Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2026-69085Critical· 10.0PoCSiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
CVE-2026-73607Medium· 5.8SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no a…
SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check
CVE-2026-73605Medium· 5.8SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over…
SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem
CVE-2026-72788Medium· 5.8SiYuan discloses an administrator's open documents and search terms to anonymous readers
SiYuan discloses an administrator's open documents and search terms to anonymous readers
CVE-2026-103263Medium· 5.9PoCTornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static direc…
CVE-2026-103262High· 7.5PoCTornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decom…
CVE-2026-103261Medium· 5.3Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauth…
CVE-2026-50221Medium· 5.4OpenStack Swift vulnerable to authenticated server-side request forgery
OpenStack Swift vulnerable to authenticated server-side request forgery
CVE-2026-53964High· 7.2Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for u…
MAL-2026-17417Critical⚠ ExploitedMalicious code in beautifytext (PyPI)
Malicious code in beautifytext (PyPI)
MAL-2026-17416Critical⚠ ExploitedMalicious code in friendly-greeting-tools (PyPI)
Malicious code in friendly-greeting-tools (PyPI)
GHSA-c2m8-h5v5-343rHighTornado: StaticFileHandler follows symlinks outside static root (path traversal)
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
GHSA-chx6-46f5-w4vpHigh· 7.5tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
GHSA-3hv7-mjh2-fv65Medium· 5.3Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
CVE-2026-103001Medium· 6.5PoCPyJWT is a Python implementation of JSON Web Token standards
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses…
CVE-2026-103000High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length…
CVE-2026-102999High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each co…
CVE-2026-102998High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a lo…
CVE-2026-102997High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while …
CVE-2026-102996High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to pro…
CVE-2026-102995High· 7.5⚖ disputedpypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and re…
CVE-2026-102994High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and py…
CVE-2026-102993High· 7.5⚖ disputedpypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an applicatio…
CVE-2026-102991Medium· 6.5PoCMako is a template library written in Python
Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py validates them with os.path, w…
CVE-2026-103241Medium· 5.3PoC⚖ disputedA flaw has been found in vllm-project vLLM up to 0.26.0
A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of servi…
MAL-2026-17325Critical⚠ ExploitedMalicious code in cleanup-string (PyPI)
Malicious code in cleanup-string (PyPI)
MAL-2026-17319Critical⚠ ExploitedMalicious code in bfox-build-utils (PyPI)
Malicious code in bfox-build-utils (PyPI)
RUSTSEC-2026-0318NoneSending custom to-device messages may panics
Sending custom to-device messages may panics
RUSTSEC-2026-0317Medium· 5.5A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process
A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process
MAL-2026-17286Critical⚠ ExploitedMalicious code in queeuees (PyPI)
Malicious code in queeuees (PyPI)