Tagged “osv”
CVEs tagged osv, newest first.
5468 CVEsRSS
RUSTSEC-2026-0296None`unzip` is unmaintained
`unzip` is unmaintained
CVE-2026-61687High· 7.1Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later…
RUSTSEC-2026-0293NoneDouble free / use-after-free in `Consumer::skip` and `Consumer::clear` when an element's `Drop` panics
Double free / use-after-free in `Consumer::skip` and `Consumer::clear` when an element's `Drop` panics
MAL-2026-16346Critical⚠ ExploitedMalicious code in rrs (PyPI)
Malicious code in rrs (PyPI)
MAL-2026-16298Critical⚠ ExploitedMalicious code in urc (PyPI)
Malicious code in urc (PyPI)
RUSTSEC-2026-0294NoneUnsoundness in UTF-8 'String' trait
Unsoundness in UTF-8 'String' trait
MAL-2026-16296Critical⚠ ExploitedMalicious code in py-venv-doctor (PyPI)
Malicious code in py-venv-doctor (PyPI)
GHSA-xwmw-prc4-v3crHigh· 8.8Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion
Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion
GHSA-pr6h-vr44-xq8jMedium· 5.3Obot: MCP Registry API readable without authentication
Obot: MCP Registry API readable without authentication
GHSA-jgh3-fggc-mcpmHigh· 7.6Obot: Server-Side Request Forgery via remote MCP server URL
Obot: Server-Side Request Forgery via remote MCP server URL
CVE-2026-59163Critical· 9.1PoCMnemosyne is a memory layer for artificial intelligence agents
Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with…
CVE-2025-66455Critical· 9.8LMDeploy is a toolkit for compressing, deploying, and serving large language models
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used `recv_pyobj()` to deserialize m…
GHSA-39wr-7q6h-cf68High· 7.5LMDeploy has an SSRF bypass
LMDeploy has an SSRF bypass
CVE-2026-33625High· 8.8LMDeploy is a toolkit for compressing, deploying, and serving large language models
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitra…
CVE-2026-64847Medium· 6.8AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains,…
CVE-2026-63374CriticalAnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
CVE-2026-63458High· 7.1Perses is an open-source dashboard and visualization project for observability data
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on projec…
CVE-2026-63445High· 7.1Perses is an open-source dashboard and visualization project for observability data
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query stru…
CVE-2026-63199High· 8.3Perses is an open-source dashboard and visualization project for observability data
Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope…
CVE-2026-63406Medium· 5.9PoCAnyCable is a realtime server for reliable two-way communication that supports any backend
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in t…
CVE-2026-63405Medium· 5.9PoCAnyCable is a realtime server for reliable two-way communication that supports any backend
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied body_md5 value in the HMAC input but does not calc…
CVE-2026-63349High· 7.0AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_proce…
CVE-2026-61833High· 8.1zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to th…
CVE-2026-81505High· 7.1PoCConvoy is a cloud native webhooks gateway
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() a…
CVE-2026-61794Medium· 6.8Capsule is a multi-tenancy and policy-based framework for Kubernetes
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the…
CVE-2026-61795Medium· 6.8Capsule is a multi-tenancy and policy-based framework for Kubernetes
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validate…
CVE-2026-61672High· 7.1Capsule is a multi-tenancy and policy-based framework for Kubernetes
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assume…
CVE-2026-77339Medium· 5.1PoCProcess Compose is a scheduler and orchestrator for non-containerized applications
Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating …
CVE-2026-58197High· 8.8PoCToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission pro…
CVE-2026-61682Critical· 9.9kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* i…