Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
GHSA-cjcg-cxmh-9wcrHigh· 7.5Praxis affected by HTTP/2 Bomb
Praxis affected by HTTP/2 Bomb
GHSA-6g2r-675j-hx59Low· 2.3xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release
xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release
GHSA-cm62-gvxx-vmxxHigh· 8.6Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
GHSA-8w8g-wq8h-fq33High· 8.6Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
GHSA-5fqc-mrg8-w798High· 8.6Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
GHSA-35mr-4567-66vgMedium· 6.5Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
GHSA-8mcx-5rqc-vhmfHigh· 8.8Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
CVE-2026-104874Medium· 5.3PoCMultidict is an implementation of a multidict data structure
Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - ope…
CVE-2026-104873High· 7.6LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.t…
CVE-2026-62314Medium· 5.8Anubis: Policy bypass via client controlled X-Original-URI header
Anubis: Policy bypass via client controlled X-Original-URI header
CVE-2026-104855Low· 2.0⚖ disputedWasmtime is a runtime for WebAssembly
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder …
CVE-2026-104851High· 8.8PoCfsspec is a specification and Python implementation framework for filesystem interfaces
fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unre…
GHSA-c9xm-49cp-xcr9Mediumrmcp OAuth client fetches server-controlled resource_metadata URLs
rmcp OAuth client fetches server-controlled resource_metadata URLs
CVE-2026-104843Medium· 5.9uv is a Python package and project manager written in Rust
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a…
CVE-2026-104437High· 7.4PoCZebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 tran…
CVE-2026-104436Low· 3.7Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages …
CVE-2026-104435High· 7.4Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output
Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more in…
CVE-2026-104434Medium· 6.5ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying inva…
ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying inva…
MAL-2026-17454Critical⚠ ExploitedMalicious code in gogets.dev/btreex (Go)
Malicious code in gogets.dev/btreex (Go)
MAL-2026-17453Critical⚠ ExploitedMalicious code in gocommunity.io/orderedbtree (Go)
Malicious code in gocommunity.io/orderedbtree (Go)
RUSTSEC-2026-0441None`pin-utils` is unmaintained
`pin-utils` is unmaintained
CVE-2026-73608High· 8.6SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class …
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route
MAL-2026-17422Critical⚠ ExploitedMalicious code in shortneer (PyPI)
Malicious code in shortneer (PyPI)
MAL-2026-17421Critical⚠ ExploitedMalicious code in spo365-graph (PyPI)
Malicious code in spo365-graph (PyPI)
MAL-2026-17419Critical⚠ ExploitedMalicious code in friendly-tools (PyPI)
Malicious code in friendly-tools (PyPI)
CVE-2026-51886Critical· 9.8PoClangflow-ai langflow v1.9.3 is affected by: Code Injection
langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-…
CVE-2026-73609Medium· 5.8SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering
SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering
GHSA-9cqf-hhrq-7v45High· 8.6SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class …
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route
CVE-2026-73606Medium· 5.8SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents refe…
SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block
CVE-2026-77387Medium· 4.0PoCgeopy is a geocoding library for Python
geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string withou…