Tagged “osv”
CVEs tagged osv, newest first.
7182 CVEsRSS
MAL-2026-10866NoneMalicious code in nemopush (PyPI)
Malicious code in nemopush (PyPI)
MAL-2026-10865NoneMalicious code in kimitalk (PyPI)
Malicious code in kimitalk (PyPI)
MAL-2026-10864NoneMalicious code in kimichat (PyPI)
Malicious code in kimichat (PyPI)
MAL-2026-10863NoneMalicious code in telebot-bot-run (PyPI)
Malicious code in telebot-bot-run (PyPI)
CVE-2026-59203Medium· 5.3Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
CVE-2026-55514High· 6.5vLLM denial of service via prompt embeds on M-RoPE models
vLLM denial of service via prompt embeds on M-RoPE models
CVE-2026-55798Medium· 4.5Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
CVE-2026-54059High· 7.5Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF f…
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
CVE-2026-12484High· 7.8Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
MAL-2026-10780NoneMalicious code in data-parser-utils (PyPI)
Malicious code in data-parser-utils (PyPI)
MAL-2026-10917NoneMalicious code in tinkoff-cloud-apis-internal (PyPI)
Malicious code in tinkoff-cloud-apis-internal (PyPI)
MAL-2026-10916NoneMalicious code in python-devplatform-client (PyPI)
Malicious code in python-devplatform-client (PyPI)
MAL-2026-10779Critical⚠ ExploitedMalicious code in mlflow-ui (PyPI)
Malicious code in mlflow-ui (PyPI)
MAL-2026-10915NoneMalicious code in dwh-kafka-client (PyPI)
Malicious code in dwh-kafka-client (PyPI)
GO-2026-5985NoneNebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh
GO-2026-5982NoneTsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services in github.com/almeidapaulopt/tsdproxy
TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services in github.com/almeidapaulopt/tsdproxy
GO-2026-5981NoneEch0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com…
Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0
GO-2026-5969NoneTSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy
TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy
GO-2026-5935Nonenetfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil
netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil
GO-2026-5934Nonenetfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil
netfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil
GO-2026-5933Nonenetfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil
netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil
CVE-2026-8505Critical· 9.8IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow
IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_A…
MAL-2026-10771NoneMalicious code in trongridme (PyPI)
Malicious code in trongridme (PyPI)
GHSA-rjwr-m7qx-3fjrLow· 0.0oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code
oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code
MAL-2026-10770NoneMalicious code in govpkg (PyPI)
Malicious code in govpkg (PyPI)
GHSA-8rqh-vxpr-x77pMedium· 4.3plone.restapi: Stored XSS by spoofing mime type
plone.restapi: Stored XSS by spoofing mime type
MAL-2026-10768NoneMalicious code in trongridev (PyPI)
Malicious code in trongridev (PyPI)
CVE-2026-50274High· 7.5github.com/DataDog/dd-trace-go: Datadog dd-trace-go: Denial of Service via malicious baggage headers (CVE-2026-50274)
A flaw was found in Datadog dd-trace-go, a Go client library. A remote, unauthenticated attacker can exploit this vulnerability by sending a request with a specially crafted baggage header containing an arbitrarily large number of key-valu…
CVE-2026-49852High· 7.5joserfc: joserfc: Integrity bypass via forged HMAC-signed tokens (CVE-2026-49852)
A flaw was found in the joserfc Python library. A remote attacker can exploit a vulnerability in the `joserfc.jwt.decode` function to forge HMAC-signed tokens. This occurs because the library accepts tokens signed with an empty or null ver…
CVE-2026-15925High· 7.4snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname ve…
A flaw was found in Snowflake Connector for Python. A network-positioned attacker could exploit improper Transport Layer Security (TLS) hostname verification by intercepting network traffic and presenting a fraudulent certificate. This cou…