Tagged “osv”

CVEs tagged osv, newest first.

7180 CVEsRSS

CVE-2026-68872Medium· 6.5

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deploymen…

▾ Sunlitapache · apache-airflow-providers-amazonEPSS 0.60%via NVD

MAL-2026-13712None

3mo ago

A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function

A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving…

▾ Sunlitkeras · kerasEPSS 0.19%via NVD

MAL-2026-13667None

3mo ago

Malicious code in kotanku (PyPI)

▾ Sunlitkotanku · kotankuvia OSV

CVE-2026-12372Low· 3.7

3mo ago

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, f…

▾ Sunlitnltk · nltkEPSS 0.26%via NVD

RUSTSEC-2026-0242None

3mo ago

Safe ErrorRegistry APIs can cause undefined behavior

▾ Sunlitdcrypt-api · dcrypt-apivia OSV

RUSTSEC-2026-0240None

3mo ago

Ed25519 identity public keys permit universal signature forgery

▾ Sunlitdcrypt-sign · dcrypt-signvia OSV

RUSTSEC-2026-0239None

3mo ago

Streaming AEAD does not authenticate stream structure

▾ Sunlitdcrypt-symmetric · dcrypt-symmetricvia OSV

RUSTSEC-2026-0238None

3mo ago

Low-level GCM ignores the operation nonce

▾ Sunlitdcrypt-algorithms · dcrypt-algorithmsvia OSV

MAL-2026-13666None

3mo ago

Malicious code in cubesat-upstream-driver (PyPI)

▾ Sunlitcubesat-upstream-driver · cubesat-upstream-drivervia OSV

MAL-2026-13665None

3mo ago

Malicious code in riakcs (PyPI)

▾ Sunlitriakcs · riakcsvia OSV

RUSTSEC-2026-0345None

3mo ago

Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences

▾ Sunlitkuva · kuvavia OSV

CVE-2026-12261Medium· 6.5PoC

3mo ago

A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning

A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of packa…

▾ Twilightnltk · nltkEPSS 0.21%via NVD

CVE-2026-45808High

3mo ago

OpenBao is an open source identity-based secrets management system

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying cred…

▾ Twilightopenbao · github.com/openbao/openbaoEPSS 0.43%via NVD

CVE-2026-46358Medium

3mo ago

OpenBao is an open source identity-based secrets management system

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers …

▾ Sunlitopenbao · github.com/openbao/openbaoEPSS 0.21%via NVD

CVE-2026-46405Medium· 5.3

3mo ago

OpenBao is an open source identity-based secrets management system

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the `GET` handler, or when an `Authorization: Negotiate` header is supplied, the response is includes a `log…

▾ Sunlitopenbao · github.com/openbao/openbaoEPSS 0.62%via NVD

CVE-2026-71870Low· 3.3⚖ disputed

3mo ago

pypdf is a free and open-source pure-python PDF library

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a fo…

▾ Sunlitpypdf_project · pypdfEPSS 0.13%via NVD

MAL-2026-13619None

3mo ago