Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
RUSTSEC-2026-0316NoneDynamic record lifting can allocate beyond the hostcall fuel limit
Dynamic record lifting can allocate beyond the hostcall fuel limit
RUSTSEC-2026-0315Medium· 5.7`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
RUSTSEC-2026-0314Medium· 6.2Guest can panic host through filesystem datetime overflow
Guest can panic host through filesystem datetime overflow
RUSTSEC-2026-0313Medium· 6.2Outgoing HTTP body write allows guest-driven host memory exhaustion
Outgoing HTTP body write allows guest-driven host memory exhaustion
RUSTSEC-2026-0312High· 7.4Excluded iPAddress name constraints with an all-zero mask are not applied
Excluded iPAddress name constraints with an all-zero mask are not applied
RUSTSEC-2026-0308NoneUse-after-free in interned values and cached function results
Use-after-free in interned values and cached function results
MAL-2026-17168Critical⚠ ExploitedMalicious code in vercel-runtime-python (PyPI)
Malicious code in vercel-runtime-python (PyPI)
MAL-2026-17167Critical⚠ ExploitedMalicious code in prosocks (PyPI)
Malicious code in prosocks (PyPI)
GHSA-2jx3-ff3v-j7jjMediumyara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB
yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB
GHSA-g28h-2cmm-rj9xHigh· 7.5langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs
langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs
CVE-2026-96747Medium· 5.0The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encrypt…
CVE-2026-96749High· 8.4⚖ disputedAn integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is perf…
CVE-2026-96748Medium· 6.5PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a conne…
CVE-2026-62286Medium· 4.3PoCDozzle is a realtime log viewer for docker containers
Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returne…
CVE-2026-61604Critical· 9.3The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet
The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolve…
CVE-2026-57175Medium· 6.4Python Social Auth is a social authentication/registration mechanism
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `Au…
CVE-2026-57178High· 7.4Python Social Auth is a social authentication/registration mechanism
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted. …
CVE-2026-57176Medium· 6.8Python Social Auth is a social authentication/registration mechanism
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same appli…
CVE-2026-85057High· 8.7ZITADEL is an open source identity management platform
ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action a…
CVE-2026-57177Medium· 4.3Python Social Auth is a social authentication/registration mechanism
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login C…
CVE-2026-85056High· 8.2ZITADEL is an open source identity management platform
ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a use…
CVE-2026-57179Medium· 4.2Python Social Auth is a social authentication/registration mechanism
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it…
CVE-2026-61732Critical· 10.0PoCDecepticon is an autonomous hacking agent for red teams
Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals.…
RUSTSEC-2026-0394NoneBuild environment compiled into the library and readable at runtime
Build environment compiled into the library and readable at runtime
RUSTSEC-2026-0307High· 7.1`uncbv`: archive extraction is vulnerable to path traversal (zip-slip)
`uncbv`: archive extraction is vulnerable to path traversal (zip-slip)
PYSEC-2026-3987NoneMemoryOS 2.0.34 was published with a credential-stealing binary
MemoryOS 2.0.34 was published with a credential-stealing binary
MAL-2026-16475Critical⚠ ExploitedMalicious code in memoryos (PyPI)
Malicious code in memoryos (PyPI)
CVE-2026-59980Medium· 6.3hpack is an HTTP/2 Header Encoding for Python
hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large en…
GHSA-8pcw-h6w9-h46gMedium· 6.5plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length
plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length
CVE-2026-96889High· 7.8PoCA flaw was found in librsvg
A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly fre…