Tagged “osv”
CVEs tagged osv, newest first.
7111 CVEsRSS
CVE-2026-100350Medium· 5.3PoCkin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.Decod…
CVE-2026-100348Medium· 5.3kin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its ow…
CVE-2026-100349High· 8.2kin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The…
CVE-2026-100351High· 7.4PoCkin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPa…
CVE-2026-100352High· 7.5PoCkin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-num…
MAL-2026-17886Critical⚠ ExploitedMalicious code in py-wormgpt (PyPI)
Malicious code in py-wormgpt (PyPI)
MAL-2026-17885Critical⚠ ExploitedMalicious code in proxyrubika (PyPI)
Malicious code in proxyrubika (PyPI)
MAL-2026-17884Critical⚠ ExploitedMalicious code in getpubip (PyPI)
Malicious code in getpubip (PyPI)
MAL-2026-17883Critical⚠ ExploitedMalicious code in py-worm (PyPI)
Malicious code in py-worm (PyPI)
MAL-2026-17881Critical⚠ ExploitedMalicious code in py-sock2 (PyPI)
Malicious code in py-sock2 (PyPI)
CVE-2026-57496Critical· 9.6PoCNetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_nu…
CVE-2026-63430Medium· 6.3PoCammonia is a Rust library for repairing and securing untrusted HTML
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding…
CVE-2026-119133NoneException tags can cause host data structures to be unaligned
Exception tags can cause host data structures to be unaligned
CVE-2026-119134Medium· 6.2Component-model handle tables are capped only per instance and charged to no limit
Component-model handle tables are capped only per instance and charged to no limit
CVE-2026-119138NonePanic when pending calls are run after a trap
Panic when pending calls are run after a trap
CVE-2026-119137Medium· 5.3Stack overflow dropping a long chain of recursive types
Stack overflow dropping a long chain of recursive types
CVE-2026-119141Medium· 5.3Panic on erroneous call-to-host from guest realloc call
Panic on erroneous call-to-host from guest realloc call
CVE-2026-119142NoneHost panic when component `call_async` is cancelled under some conditions
Host panic when component `call_async` is cancelled under some conditions
CVE-2026-119130NoneGuests can send absolute-form HTTP requests to different hosts
Guests can send absolute-form HTTP requests to different hosts
RUSTSEC-2026-0365High· 7.5Remote DoS through unchecked `IdList` allocation in negentropy
Remote DoS through unchecked `IdList` allocation in negentropy
RUSTSEC-2026-0364NoneException tags can cause host data structures to be unaligned
Exception tags can cause host data structures to be unaligned
RUSTSEC-2026-0363Medium· 6.2Component-model handle tables are capped only per instance and charged to no limit
Component-model handle tables are capped only per instance and charged to no limit
RUSTSEC-2026-0362NoneWasmtime may not properly enforce async-entrypoint requirement
Wasmtime may not properly enforce async-entrypoint requirement
RUSTSEC-2026-0361NonePanic when pending calls are run after a trap
Panic when pending calls are run after a trap
RUSTSEC-2026-0360NoneOverlapping string transcode in a fused adapter can panic
Overlapping string transcode in a fused adapter can panic
RUSTSEC-2026-0359Medium· 5.3Stack overflow dropping a long chain of recursive types
Stack overflow dropping a long chain of recursive types
RUSTSEC-2026-0358NoneYielding in a component start function can lead to a host panic
Yielding in a component start function can lead to a host panic
RUSTSEC-2026-0357NoneOut-of-bounds zero-length stream writes can panic
Out-of-bounds zero-length stream writes can panic
RUSTSEC-2026-0356Medium· 5.3Panic on erroneous call-to-host from guest realloc call
Panic on erroneous call-to-host from guest realloc call
RUSTSEC-2026-0355NonePanic viewing component model stream or future as the wrong type
Panic viewing component model stream or future as the wrong type