Tagged “osv”

CVEs tagged osv, newest first.

7180 CVEsRSS

GO-2026-5408None

3mo ago

Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

▾ Sunlitcaddyserver · github.com/caddyserver/caddy/v2via OSV

MAL-2026-11051None

3mo ago

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

▾ Sunlitpymdown-extensions · pymdown-extensionsEPSS 0.40%via OSV

CVE-2026-65607Medium· 6.5

3mo ago

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go)

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request…

▾ Sunlitsiyuan-note · siyuanEPSS 0.59%via NVD

CVE-2026-44210Critical· 9.9

3mo ago

kata-containers: Kata Containers: Privilege escalation and information disclosure via command-line argument injection (CVE-2026-44210)

A flaw was found in Kata Containers, an open-source project that provides lightweight virtual machines (VMs) for containers. A user with privileges to create pods can inject malicious command-line arguments into the virtiofsd process, whic…

▾ MidnightRed Hat · Red Hat OpenShift Container Platform 4EPSS 0.59%via CSAF

CVE-2026-25800High· 7.5

3mo ago

quinn: Quinn: Remote memory exhaustion via malformed QUIC stream fragments (CVE-2026-25800)

A flaw was found in Quinn, a Rust implementation of the QUIC transport protocol. A remote attacker can exploit this vulnerability by sending specially crafted QUIC stream fragments with many gaps. This can lead to high buffer overhead in t…

▾ TwilightRed Hat · quinn-protoEPSS 0.84%via CSAF

MAL-2026-11031None

3mo ago

Malicious code in govapkg (PyPI)

▾ Sunlitgovapkg · govapkgvia OSV

RUSTSEC-2026-0215None

3mo ago

smallstr is unmaintained

▾ Sunlitsmallstr · smallstrvia OSV

RUSTSEC-2026-0214None

3mo ago

gumdrop is unmaintained

▾ Sunlitgumdrop · gumdropvia OSV

GO-2026-6019None

3mo ago

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper

▾ Sunlitzalando · github.com/zalando/skippervia OSV

GO-2026-6016None

3mo ago

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen

▾ Sunlitoapi-codegen · github.com/oapi-codegen/oapi-codegenvia OSV

MAL-2026-10993None

3mo ago

Malicious code in torch-musa (PyPI)

▾ Sunlittorch-musa · torch-musavia OSV

MAL-2026-10992None

3mo ago

Malicious code in dev-helper-bg (PyPI)

▾ Sunlitdev-helper-bg · dev-helper-bgvia OSV

MAL-2026-10991None

3mo ago

Malicious code in make-helper (PyPI)

▾ Sunlitmake-helper · make-helpervia OSV

GHSA-h5v5-8746-g7mmMedium

3mo ago

JupyterLab PluginManager lock-rule enforcement bypass

▾ Sunlitjupyterlab · jupyterlabvia OSV

CVE-2026-64825Critical· 9.3

3mo ago

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial o…

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial o…

▾ Midnighthome-assistant · Home Assistant CoreEPSS 0.58%via NVD

CVE-2026-47143Medium· 5.9

3mo ago

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `d…

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`…

▾ Sunlitcapstone · capstoneEPSS 0.47%via OSV

RUSTSEC-2026-0218None

3mo ago