Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2026-71312High· 8.0rclone is a command-line program to sync files and directories to and from different cloud storage providers
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscap…
CVE-2026-59732Medium· 5.0rclone archive extract allows S3 destination prefix escape via crafted archive paths
rclone archive extract allows S3 destination prefix escape via crafted archive paths
CVE-2026-71313Medium· 6.9rclone is a command-line program to sync files and directories to and from different cloud storage providers
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent …
MAL-2026-13362NoneMalicious code in mnemonic-py (PyPI)
Malicious code in mnemonic-py (PyPI)
MAL-2026-13361NoneMalicious code in defi-sdk-py (PyPI)
Malicious code in defi-sdk-py (PyPI)
MAL-2026-12503NoneMalicious code in numpyp (PyPI)
Malicious code in numpyp (PyPI)
MAL-2026-12502NoneMalicious code in gcli-control (PyPI)
Malicious code in gcli-control (PyPI)
MAL-2026-12083NoneMalicious code in crypto-wallet-sdk (PyPI)
Malicious code in crypto-wallet-sdk (PyPI)
MAL-2026-12082NoneMalicious code in crypto-trading-toolkit (PyPI)
Malicious code in crypto-trading-toolkit (PyPI)
MAL-2026-12081NoneMalicious code in bitcoinlib-py (PyPI)
Malicious code in bitcoinlib-py (PyPI)
MAL-2026-12080NoneMalicious code in bip39-py (PyPI)
Malicious code in bip39-py (PyPI)
CVE-2026-15307High· 8.8Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
RUSTSEC-2026-0274NoneDouble free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics
Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics
CVE-2026-15830Medium· 5.3An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as …
An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as …
MAL-2026-11521NoneMalicious code in psbt-helpers (PyPI)
Malicious code in psbt-helpers (PyPI)
MAL-2026-11520NoneMalicious code in psbt-utils (PyPI)
Malicious code in psbt-utils (PyPI)
MAL-2026-11519NoneMalicious code in launchdarkly-ai-server-sdk (PyPI)
Malicious code in launchdarkly-ai-server-sdk (PyPI)
MAL-2026-11516NoneMalicious code in coldcard-helpers (PyPI)
Malicious code in coldcard-helpers (PyPI)
RUSTSEC-2026-0329NoneAuto-Reseeding HMAC-DRBG could panic for some output lengths
Auto-Reseeding HMAC-DRBG could panic for some output lengths
CVE-2026-12259Medium· 6.5In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with…
RUSTSEC-2026-0243None`nostr-relay-pool` is unmaintained
`nostr-relay-pool` is unmaintained
RUSTSEC-2026-0241None`nostr-keyring` is unmaintained
`nostr-keyring` is unmaintained
RUSTSEC-2026-0237None`nostr-relay-builder` is unmaintained
`nostr-relay-builder` is unmaintained
MAL-2026-11503NoneMalicious code in instalogin1234 (PyPI)
Malicious code in instalogin1234 (PyPI)
CVE-2026-69097High· 7.0GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerou…
CVE-2026-69243High· 7.0PoCAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attack…
CVE-2026-69244High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker contro…
CVE-2026-69247Medium· 5.9cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a Recipien…
CVE-2026-69249High· 7.5python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed cert…
CVE-2026-69248High· 7.4cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate h…