Tagged “osv”
CVEs tagged osv, newest first.
7107 CVEsRSS
CVE-2026-95837High· 7.8containerd is an open-source container runtime
containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing th…
CVE-2026-104102Medium· 5.3copyparty is a portable file server
copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit travers…
CVE-2026-102663Medium· 4.3PoCOpenList is a file list program that supports multiple storage backends
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally …
CVE-2026-104774Medium· 5.8PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causin…
CVE-2026-41504Medium· 5.8PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without n…
CVE-2026-41510High· 7.2PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/url…
CVE-2026-41508Medium· 5.8OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPAR…
CVE-2026-57118Critical· 9.8PoCPraisonAI is a multi-agent teams system
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or…
CVE-2026-57143High· 8.8PoCPraisonAI is a multi-agent teams system
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port…
RUSTSEC-2026-0344High· 7.5Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)
Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)
RUSTSEC-2026-0369Critical· 9.1ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
MAL-2026-17757Critical⚠ ExploitedMalicious code in webreader (PyPI)
Malicious code in webreader (PyPI)
MAL-2026-17756Critical⚠ ExploitedMalicious code in pafer (PyPI)
Malicious code in pafer (PyPI)
MAL-2026-17755Critical⚠ ExploitedMalicious code in agent-vx (PyPI)
Malicious code in agent-vx (PyPI)
MAL-2026-17753Critical⚠ ExploitedMalicious code in media-manager5 (PyPI)
Malicious code in media-manager5 (PyPI)
MAL-2026-17752Critical⚠ ExploitedMalicious code in agentaix (PyPI)
Malicious code in agentaix (PyPI)
CVE-2026-111917Medium· 6.5PoCVikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
CVE-2026-111918Medium· 5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
CVE-2026-111919Medium· 6.5PoCVikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
CVE-2026-111920Medium· 5.4PoCVikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control…
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
CVE-2026-111922High· 6.3PoCVikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
CVE-2026-111921Medium· 5.4PoCVikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
RUSTSEC-2026-0368Nonezip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
RUSTSEC-2026-0367High· 7.3Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
RUSTSEC-2026-0337High· 7.5Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more
Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more
RUSTSEC-2026-0336High· 7.5MIKEY message MAC is never verified on receive, so forged messages are accepted
MIKEY message MAC is never verified on receive, so forged messages are accepted
RUSTSEC-2026-0335Critical· 9.1Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key
Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key
MAL-2026-17807Critical⚠ ExploitedMalicious code in py2ops (PyPI)
Malicious code in py2ops (PyPI)
MAL-2026-17713Critical⚠ ExploitedMalicious code in sharpnes (crates.io)
Malicious code in sharpnes (crates.io)
MAL-2026-17712Critical⚠ ExploitedMalicious code in ig-gox (PyPI)
Malicious code in ig-gox (PyPI)