Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
MAL-2026-17469Critical⚠ ExploitedMalicious code in infrabench (PyPI)
Malicious code in infrabench (PyPI)
MAL-2026-17468Critical⚠ ExploitedMalicious code in voxcpmintel (PyPI)
Malicious code in voxcpmintel (PyPI)
MAL-2026-17467Critical⚠ ExploitedMalicious code in voxcpmui4 (PyPI)
Malicious code in voxcpmui4 (PyPI)
MAL-2026-17466Critical⚠ ExploitedMalicious code in voxcpmkit (PyPI)
Malicious code in voxcpmkit (PyPI)
MAL-2026-17465Critical⚠ ExploitedMalicious code in voxcpmeval (PyPI)
Malicious code in voxcpmeval (PyPI)
MAL-2026-17464Critical⚠ ExploitedMalicious code in voxcpmui3 (PyPI)
Malicious code in voxcpmui3 (PyPI)
MAL-2026-17463Critical⚠ ExploitedMalicious code in voxcpmtts3 (PyPI)
Malicious code in voxcpmtts3 (PyPI)
MAL-2026-17462Critical⚠ ExploitedMalicious code in echogen (PyPI)
Malicious code in echogen (PyPI)
MAL-2026-17461Critical⚠ ExploitedMalicious code in voxel-tts (PyPI)
Malicious code in voxel-tts (PyPI)
CVE-2026-115386Low· 2.6fd_readdir copies uninitialized struct padding into guest memory
fd_readdir copies uninitialized struct padding into guest memory
CVE-2026-115382Medium· 4.8Wasmtime wasi:http implementation panics with a zero timeout supplied
Wasmtime wasi:http implementation panics with a zero timeout supplied
RUSTSEC-2026-0327NoneWasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
RUSTSEC-2026-0326Medium· 5.7Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
RUSTSEC-2026-0325NoneMis-typed WebAssembly tag imports can lead to GC heap corruption
Mis-typed WebAssembly tag imports can lead to GC heap corruption
RUSTSEC-2026-0324Medium· 6.2Guest can panic host through filesystem timestamp before the epoch on wasip3
Guest can panic host through filesystem timestamp before the epoch on wasip3
RUSTSEC-2026-0323Nonefd_readdir copies uninitialized struct padding into guest memory
fd_readdir copies uninitialized struct padding into guest memory
RUSTSEC-2026-0322NoneExcessive allocated memory on the host when guests don't have stdio
Excessive allocated memory on the host when guests don't have stdio
RUSTSEC-2026-0321Medium· 4.0WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
RUSTSEC-2026-0320NoneWasmtime wasi:http implementation panics with a zero timeout supplied
Wasmtime wasi:http implementation panics with a zero timeout supplied
RUSTSEC-2026-0319Noneanymap2 is unmaintained
anymap2 is unmaintained
CVE-2026-82234High· 8.2SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)
SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)
CVE-2026-82233Medium· 5.7SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)
SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)
MAL-2026-17457Critical⚠ ExploitedMalicious code in voxeval (PyPI)
Malicious code in voxeval (PyPI)
MAL-2026-17455Critical⚠ ExploitedMalicious code in dedh-devops-automation (PyPI)
Malicious code in dedh-devops-automation (PyPI)
GHSA-5wf9-h793-w73cHighXray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks
Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks
GHSA-jqmf-mx4f-hfr6Critical· 10.0Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
GHSA-5rmq-chc7-m22fHigh· 7.5Vibe-Trading file-read tools expose arbitrary server-readable files
Vibe-Trading file-read tools expose arbitrary server-readable files
GHSA-v2f8-6655-7grjCritical· 10.0Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
CVE-2026-74802Low· 0.0SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` by…
SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass
CVE-2026-74904High· 7.5SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mod…
SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers