Tagged “osv”
CVEs tagged osv, newest first.
7111 CVEsRSS
MAL-2026-18111Critical⚠ ExploitedMalicious code in hijiko-pilaka (PyPI)
Malicious code in hijiko-pilaka (PyPI)
MAL-2026-18110Critical⚠ ExploitedMalicious code in facewareretargeter (PyPI)
Malicious code in facewareretargeter (PyPI)
MAL-2026-18104Critical⚠ ExploitedMalicious code in semvver (PyPI)
Malicious code in semvver (PyPI)
MAL-2026-18103Critical⚠ ExploitedMalicious code in semverr (PyPI)
Malicious code in semverr (PyPI)
MAL-2026-18102Critical⚠ ExploitedMalicious code in semveer (PyPI)
Malicious code in semveer (PyPI)
MAL-2026-18101Critical⚠ ExploitedMalicious code in semmver (PyPI)
Malicious code in semmver (PyPI)
MAL-2026-18098Critical⚠ ExploitedMalicious code in security-research-startup-snapshot-810764b303 (PyPI)
Malicious code in security-research-startup-snapshot-810764b303 (PyPI)
MAL-2026-18097Critical⚠ ExploitedMalicious code in research-probe-6150c1c915 (PyPI)
Malicious code in research-probe-6150c1c915 (PyPI)
MAL-2026-18096Critical⚠ ExploitedMalicious code in workalender (PyPI)
Malicious code in workalender (PyPI)
MAL-2026-18095Critical⚠ ExploitedMalicious code in resion (PyPI)
Malicious code in resion (PyPI)
MAL-2026-18094Critical⚠ ExploitedMalicious code in pafex (PyPI)
Malicious code in pafex (PyPI)
MAL-2026-18093Critical⚠ ExploitedMalicious code in workcalender (PyPI)
Malicious code in workcalender (PyPI)
MAL-2026-18092Critical⚠ ExploitedMalicious code in test-workalendar-internal (PyPI)
Malicious code in test-workalendar-internal (PyPI)
CVE-2026-113729High· 7.5Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference dig…
CVE-2026-113731Low· 3.3PoCdjust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the find_handlers_for_template MCP tool in python/djust/mcp/server.py acc…
CVE-2026-113727High· 7.4OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the…
GHSA-hq85-5cpj-mr62Criticaluv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
GHSA-6q48-6c7w-9gw2Criticalcertifi bundles emSign root CAs with compromised intermediate CA keys
certifi bundles emSign root CAs with compromised intermediate CA keys
CVE-2026-105297High· 7.5Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
CVE-2026-105298Medium· 6.3Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
CVE-2026-105299High· 8.7Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
CVE-2026-112895High· 7.5Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
CVE-2026-112897High· 7.5PoCPillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
CVE-2026-112896High· 7.1PoCPillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
CVE-2026-112400High· 7.5PoCPillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
CVE-2026-112403Critical· 9.8PoCPillow: Heap buffer overflow in ImagingJpegDecode
Pillow: Heap buffer overflow in ImagingJpegDecode
CVE-2026-112397High· 7.5PoCPillow: Out-of-bounds access in _imagingmorph on a zero-width image
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
CVE-2026-111065Medium· 6.9AIOHTTP: Connector pool exhaustion via Max-Age overflow
AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111748Medium· 6.3AIOHTTP: Absolute-form request targets can spoof Request.scheme
AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-121441Low· 3.7`wasi-http`: Guests can add conflicting content lengths to messages
`wasi-http`: Guests can add conflicting content lengths to messages