A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding f…

▾ SunlitRed Hat · Red Hat Enterprise Linux 9EPSS 0.46%via CSAF

CVE-2026-10775Low· 3.6

3mo ago

SGLang is Vulnerable to DoS via the data_hash Function

▾ Sunlitsglang · sglangEPSS 0.12%via OSV

CVE-2026-41178High· 7.5

3mo ago

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denia…

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length i…

▾ TwilightRed Hat · Red Hat Openshift Data Foundation 4.22EPSS 0.34%via CSAF

CVE-2026-47703Medium

3mo ago

AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle

▾ SunlitAdguardTeam · github.com/AdguardTeam/AdGuardHomeEPSS 0.14%via OSV

CVE-2026-44889Medium· 6.1

3mo ago

WebOb: Location header normalization during redirect leads to open redirect - again

▾ Sunlitwebob · webobEPSS 0.27%via OSV

CVE-2026-10814Medium· 4.5

3mo ago

milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery

▾ Sunlitmilvus-io · github.com/milvus-io/milvusEPSS 0.09%via OSV

Tagged “osv”

Malicious code in instructor-mcp (PyPI)

Malicious code in dreamgen (PyPI)

Malicious code in pantheon-agents (PyPI)

Malicious code in ufish (PyPI)

Malicious code in synago (PyPI)

Malicious code in okite (PyPI)

Malicious code in uprobe (PyPI)

Malicious code in pantheon-toolsets (PyPI)

Malicious code in nucbox (PyPI)

Malicious code in napari-ufish (PyPI)

Possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`

sanic-cors contains an improper regular expression in the try_match() function

OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash

bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map

Bugsink: Issue event views can show an event from another project if its UUID is known

Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known

praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

Vantage6: No limit on emails sent for password/MFA reset

Bugsink: Project scoping missing in sourcemap and debug-file lookup

Vantage6: 2FA can be circumvented with hacked email access

vantage6 node has an Improper Access Control issue

Vantage6: Set admin user and password from environment or configuration

wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

Malicious code in anthropy (PyPI)

python-idna: idna: Denial of Service via specially crafted long inputs (CVE-2026-45409)

SGLang is Vulnerable to DoS via the data_hash Function

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denia…

AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle

WebOb: Location header normalization during redirect leads to open redirect - again

milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery