Tagged “osv”
CVEs tagged osv, newest first.
7207 CVEsRSS
CVE-2025-22151Low· 3.7Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution
Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution
CVE-2024-55459Mediumkeras Path Traversal vulnerability
keras Path Traversal vulnerability
CVE-2024-53526Medium· 6.4Composio Command Execution vulnerability
Composio Command Execution vulnerability
CVE-2024-45033LowApache Airflow Fab Provider Insufficient Session Expiration vulnerability
Apache Airflow Fab Provider Insufficient Session Expiration vulnerability
CVE-2024-53995LowPoCGHSL-2024-288: SickChill open redirect in login
GHSL-2024-288: SickChill open redirect in login
CVE-2025-21613High· 8.1go-git: argument injection via the URL field (CVE-2025-21613)
An argument injection vulnerability was found in go-git. This flaw allows an attacker to set arbitrary values to git-upload-pack flags, leading to command or code execution, exposure of sensitive data, or other unintended behavior. This is…
CVE-2025-21618High· 7.5NiceGUI On Air authentication issue
NiceGUI On Air authentication issue
CVE-2024-52294Medium· 4.3khoj has an IDOR in subscription management allows unauthorized subscription modifications
khoj has an IDOR in subscription management allows unauthorized subscription modifications
CVE-2024-9774Medium· 6.5python-sql SQL injection vulnerability
python-sql SQL injection vulnerability
CVE-2024-56509High· 8.6changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal
changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal
CVE-2024-39025High· 7.5Letta (previously MemGPT) incorrect access control vulnerability
Letta (previously MemGPT) incorrect access control vulnerability
CVE-2024-12745High· 8.0Amazon Redshift Python Connector vulnerable to SQL Injection
Amazon Redshift Python Connector vulnerable to SQL Injection
MAL-2025-923NoneMalicious code in fflask (PyPI)
Malicious code in fflask (PyPI)
CVE-2024-9427Medium· 5.4Koji Cross-site Scripting
Koji Cross-site Scripting
CVE-2024-56326Medium· 6.3jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326)
A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python co…
CVE-2024-56201High· 7.3jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)
A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja's sandbox being used. An attacker needs …
CVE-2024-56327Critical· 9.8pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
RUSTSEC-2024-0433NoneMalicious plugin names, recipients, or identities can cause arbitrary binary execution
Malicious plugin names, recipients, or identities can cause arbitrary binary execution
RUSTSEC-2024-0432NoneMalicious plugin names, recipients, or identities can cause arbitrary binary execution
Malicious plugin names, recipients, or identities can cause arbitrary binary execution
GHSA-32gq-x56h-299cMediumage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
CVE-2024-56142Medium· 6.5PGHoard Path Traversal vulnerability
PGHoard Path Traversal vulnerability
CVE-2024-55949High· 8.1minio: Privilege escalation in IAM import API in MinIO (CVE-2024-55949)
A flaw was found in MinIO. Due to insufficient permissions checking in the IAM import API, a user may be able to change their policy mapping to escalate their privileges via a specially crafted configuration file.
CVE-2024-55890MediumPoCD-Tale allows Remote Code Execution through the Custom Filter Input
D-Tale allows Remote Code Execution through the Custom Filter Input
CVE-2024-55633Medium· 6.5Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
CVE-2024-55587High· 8.8PoCpython-libarchive directory traversal
python-libarchive directory traversal
CVE-2024-45337NonePoCMisuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
CVE-2024-55655Lowsigstore has insufficient validation of integration timestamp during verification
sigstore has insufficient validation of integration timestamp during verification
CVE-2024-53947Critical· 9.8Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
CVE-2024-53949Medium· 6.5Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
CVE-2024-46455Mediumunstructured XML External Entity (XXE)
unstructured XML External Entity (XXE)