Tagged “osv”

CVEs tagged osv, newest first.

5683 CVEsRSS

MAL-2026-14341None

1mo ago

Malicious code in reqcrypts (PyPI)

▾ Sunlitreqcrypts · reqcryptsvia OSV

CVE-2026-43980Medium· 6.3

1mo ago

Malla is a web analyzer for Meshtastic networks based on MQTT data

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered int…

▾ Sunlitmalla · mallaEPSS 0.33%via NVD

CVE-2026-53572Medium· 5.9

1mo ago

KEDA is a Kubernetes-based Event Driven Autoscaling component

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values,…

▾ Sunlitkedacore · github.com/kedacore/keda/v2EPSS 0.39%via NVD

CVE-2026-71485Critical· 9.1

1mo ago

Centrifugo is an open-source scalable real-time messaging server

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers,…

▾ Midnightcentrifugal · github.com/centrifugal/centrifugoEPSS 0.61%via NVD

CVE-2026-61625Medium· 6.8

1mo ago

VictoriaMetrics is a scalable solution for monitoring and managing time series data

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/bac…

▾ SunlitVictoriaMetrics · github.com/VictoriaMetrics/VictoriaMetricsEPSS 0.40%via NVD

CVE-2026-71428Critical· 9.3

1mo ago

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, an…

▾ Midnightunstructured · unstructuredEPSS 0.44%via NVD

CVE-2026-67446Medium· 5.3⚖ disputed

1mo ago

Mailpit is an email testing tool and API for developers

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{i…

▾ Sunlitaxllent · github.com/axllent/mailpitEPSS 0.51%via NVD

CVE-2026-72818High· 7.5PoC

1mo ago

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is unbounded

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is unbounded. Inpu…

▾ Midnightnltk · nltkEPSS 0.74%via NVD

CVE-2026-71492Medium· 6.5

1mo ago

Banks generates meaningful LLM prompts using a simple template language

Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set() in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values in…

▾ Sunlitbanks · banksEPSS 0.47%via NVD

RUSTSEC-2026-0269None

1mo ago

Filesystem sandbox escape when paths or symlinks contain trailing slashes

▾ Sunlitwasmtime · wasmtimevia OSV

RUSTSEC-2026-0268None

1mo ago

Guest controlled-size host heap allocation through WASIp3 streams

▾ Sunlitwasmtime · wasmtimevia OSV

CVE-2026-55558Medium· 5.9

1mo ago

aiosmtplib is an asynchronous SMTP client for use with asyncio

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. A…

▾ Sunlitaiosmtplib · aiosmtplibEPSS 0.40%via NVD

CVE-2026-54770Medium· 6.1

1mo ago

WebOb provides objects for HTTP requests and responses

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips le…

▾ SunlitRed Hat · Red Hat OpenStack Platform 16.2EPSS 0.42%via NVD

CVE-2026-54623High· 7.1

1mo ago

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value with…

▾ Twilightdjango-cms · django-cmsEPSS 0.49%via NVD

CVE-2026-54625Medium· 4.8

1mo ago

django CMS is a content management system powered by Django

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key funct…

▾ Sunlitdjango-cms · django-cmsEPSS 0.18%via NVD

MAL-2026-14340None

1mo ago