Tagged “osv”
CVEs tagged osv, newest first.
7180 CVEsRSS
CVE-2026-35193Low· 3.1Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary
Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary
CVE-2026-6873Low· 3.1Django: signed cookies are vulnerable to salt namespace collisions
Django: signed cookies are vulnerable to salt namespace collisions
CVE-2026-48587Low· 3.1Django: has_vary_header may expose cached responses when Vary values contain whitespace
Django: has_vary_header may expose cached responses when Vary values contain whitespace
CVE-2026-8404Low· 3.1Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling
Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling
CVE-2026-37462High· 7.3GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function
GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function
MAL-2026-5173NoneMalicious code in spadata (PyPI)
Malicious code in spadata (PyPI)
CVE-2026-44020High· 7.5Docling: Unsafe XML Entity Expansion in USPTO Patent Backend
Docling: Unsafe XML Entity Expansion in USPTO Patent Backend
CVE-2026-10766Low· 3.6mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption
mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption
CVE-2026-44018Medium· 5.5Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
CVE-2026-44016High· 8.2Docling: Unsafe Playwright-based HTML Rendering
Docling: Unsafe Playwright-based HTML Rendering
CVE-2026-7666Low· 3.1Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake
Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake
CVE-2026-44023High· 8.6Docling Core: Unsafe remote filename resolution
Docling Core: Unsafe remote filename resolution
CVE-2026-44019High· 8.1Docling Core: Insufficient validation of image reference URIs
Docling Core: Insufficient validation of image reference URIs
CVE-2026-47265MediumAIOHTTP is vulnerable to cross-origin redirect with per-request cookies
AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
CVE-2026-5241High· 7.7python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting (CVE-2026-5241)
A flaw was found in python-transformers. An attacker can exploit this vulnerability by providing a malicious model repository. During model initialization, the `trust_remote_code` parameter, intended to prevent remote code execution, is ov…
CVE-2026-44017High· 7.5Docling: Unsafe Zip Extraction in EasyOCR Model Download
Docling: Unsafe Zip Extraction in EasyOCR Model Download
CVE-2026-44022Medium· 5.5Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands
Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands
CVE-2026-44546Low· 3.7daphne: WebSocket handshake header smuggling through autobahn splitlines() mishandling of non-standard line separators
daphne: WebSocket handshake header smuggling through autobahn splitlines() mishandling of non-standard line separators
CVE-2026-44545Medium· 5.3daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames
daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames
CVE-2026-4035Critical· 9.1MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration
MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration
CVE-2026-10692Medium· 4.3Code Index MCP is vulnerable to Uncontrolled Resource Consumption
Code Index MCP is vulnerable to Uncontrolled Resource Consumption
RUSTSEC-2026-0279High· 8.1Rojo development server vulnerable to DNS rebinding, allowing unauthenticated read/write access and local program execution
Rojo development server vulnerable to DNS rebinding, allowing unauthenticated read/write access and local program execution
CVE-2026-42507Medium· 5.3Arbitrary inputs are included in errors without any escaping in net/textproto
Arbitrary inputs are included in errors without any escaping in net/textproto
MAL-2026-5171NoneMalicious code in spaysdata (PyPI)
Malicious code in spaysdata (PyPI)
MAL-2026-5170NoneMalicious code in spaysrbdata (PyPI)
Malicious code in spaysrbdata (PyPI)
CVE-2026-42504High· 7.5Quadratic complexity in WordDecoder.DecodeHeader in mime
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
CVE-2026-47117Critical· 9.8PoCOpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter model loading path
OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter model loading path. The privacy-filter dispatcher used broad substring matching on the user-supplied model_name parameter, allowing a value suc…
CVE-2026-34993High· 7.2aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() (CVE-2026-34993)
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to …
RUSTSEC-2026-0155None`exploration` was removed from crates.io for malicious code
`exploration` was removed from crates.io for malicious code
CVE-2026-3198Medium· 6.5MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions