Tagged “osv”
CVEs tagged osv, newest first.
7181 CVEsRSS
CVE-2026-107291Medium· 4.3⚖ disputedPydantic AI is a Python agent framework for building applications and workflows with Generative AI
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can sti…
CVE-2026-107290Medium· 6.5Pydantic AI is a Python agent framework for building applications and workflows with Generative AI
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with q…
CVE-2026-61437High· 7.8PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow
PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow
CVE-2026-61432Medium· 5.7PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace
PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace
CVE-2026-61443High· 8.1PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
CVE-2026-107289Medium· 6.8⚖ disputedPydantic AI is a Python agent framework for building applications and workflows with Generative AI
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force…
CVE-2026-107287Medium· 6.5Pydantic AI is a Python agent framework for building applications and workflows with Generative AI
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory durin…
CVE-2026-107286High· 7.5Pydantic AI is a Python agent framework for building applications and workflows with Generative AI
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency…
GO-2026-6632NoneSiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class …
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel
CVE-2026-61441Medium· 6.5PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
CVE-2026-107225Medium· 6.5PoCExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. Fi…
CVE-2026-107224Medium· 6.5PoCExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks an…
CVE-2026-107223High· 7.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reach…
CVE-2026-107222Medium· 6.5PoCExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating mal…
CVE-2026-107221Medium· 6.5PoCExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit c…
CVE-2026-107220Medium· 6.5PoCExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange w…
CVE-2026-107219High· 7.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before veri…
CVE-2026-107218Medium· 5.3Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIG…
CVE-2026-107217High· 7.5PoCExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective b…
CVE-2026-56851High· 7.5The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.
The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.
CVE-2026-107216High· 7.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh calculation context at each cycle and bypas…
CVE-2026-107215High· 7.5PoCExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector c…
CVE-2026-107214High· 7.5PoCExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, i…
CVE-2026-107213Medium· 5.5⚖ disputedExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element ex…
CVE-2026-107212High· 7.5PoCExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows rel…
CVE-2026-107211Medium· 5.5⚖ disputedExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPi…
CVE-2026-62253Critical· 9.8PoCHomer is open source telecom observability software
Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret defaults to an empt…
CVE-2026-62252Critical· 9.8PoCHomer is open source telecom observability software
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` …
CVE-2026-62251High· 8.1Homer is open source telecom observability software
Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used …
CVE-2026-61436High· 8.6PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents