Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
RUSTSEC-2026-0222Low· 3.8Stores can mix up type indices between engines
Stores can mix up type indices between engines
MAL-2026-11420NoneMalicious code in walmart-genai-trace (PyPI)
Malicious code in walmart-genai-trace (PyPI)
MAL-2026-11419NoneMalicious code in cognikit (PyPI)
Malicious code in cognikit (PyPI)
MAL-2026-11418NoneMalicious code in catalogai (PyPI)
Malicious code in catalogai (PyPI)
MAL-2026-11417NoneMalicious code in aiprepkit (PyPI)
Malicious code in aiprepkit (PyPI)
MAL-2026-11416NoneMalicious code in ailaunchkit (PyPI)
Malicious code in ailaunchkit (PyPI)
MAL-2026-11415NoneMalicious code in aichannel (PyPI)
Malicious code in aichannel (PyPI)
MAL-2026-11414NoneMalicious code in aiassistcore (PyPI)
Malicious code in aiassistcore (PyPI)
MAL-2026-11413NoneMalicious code in reguestsc (PyPI)
Malicious code in reguestsc (PyPI)
CVE-2026-12074High· 7.5Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nlt…
Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
CVE-2026-12072High· 7.5Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (E…
Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
CVE-2026-12061High· 7.5Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
CVE-2026-12075High· 8.6Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORC…
Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
CVE-2026-18140High· 7.5aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON (CVE-2026-18140)
A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service (DoS) in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacke…
CVE-2026-59881Medium· 5.3aiohttp: AIOHTTP: Denial of Service via unnegotiated WebSocket compression (CVE-2026-59881)
A flaw was found in AIOHTTP. The WebSocket client in AIOHTTP processes compressed data frames even when the compression mechanism, known as permessage-deflate, has not been properly negotiated. A malicious server can exploit this by sendin…
CVE-2026-61536High· 7.5Banks generates meaningful LLM prompts using a simple template language
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through impo…
MAL-2026-11202NoneMalicious code in ml-shared (PyPI)
Malicious code in ml-shared (PyPI)
MAL-2026-11201NoneMalicious code in ml-nps-shared (PyPI)
Malicious code in ml-nps-shared (PyPI)
MAL-2026-11200NoneMalicious code in ml-fdbk-shared (PyPI)
Malicious code in ml-fdbk-shared (PyPI)
MAL-2026-11199NoneMalicious code in ml-data-shared (PyPI)
Malicious code in ml-data-shared (PyPI)
MAL-2026-11198NoneMalicious code in mcp-search-server (PyPI)
Malicious code in mcp-search-server (PyPI)
MAL-2026-11197NoneMalicious code in ai-perf-toolkit (PyPI)
Malicious code in ai-perf-toolkit (PyPI)
MAL-2026-11195NoneMalicious code in phabricator-client (PyPI)
Malicious code in phabricator-client (PyPI)
CVE-2026-13346Medium· 5.9pip: pip: Arbitrary file installation via malicious package indexes (CVE-2026-13346)
A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from su…
RUSTSEC-2026-0257NoneUnix `BROWSER` handling allows browser argument injection
Unix `BROWSER` handling allows browser argument injection
CVE-2026-55415High· 7.5datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
CVE-2026-54690High· 8.2datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)
datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)
CVE-2026-55391High· 7.5datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
CVE-2026-54653High· 8.8`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
CVE-2026-55389High· 7.5datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-…
datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`