Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0

▾ Sunlitlin-snow · github.com/lin-snow/ech0via OSV

GO-2026-5969None

2mo ago

TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy

▾ Sunlitalmeidapaulopt · github.com/almeidapaulopt/tsdproxyvia OSV

GO-2026-5935None

2mo ago

netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil

▾ Sunlittinfoil-factory · github.com/tinfoil-factory/netfoilvia OSV

Tagged “osv”

Malicious code in automatic-octo-invention (PyPI)

Malicious code in shark-e2e-bnsneo (PyPI)

Malicious code in mysuperlicense (PyPI)

Malicious code in mysupergoodpython (PyPI)

Malicious code in ibreak (PyPI)

Malicious code in hello-world-test-mh3 (PyPI)

Malicious code in hello-world-test-mh2 (PyPI)

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Malicious code in paperclip-ai (PyPI)

Malicious code in neroteam-v1 (PyPI)

Malicious code in vantrala (PyPI)

Malicious code in nemopush (PyPI)

Malicious code in kimitalk (PyPI)

Malicious code in kimichat (PyPI)

Malicious code in telebot-bot-run (PyPI)

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

vLLM denial of service via prompt embeds on M-RoPE models

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF f…

Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data

Malicious code in data-parser-utils (PyPI)

Malicious code in tinkoff-cloud-apis-internal (PyPI)

Malicious code in python-devplatform-client (PyPI)

Malicious code in mlflow-ui (PyPI)

Malicious code in dwh-kafka-client (PyPI)

Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh

TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services in github.com/almeidapaulopt/tsdproxy

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com…

TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy

netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil