Tagged “osv”

CVEs tagged osv, newest first.

7182 CVEsRSS

MAL-2026-10975None

3mo ago

golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing (CVE-2026-46600)

A flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may p…

▾ TwilightRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2.15EPSS 0.55%via CSAF

CVE-2026-56657Medium· 6.2

3mo ago

Gitea SSH Key Parser Denial of Service

▾ Sunlitgitea · code.gitea.io/giteaEPSS 0.17%via OSV

CVE-2026-58314High· 7.7

3mo ago

Gitea: Two SSRF findings

▾ Twilightgitea · code.gitea.io/giteaEPSS 0.40%via OSV

CVE-2026-56443Medium· 4.3

3mo ago

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / …

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

▾ Sunlitgitea · code.gitea.io/giteaEPSS 0.53%via OSV

CVE-2026-63745Medium· 5.4

3mo ago

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access…

▾ Sunlitsurrealdb · surrealdbEPSS 0.25%via NVD

CVE-2026-63746Medium· 6.5

3mo ago

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's P…

▾ Sunlitsurrealdb · surrealdbEPSS 0.40%via NVD

CVE-2026-63761Medium· 4.3

3mo ago

SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ..

SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ... TYPE JWT ALGORITHM ES512), because the underlying jsonwebtoken crate (v10.x) has no ES512 vari…

▾ Sunlitsurrealdb · surrealdbEPSS 0.28%via NVD

CVE-2026-63751Medium· 4.3

3mo ago

SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or…

▾ Sunlitsurrealdb · surrealdbEPSS 0.29%via CVEORG

CVE-2026-63755Medium· 6.5

3mo ago

SurrealDB before 3.1.0 Permission Bypass via WHERE Clause

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements) against full record data befo…

▾ Sunlitsurrealdb · surrealdbEPSS 0.36%via CVEORG

MAL-2026-10930None

3mo ago

Malicious code in trongridmy (PyPI)

▾ Sunlittrongridmy · trongridmyvia OSV

MAL-2026-10929None

3mo ago

Malicious code in trongrider (PyPI)

▾ Sunlittrongrider · trongridervia OSV

MAL-2026-10927None

3mo ago

Malicious code in roles-royce (PyPI)

▾ Sunlitroles-royce · roles-roycevia OSV

MAL-2026-10926None

3mo ago

Malicious code in defi-kit (PyPI)

▾ Sunlitdefi-kit · defi-kitvia OSV

MAL-2026-10919None

3mo ago

Malicious code in ml-core-airflow-auth (PyPI)

▾ Sunlitml-core-airflow-auth · ml-core-airflow-authvia OSV

MAL-2026-10918None

3mo ago

Malicious code in automatic-octo-invention (PyPI)

▾ Sunlitautomatic-octo-invention · automatic-octo-inventionvia OSV

MAL-2026-10912None

3mo ago

Malicious code in shark-e2e-bnsneo (PyPI)

▾ Sunlitshark-e2e-bnsneo · shark-e2e-bnsneovia OSV

MAL-2026-10911None

3mo ago

Malicious code in mysuperlicense (PyPI)

▾ Sunlitmysuperlicense · mysuperlicensevia OSV

MAL-2026-10910None

3mo ago

Malicious code in mysupergoodpython (PyPI)

▾ Sunlitmysupergoodpython · mysupergoodpythonvia OSV

MAL-2026-10909None

3mo ago

Malicious code in ibreak (PyPI)

▾ Sunlitibreak · ibreakvia OSV

MAL-2026-10908None

3mo ago

Malicious code in hello-world-test-mh3 (PyPI)

▾ Sunlithello-world-test-mh3 · hello-world-test-mh3via OSV

MAL-2026-10907None

3mo ago

Malicious code in hello-world-test-mh2 (PyPI)

▾ Sunlithello-world-test-mh2 · hello-world-test-mh2via OSV

CVE-2026-63762Medium· 6.0

3mo ago

SurrealDB before v2.6.1 Denial of Service via scripting

SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to exec…

▾ Sunlitsurrealdb · surrealdbEPSS 0.45%via CVEORG

CVE-2026-59198Medium· 6.5

3mo ago