Tagged “osv”
CVEs tagged osv, newest first.
7111 CVEsRSS
MAL-2026-17927Critical⚠ ExploitedMalicious code in fabtoolkit (PyPI)
Malicious code in fabtoolkit (PyPI)
MAL-2026-17926Critical⚠ ExploitedMalicious code in fabdeploycheck (PyPI)
Malicious code in fabdeploycheck (PyPI)
RUSTSEC-2026-0414High· 7.5Exponential event growth with `ENABLE_WIKILINKS`
Exponential event growth with `ENABLE_WIKILINKS`
MAL-2026-17921Critical⚠ ExploitedMalicious code in leakdeep (PyPI)
Malicious code in leakdeep (PyPI)
MAL-2026-17920Critical⚠ ExploitedMalicious code in voltswannts (PyPI)
Malicious code in voltswannts (PyPI)
MAL-2026-17919Critical⚠ ExploitedMalicious code in ukraine69 (PyPI)
Malicious code in ukraine69 (PyPI)
MAL-2026-17918Critical⚠ ExploitedMalicious code in tonemaptts (PyPI)
Malicious code in tonemaptts (PyPI)
MAL-2026-17917Critical⚠ ExploitedMalicious code in quasitonnts (PyPI)
Malicious code in quasitonnts (PyPI)
MAL-2026-17916Critical⚠ ExploitedMalicious code in pyrechoasr (PyPI)
Malicious code in pyrechoasr (PyPI)
MAL-2026-17915Critical⚠ ExploitedMalicious code in novalithtts (PyPI)
Malicious code in novalithtts (PyPI)
MAL-2026-17914Critical⚠ ExploitedMalicious code in glassbeakasr (PyPI)
Malicious code in glassbeakasr (PyPI)
MAL-2026-17913Critical⚠ ExploitedMalicious code in emberlytts (PyPI)
Malicious code in emberlytts (PyPI)
MAL-2026-17912Critical⚠ ExploitedMalicious code in driftwavets (PyPI)
Malicious code in driftwavets (PyPI)
CVE-2024-58398Medium· 4.3Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that,…
CVE-2025-71435Medium· 4.2Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular us…
CVE-2026-111932Low· 3.4Coder before 2.34.2 Stored HTML Injection via Appearance Settings
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without s…
CVE-2026-111933Low· 3.7Coder before 2.34.2 User Enumeration via Login Placeholder Hash
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a s…
RUSTSEC-2026-0410NoneWebAssembly allocator shim corrupts memory on allocation failure
WebAssembly allocator shim corrupts memory on allocation failure
RUSTSEC-2026-0406NoneUse-after-free when changing a multithreaded context with an unfinished frame
Use-after-free when changing a multithreaded context with an unfinished frame
RUSTSEC-2026-0405NoneOut-of-bounds read with an out-of-range `InBuffer::pos`
Out-of-bounds read with an out-of-range `InBuffer::pos`
RUSTSEC-2026-0404NoneDouble free in `DCtx::try_clone`
Double free in `DCtx::try_clone`
RUSTSEC-2026-0403NoneUninitialized memory exposed when streaming decompression of a legacy frame fails
Uninitialized memory exposed when streaming decompression of a legacy frame fails
RUSTSEC-2026-0402NoneHeap buffer overflow in `CCtx::try_clone` on a multithreaded context
Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
RUSTSEC-2026-0401NoneOut-of-bounds read in `train_from_buffer` when sample sizes overflow
Out-of-bounds read in `train_from_buffer` when sample sizes overflow
RUSTSEC-2026-0400NoneUse-after-free of a dictionary after a one-shot call on a context with an open stream
Use-after-free of a dictionary after a one-shot call on a context with an open stream
RUSTSEC-2026-0399NoneUse-after-free through `init_using_cdict` and `init_using_ddict`
Use-after-free through `init_using_cdict` and `init_using_ddict`
RUSTSEC-2026-0398None`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end
`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end
RUSTSEC-2026-0397None`OutBuffer::around_pos` exposes uninitialized memory
`OutBuffer::around_pos` exposes uninitialized memory
RUSTSEC-2026-0396None`Seekable` reads a NULL or out-of-bounds seek table
`Seekable` reads a NULL or out-of-bounds seek table
RUSTSEC-2026-0395NoneUse-after-free with `CParameter::StableInBuffer`
Use-after-free with `CParameter::StableInBuffer`