable to Denial of Service (DoS)
CVE-2025-32873Medium· 5.3PoCDjango has a denial-of-service possibility in strip_tags()
Django has a denial-of-service possibility in strip_tags()
RUSTSEC-2025-0171Nonesoundness issue
soundness issue
CVE-2025-46814High· 7.5FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. A…
FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. An HTTP header injection vulnerability has been identified in versions prior to 2.0.0. By manipulatin…
CVE-2025-30165High· 8.0Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration
Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration
CVE-2025-47241Critical· 9.3Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL
Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL
CVE-2025-46726HighLangroid Allows XXE Injection via XMLToolMessage
Langroid Allows XXE Injection via XMLToolMessage
CVE-2025-46335MediumMobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
CVE-2025-46730Medium· 6.8Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack
Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack
CVE-2025-4166Medium· 4.5Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information
Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information
CVE-2025-46569HighOPA server Data API HTTP path injection of Rego
OPA server Data API HTTP path injection of Rego
CVE-2025-32444Critical· 10.0vLLM Vulnerable to Remote Code Execution via Mooncake Integration
vLLM Vulnerable to Remote Code Execution via Mooncake Integration
CVE-2025-46560Medium· 6.5phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service
phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service
CVE-2025-1194Medium· 4.3Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Transformers Regular Expression Denial of Service (ReDoS) vulnerability