Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2026-46438Medium· 6.5PoCwger is a free, open-source workout and fitness manager
wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api…
CVE-2026-46437Medium· 4.8PoCwger is a free, open-source workout and fitness manager
wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bearer-style API credentials remain valid after a user logs out and after a user …
CVE-2026-46434High· 7.1PoCwger is a free, open-source workout and fitness manager
wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `Use…
CVE-2026-45161Medium· 5.4wger is a free, open-source workout and fitness manager
wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login()` without any CSRF protection, because Django's `CsrfViewMiddleware` only en…
CVE-2026-43976High· 7.1PoCwger is a free, open-source workout and fitness manager
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gy…
CVE-2026-105192Critical· 9.8PoCLMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapp…
CVE-2020-37288Medium· 3.7Vyper: Return inside for loop more than 1 level deep
Vyper: Return inside for loop more than 1 level deep
RUSTSEC-2026-0333NoneResource budgets not enforced on the typed deserialization path
Resource budgets not enforced on the typed deserialization path
MAL-2026-17639Critical⚠ ExploitedMalicious code in lore-cs (PyPI)
Malicious code in lore-cs (PyPI)
CVE-2026-106454Medium· 4.3PoCTwisted is an event-based framework for internet applications, supporting Python 3.6+
Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters …
CVE-2026-106439High· 8.5PoCHydra is a framework for elegantly configuring complex applications
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An att…
CVE-2026-106440High· 7.8Hydra is a framework for elegantly configuring complex applications
Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom_search_space, resolves i…
CVE-2026-106441High· 7.8Hydra is a framework for elegantly configuring complex applications
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values o…
CVE-2026-106442High· 7.8Hydra is a framework for elegantly configuring complex applications
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the targe…
CVE-2026-106443High· 8.8WeasyPrint helps web developers to create PDF documents
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's gener…
GHSA-vg88-3v92-rjx2MediumVyper: Return inside for loop more than 1 level deep
Vyper: Return inside for loop more than 1 level deep
GHSA-4v7v-gqf9-ww2gMediumVyper: Call stack corruption when passing complex type containing non-base type members as argument
Vyper: Call stack corruption when passing complex type containing non-base type members as argument
GHSA-2r3x-4mrv-mcxfMediumVyper: Memory corruption using function calls within tuples / nested calls
Vyper: Memory corruption using function calls within tuples / nested calls
CVE-2026-26287High· 7.1External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization ord…
CVE-2026-105922Medium· 4.3PoC⚖ disputedA security flaw has been discovered in vllm-project vLLM up to 0.31.0
A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation re…
CVE-2026-105801High· 8.4openapi-python-client generates Python clients from OpenAPI documents
openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Py…
GHSA-j8f7-x8jm-wmm4MediumLangflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assist…
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
CVE-2026-10561Critical· 9.9Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
CVE-2026-105782High· 7.5Scrapy is a high-level web crawling and scraping framework for Python
Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path …
RUSTSEC-2026-0444None`astral-tl` is unmaintained
`astral-tl` is unmaintained
MAL-2026-17628Critical⚠ ExploitedMalicious code in erc7730-hackathon (PyPI)
Malicious code in erc7730-hackathon (PyPI)
GHSA-v853-p72q-4cfwHigh· 7.5Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
GHSA-6w6g-hm98-mhgmHighhickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)
hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)
GHSA-6f2x-v7q7-m7m5Mediumhickory-resolver follows irrelevant CNAME records
hickory-resolver follows irrelevant CNAME records
GHSA-2mjx-qc3c-rqvcMedium· 5.3Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries