Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2026-86255Medium· 6.5wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endp…
MAL-2026-15938Critical⚠ ExploitedMalicious code in dac-tools (PyPI)
Malicious code in dac-tools (PyPI)
MAL-2026-15937NoneMalicious code in minecraftmodes (PyPI)
Malicious code in minecraftmodes (PyPI)
PYSEC-2026-4010High· 7.5Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit
Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit
PYSEC-2026-4009Critical· 9.1Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator
Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator
MAL-2026-15936NoneMalicious code in trongridew (PyPI)
Malicious code in trongridew (PyPI)
MAL-2026-15935Critical⚠ ExploitedMalicious code in proxycer (PyPI)
Malicious code in proxycer (PyPI)
MAL-2026-15934NoneMalicious code in dbt-sa-cli (PyPI)
Malicious code in dbt-sa-cli (PyPI)
RUSTSEC-2026-0292NoneDouble free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics
Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics
MAL-2026-16044Critical⚠ ExploitedMalicious code in tsshare (PyPI)
Malicious code in tsshare (PyPI)
CVE-2026-63464High· 7.7PoCnebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/w…
MAL-2026-15933NoneMalicious code in houdus (PyPI)
Malicious code in houdus (PyPI)
MAL-2026-15932NoneMalicious code in chartkit-core (PyPI)
Malicious code in chartkit-core (PyPI)
CVE-2026-72799Medium· 5.8SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers
SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers
CVE-2026-72794High· 8.6SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf
SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf
MAL-2026-15931Critical⚠ ExploitedMalicious code in metricboxlite (PyPI)
Malicious code in metricboxlite (PyPI)
MAL-2026-15930NoneMalicious code in tpu-raiden-jax (PyPI)
Malicious code in tpu-raiden-jax (PyPI)
MAL-2026-15929NoneMalicious code in pymaas (PyPI)
Malicious code in pymaas (PyPI)
MAL-2026-15928NoneMalicious code in olympuslib (PyPI)
Malicious code in olympuslib (PyPI)
MAL-2026-15927NoneMalicious code in qoeoe (PyPI)
Malicious code in qoeoe (PyPI)
MAL-2026-15926NoneMalicious code in astlsi (PyPI)
Malicious code in astlsi (PyPI)
MAL-2026-15910NoneMalicious code in timeweave (PyPI)
Malicious code in timeweave (PyPI)
CVE-2026-85175High· 8.8SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/…
SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/…
CVE-2026-68584High· 8.6SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)
SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)
MAL-2026-15864Critical⚠ ExploitedMalicious code in asti (PyPI)
Malicious code in asti (PyPI)
CVE-2024-33663Critical· 9.1python-jose algorithm confusion guard bypassed by DER-encoded public keys
python-jose algorithm confusion guard bypassed by DER-encoded public keys
CVE-2026-72806Medium· 5.8SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents with…
SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)
CVE-2026-72800Medium· 5.8SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeratio…
SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)
CVE-2026-68587High· 8.6SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rende…
SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check
CVE-2026-68586High· 8.6SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-f…
SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered