Tagged “osv”

CVEs tagged osv, newest first.

5712 CVEsRSS

CVE-2026-21892Medium· 5.3

8mo ago

badkeys vulnerable to ASCII control character injection on console via malformed input

▾ Sunlitbadkeys · badkeysEPSS 0.34%via OSV

CVE-2025-69225Low

8mo ago

AIOHTTP has unicode match groups in regexes for ASCII protocol elements

▾ Sunlitaiohttp · aiohttpEPSS 0.28%via OSV

CVE-2025-69227High· 7.5

8mo ago

aiohttp: aiohttp: Denial of Service via specially crafted POST request (CVE-2025-69227)

A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. A remote attacker could exploit this vulnerability by sending a specially crafted POST request to an application using the Request.post() method, provide…

▾ TwilightRed Hat · Red Hat Ansible Automation Platform 2EPSS 0.39%via CSAF

CVE-2025-69229Medium

8mo ago

AIOHTTP vulnerable to DoS through chunked messages

▾ Sunlitaiohttp · aiohttpEPSS 0.40%via OSV

CVE-2025-69228Medium· 6.8

8mo ago

aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request (CVE-2025-69228)

A flaw was found in aiohttp. A remote attacker can craft a malicious request that, when processed by an aiohttp server using the `Request.post()` method, causes the server's memory to fill uncontrollably. This can lead to a Denial of Servi…

▾ SunlitRed Hat · Red Hat OpenShift AI (RHOAI)EPSS 0.40%via CSAF

CVE-2025-69224Low

8mo ago

AIOHTTP's unicode processing of header values could cause parsing discrepancies

▾ Sunlitaiohttp · aiohttpEPSS 0.24%via OSV

CVE-2025-69226Low

8mo ago

AIOHTTP vulnerable to brute-force leak of internal static ﬁle path components

▾ Sunlitaiohttp · aiohttpEPSS 0.36%via OSV

CVE-2025-69223High· 7.5

8mo ago

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that …

Tagged “osv”

Parsl Monitoring Visualization Vulnerable to SQL Injection

MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download

Bokeh server applications have Incomplete Origin Validation in WebSockets

Malicious code in pyrogrom (PyPI)

badkeys vulnerable to ASCII control character injection on console via malformed input

AIOHTTP has unicode match groups in regexes for ASCII protocol elements

aiohttp: aiohttp: Denial of Service via specially crafted POST request (CVE-2025-69227)

AIOHTTP vulnerable to DoS through chunked messages

aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request (CVE-2025-69228)

AIOHTTP's unicode processing of header values could cause parsing discrepancies

AIOHTTP vulnerable to brute-force leak of internal static ﬁle path components

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

Langflow Missing Authentication on Critical API Endpoints

CBORDecoder reuse can leak shareable values across decode calls

Malicious code in requeses (PyPI)

Malicious code in pyrogrqm (PyPI)

Malicious code in telegreph (PyPI)

Malicious code in aiogrem (PyPI)

Malicious code in pyrogrem (PyPI)

libsodium has Incomplete List of Disallowed Inputs

Cowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability in the emulated shell implementation of wget and curl

Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length

Picklescan vulnerable to Arbitrary File Writing

Picklescan Bypasses Unsafe Globals Check using pty.spawn

Picklescan has Incomplete List of Disallowed Inputs

Picklescan does not block ctypes

Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval

Gitea allows attackers to add attachments with forbidden file extensions

Malicious code in telegrem (PyPI)

Malicious code in telebot-bot (PyPI)