Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2026-47715Low· 3.1Bugsink: Issue event views can show an event from another project if its UUID is known
Bugsink: Issue event views can show an event from another project if its UUID is known
CVE-2026-47716Low· 3.1Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
CVE-2026-47419High· 8.3praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
CVE-2024-24769LowVantage6: No limit on emails sent for password/MFA reset
Vantage6: No limit on emails sent for password/MFA reset
CVE-2026-47728Medium· 4.3Bugsink: Project scoping missing in sourcemap and debug-file lookup
Bugsink: Project scoping missing in sourcemap and debug-file lookup
CVE-2024-27928MediumVantage6: 2FA can be circumvented with hacked email access
Vantage6: 2FA can be circumvented with hacked email access
CVE-2026-54533Mediumvantage6 node has an Improper Access Control issue
vantage6 node has an Improper Access Control issue
CVE-2026-54445MediumVantage6: Set admin user and password from environment or configuration
Vantage6: Set admin user and password from environment or configuration
MAL-2026-5273NoneMalicious code in anthropy (PyPI)
Malicious code in anthropy (PyPI)
CVE-2026-45409Medium· 5.3python-idna: idna: Denial of Service via specially crafted long inputs (CVE-2026-45409)
A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding f…
CVE-2026-10775Low· 3.6SGLang is Vulnerable to DoS via the data_hash Function
SGLang is Vulnerable to DoS via the data_hash Function
CVE-2026-41178High· 7.5github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denia…
A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length i…
CVE-2026-47703MediumAdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle
AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle
CVE-2026-44889Medium· 6.1WebOb: Location header normalization during redirect leads to open redirect - again
WebOb: Location header normalization during redirect leads to open redirect - again
CVE-2026-10814Medium· 4.5milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery
milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery
CVE-2026-10812Low· 3.6GPTCache: File and image cache keys collide because BufferedReader.peek() only reads the buffered prefix
GPTCache: File and image cache keys collide because BufferedReader.peek() only reads the buffered prefix
CVE-2026-10804Low· 3.6Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission
Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission
CVE-2026-50266Low· 2.2OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks
OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks
CVE-2026-44393High· 7.4OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake
OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake
CVE-2026-10803Low· 2.5mlflow: MLflow: Use of weak hash in Dataset Digest Computation (CVE-2026-10803)
A flaw was found in MLflow. This vulnerability stems from the use of a weak hash algorithm within the Dataset Digest Computation component. A local attacker could potentially exploit this weakness, which may impact the integrity or authent…
CVE-2026-10813Low· 3.6PoCA flaw has been found in LMCache up to 0.5.4
A flaw has been found in LMCache up to 0.5.4. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack …
CVE-2026-10801Low· 3.6ms-swift: Image Cache Hash Collision via Missing Dimension Metadata
ms-swift: Image Cache Hash Collision via Missing Dimension Metadata
CVE-2026-46447Medium· 5.8OpenStack Ironic allows Boot Script Injection
OpenStack Ironic allows Boot Script Injection
CVE-2026-48681Medium· 5.9OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
CVE-2026-41283Critical· 9.9OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed
OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed
CVE-2026-10783Low· 2.5Gradio: Audio cache key ignores metadata when saving numpy audio outputs
Gradio: Audio cache key ignores metadata when saving numpy audio outputs
CVE-2026-47706Medium· 5.3Strawberry GraphQL has a Circular Fragment Reference DOS
Strawberry GraphQL has a Circular Fragment Reference DOS
CVE-2026-47707Medium· 5.3Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
CVE-2026-40898High· 7.5⚖ disputedgithub.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers (CVE-2026-40898)
A flaw was found in quic-go, an implementation of the QUIC protocol in Go. A remote attacker can exploit this by sending specially crafted HTTP/3 trailer fields. This can cause the system to allocate excessive memory, leading to a denial-o…
CVE-2026-10722Medium· 5.5⚖ disputedgithub.com/cilium/ebpf: Cilium ebpf: Denial of Service via integer overflow (CVE-2026-10722)
A flaw was found in the cilium/ebpf Go library (versions up to 0.21.0). An integer overflow in the loadRawSpec function (btf/btf.go) when parsing BTF collection specs can cause excessive memory allocation or parsing failure. A local attack…