Tagged “osv”
CVEs tagged osv, newest first.
7055 CVEsRSS
CVE-2026-118651Medium· 5.3Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make…
CVE-2026-118653Medium· 5.3Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
CVE-2026-118266Medium· 5.3Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
CVE-2026-118652Medium· 6.1Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
CVE-2026-118650High· 7.5Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
CVE-2026-118261High· 8.2Echo: Decompress permits unbounded gzip expansion in v4
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a han…
CVE-2026-118265Medium· 5.3Echo: X-Real-IP extractor trusts the header value instead of the sending peer
Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Ech…
CVE-2026-54462Medium· 6.5knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
CVE-2026-117601High· 7.5Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
CVE-2026-116586Medium· 6.9Go JOSE: Panics in JSON parsing
Go JOSE: Panics in JSON parsing
CVE-2026-116585Medium· 6.9Go JOSE: Panic during CBC-HMAC processing
Go JOSE: Panic during CBC-HMAC processing
CVE-2026-115927Medium· 5.3Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
CVE-2026-116575Medium· 6.3Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
CVE-2026-116577Medium· 5.3Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
CVE-2026-116578Low· 2.1Tornado: Open redirect in RedirectHandler via protocol-relative URLs
Tornado: Open redirect in RedirectHandler via protocol-relative URLs
CVE-2026-116579Medium· 5.9Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
CVE-2026-115910Medium· 6.8Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the …
Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim
CVE-2026-115911Medium· 6.5vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
CVE-2026-115912High· 7.5vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
CVE-2026-115913Medium· 6.5vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
CVE-2026-115916Medium· 6.5vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
CVE-2026-115917Low· 3.4vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
CVE-2026-115915High· 8.1vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
CVE-2026-115914Medium· 6.5vLLM DeepSeek-OCR image processing vulnerable to denial of service
vLLM DeepSeek-OCR image processing vulnerable to denial of service
CVE-2026-115919Medium· 6.2ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
CVE-2026-115918Medium· 6.5vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
CVE-2026-115921Medium· 6.2ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
CVE-2026-115920Medium· 6.2ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
CVE-2026-115922Medium· 6.2ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
CVE-2026-115905Critical· 10.0PoCzip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Over…
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE