Tagged “osv”
CVEs tagged osv, newest first.
7182 CVEsRSS
CVE-2025-71349High· 8.1picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious code
picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using trace.Trace.run in…
CVE-2025-71363High· 8.1picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code
picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass pickles…
CVE-2026-27197Critical· 9.1Sentry: Improper authentication on SAML SSO process allows user identity linking
Sentry: Improper authentication on SAML SSO process allows user identity linking
CVE-2020-7941Critical· 9.8Plone Unauthenticated Write Vulnerability
Plone Unauthenticated Write Vulnerability
CVE-2026-11720Critical· 9.1MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints
MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints
MAL-2026-6593NoneMalicious code in django-bkvision (PyPI)
Malicious code in django-bkvision (PyPI)
MAL-2026-6561NoneMalicious code in skillspector (PyPI)
Malicious code in skillspector (PyPI)
CVE-2026-6658Medium· 5.4jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports
jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports
CVE-2026-13318Medium· 6.4KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address
KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address
CVE-2026-13218Medium· 4.2KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite
KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite
CVE-2026-13322Low· 3.8KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption
KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption
CVE-2026-13426Medium· 5.4github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
CVE-2026-57231High· 7.5podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231)
A flaw was found in Podman, a tool for managing OCI containers and pods. A malicious container image can be crafted with an environment variable that has a key but no value, or an asterisk (*), to trick Podman. This vulnerability causes Po…
CVE-2026-49486High· 7.5The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment u…
MAL-2026-6515NoneMalicious code in sqligen (PyPI)
Malicious code in sqligen (PyPI)
CVE-2026-9639Medium· 6.5Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volum…
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volum…
CVE-2026-47214High· 7.1Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.
CVE-2026-12411High· 8.4Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when securi…
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when securi…
CVE-2026-48797CriticalBackpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
CVE-2026-42602NoneAuthenticate method auth bypass in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension
Authenticate method auth bypass in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension
CVE-2026-40923NoneTekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline
CVE-2026-40924NoneTekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline
CVE-2026-42576Noneapko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko
CVE-2026-42575Noneapko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko
CVE-2025-71340High· 8.1picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods
picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the…
CVE-2026-56121Critical· 9.8PoCFeast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server
Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_functi…
CVE-2025-71361High· 8.1picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution
picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution. Attackers can embed undetected payloads in pickle files that execute arbitrary code when loaded v…
CVE-2025-71354High· 8.1picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods
picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and e…
CVE-2026-10609Medium· 6.8OpenShift Cluster Logging Operator missing authorization flaw
OpenShift Cluster Logging Operator missing authorization flaw
CVE-2026-56695Medium· 6.5OpenHarness remote resume commands expose other users' saved session snapshots
OpenHarness remote resume commands expose other users' saved session snapshots