Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
MAL-2026-14339NoneMalicious code in proc_macro_en (crates.io)
Malicious code in proc_macro_en (crates.io)
MAL-2026-14338NoneMalicious code in proc_macro1 (crates.io)
Malicious code in proc_macro1 (crates.io)
MAL-2026-14337NoneMalicious code in internment (crates.io)
Malicious code in internment (crates.io)
MAL-2026-14336NoneMalicious code in arrayref (crates.io)
Malicious code in arrayref (crates.io)
MAL-2026-14335NoneMalicious code in aronenao (crates.io)
Malicious code in aronenao (crates.io)
MAL-2026-14334NoneMalicious code in arone (crates.io)
Malicious code in arone (crates.io)
MAL-2026-14333NoneMalicious code in append_only_vec (crates.io)
Malicious code in append_only_vec (crates.io)
MAL-2026-14332NoneMalicious code in aovine (crates.io)
Malicious code in aovine (crates.io)
RUSTSEC-2026-0266None`internment` 0.8.7 was removed from crates.io due to a malicious dependency
`internment` 0.8.7 was removed from crates.io due to a malicious dependency
RUSTSEC-2026-0265None`proc-macro1` was removed from crates.io due to malicious code
`proc-macro1` was removed from crates.io due to malicious code
RUSTSEC-2026-0264None`proc-macro-en` was removed from crates.io due to malicious code
`proc-macro-en` was removed from crates.io due to malicious code
RUSTSEC-2026-0263None`tinymember` was removed from crates.io due to affiliation with malicious code
`tinymember` was removed from crates.io due to affiliation with malicious code
RUSTSEC-2026-0262None`append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency
`append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency
RUSTSEC-2026-0261None`aronenao` was removed from crates.io due to malicious code
`aronenao` was removed from crates.io due to malicious code
RUSTSEC-2026-0260None`arrayref` 0.3.10 was removed from crates.io due to a malicious dependency
`arrayref` 0.3.10 was removed from crates.io due to a malicious dependency
RUSTSEC-2026-0259None`arone` was removed from crates.io due to malicious code
`arone` was removed from crates.io due to malicious code
GHSA-22w5-2fxg-vrwxLow· 2.6OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or c…
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers
CVE-2026-54622Medium· 6.5django CMS: Clipboard copy IDOR discloses unauthorized plugin content
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
CVE-2026-54624Medium· 6.5django CMS: Structure endpoint bypasses page-view permission
django CMS: Structure endpoint bypasses page-view permission
CVE-2026-75526Medium· 4.4django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values…
CVE-2026-63003Medium· 6.5django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePa…
CVE-2026-61663Medium· 4.3django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
GHSA-jm5p-837g-rv8gMedium· 6.5Wagtail: Improper restriction handling on Page translation API endpoint
Wagtail: Improper restriction handling on Page translation API endpoint
GHSA-9w56-46f6-3qhxMedium· 5.5asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
CVE-2026-76216High· 7.5Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share …
CVE-2026-76234High· 7.5libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs
libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping ch…
MAL-2026-14308NoneMalicious code in libasync (PyPI)
Malicious code in libasync (PyPI)
MAL-2026-14306NoneMalicious code in rc4-secure (PyPI)
Malicious code in rc4-secure (PyPI)
CVE-2026-76237Highstigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in the quarantine review endpoints
stigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count qu…
CVE-2026-76245Highstigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired
stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliab…