A denial of service vector has been discovered in the golang crypto/x509 module. An attacker could craft an intermediate X.509 certificate containing a DSA public key and can crash a remote host with an unauthenticated call to any endpoint…

▾ SunlitRed Hat · Red Hat OpenShift Container Platform 4EPSS 0.38%via CSAF

CVE-2025-58183None

11mo ago

Unbounded allocation when parsing GNU sparse map in archive/tar

▾ Sunlitstdlib · stdlibEPSS 0.44%via OSV

CVE-2025-13327Medium

11mo ago

uv allows ZIP payload obfuscation through parsing differentials

▾ Sunlituv · uvEPSS 0.15%via OSV

CVE-2025-62801Medium

11mo ago

FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

▾ Sunlitfastmcp · fastmcpEPSS 0.23%via OSV

Tagged “osv”

KubeVirt Vulnerable to Arbitrary Host File Read and Write

AstrBot contains a directory traversal vulnerability

Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64

Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes

KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer

Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode

`replit_ruspty` was removed from crates.io for malicious code

Malicious code in replit_ruspty (crates.io)

DSPy does not properly restrict file reads

OctoPrint vulnerable to XSS in Action Commands Notification and Prompt

Dosage vulnerable to a Directory Traversal through crafted HTTP responses

motionEye vulnerable to RCE via unsanitized motion config parameter

Malicious code in speed-testing-nt (PyPI)

Agno session state overwrites between different sessions/users

cryptidy allows code execution via untrusted data due to pickle.loads

Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Apache Airflow has a command injection vulnerability in "example_dag_decorator"

Byaidu PDFMathTranslate vulnerable to open redirect

Apache Airflow's create action can upsert existing Pools/Connections/Variables

Apache Airflow `/api/v2/dagReports` executes DAG Python in API

crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509 (CVE-2025-58188)

Unbounded allocation when parsing GNU sparse map in archive/tar

uv allows ZIP payload obfuscation through parsing differentials

FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name