Tagged “osv”
CVEs tagged osv, newest first.
7207 CVEsRSS
CVE-2024-27315Medium· 4.3Apache Superset: Improper error handling on alerts
Apache Superset: Improper error handling on alerts
CVE-2024-27083Medium· 4.3Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
CVE-2024-24773Medium· 4.9Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
CVE-2024-26016Medium· 4.3Apache Superset: Improper authorization validation on dashboards and charts import
Apache Superset: Improper authorization validation on dashboards and charts import
CVE-2024-25170MediumPoCMezzanine allows attackers to bypass access controls via manipulating the Host header
Mezzanine allows attackers to bypass access controls via manipulating the Host header
CVE-2024-25723Medium· 6.5PoCZenML Server Remote Privilege Escalation Vulnerability
ZenML Server Remote Privilege Escalation Vulnerability
CVE-2024-27444Critical· 9.8LangChain Experimental vulnerable to arbitrary code execution
LangChain Experimental vulnerable to arbitrary code execution
CVE-2024-27454High· 7.5orjson does not limit recursion for deeply nested JSON documents
orjson does not limit recursion for deeply nested JSON documents
CVE-2024-0243Low· 3.7langchain Server-Side Request Forgery vulnerability
langchain Server-Side Request Forgery vulnerability
CVE-2024-27318High· 7.5Onnx Directory Traversal vulnerability
Onnx Directory Traversal vulnerability
CVE-2024-27319Medium· 4.4Onnx Out-of-bounds Read vulnerability
Onnx Out-of-bounds Read vulnerability
CVE-2024-1729Medium· 5.9Gradio apps vulnerable to timing attacks to guess password
Gradio apps vulnerable to timing attacks to guess password
CVE-2024-26151High· 8.2Potentially untrusted input is rendered as HTML in final output
Potentially untrusted input is rendered as HTML in final output
CVE-2024-26130High· 7.5cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private …
cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
CVE-2024-25141Critical· 9.1Improper Certificate Validation in apache airflow mongo hook
Improper Certificate Validation in apache airflow mongo hook
CVE-2024-25630Medium· 6.1Unencrypted ingress/health traffic when using Wireguard transparent encryption
Unencrypted ingress/health traffic when using Wireguard transparent encryption
CVE-2024-3572High· 7.5Scrapy decompression bomb vulnerability
Scrapy decompression bomb vulnerability
CVE-2024-3574High· 7.5Scrapy authorization header leakage on cross-domain redirect
Scrapy authorization header leakage on cross-domain redirect
CVE-2024-1485High· 8.0registry-support: decompress can delete files outside scope via relative paths
registry-support: decompress can delete files outside scope via relative paths
CVE-2023-6152Medium· 5.4Email Validation Bypass And Preventing Sign Up From Email's Owner
Email Validation Bypass And Preventing Sign Up From Email's Owner
CVE-2024-24762High· 7.5python-multipart vulnerable to Content-Type Header ReDoS
python-multipart vulnerable to Content-Type Header ReDoS
CVE-2024-1402Medium· 4.3Mattermost vulnerable to denial of service via large number of emoji reactions
Mattermost vulnerable to denial of service via large number of emoji reactions
CVE-2024-21624Medium· 5.7NoneBot Potential Information Leak in User-Constructed Message Templates
NoneBot Potential Information Leak in User-Constructed Message Templates
CVE-2023-29483Medium· 5.9dnspython: denial of service in stub resolver (CVE-2023-29483)
The dnspython stub resolver is vulnerable to a denial of service (DoS) risk if an attacker sends a malicious response forged with the correct address and port before a legitimate one arrives on the UDP port used by dnspython for the query.…
CVE-2024-24825Critical· 9.1DIRAC's TokenManager does not check permissions on cached tokens
DIRAC's TokenManager does not check permissions on cached tokens
CVE-2023-32192High· 8.3Rancher API Server Cross-site Scripting Vulnerability
Rancher API Server Cross-site Scripting Vulnerability
CVE-2024-23448Medium· 5.7APM Server vulnerable to Insertion of Sensitive Information into Log File
APM Server vulnerable to Insertion of Sensitive Information into Log File
CVE-2024-1314High· 8.6Kinto Attachment's attachments can be replaced on read-only records
Kinto Attachment's attachments can be replaced on read-only records
CVE-2024-24811Critical· 9.8SQLAlchemyDA unauthenticated arbitrary SQL query execution
SQLAlchemyDA unauthenticated arbitrary SQL query execution
CVE-2024-24563Critical· 9.8Vyper negative array index bounds checks
Vyper negative array index bounds checks