Skip to content
OpenAdvisories

Source

OSV.dev (GitHub Advisories, PyPA, Go, RustSec…)

Source: https://osv.dev/

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-48710 Exploited Public exploit EPSS 70%

    Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

    Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuil…

    Kludex starlette starlette starlette Debian Ubuntu Alpine PyPI
    KEV Sep 2, 2026
  • Medium 5.3
    CVE-2025-35939 Exploited

    Craft CMS stores user-provided content in session files

    Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and gen…

    Craft CMS craftcms/cms Packagist
    KEV Jun 2, 2025
  • Medium 5.3
    CVE-2025-31125 Exploited Public exploit EPSS 75%

    Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

    Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This…

    vitejs vite vite npm
    KEV Jan 22, 2026
  • Medium 6.5
    CVE-2020-11652 Exploited Public exploit EPSS 86%

    SaltStack Salt is vulnerable Arbitrary Directory Access

    An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Medium 6.5
    CVE-2019-5786 Exploited Public exploit EPSS 61%

    Use-After-Free in puppeteer

    Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine npm
    KEV May 23, 2022
  • Medium 6.9
    CVE-2020-11023 Exploited Public exploit EPSS 85%

    Potential XSS vulnerability in jQuery

    In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

    jquery jQuery drupal7 cacti Debian Ubuntu Alpine npm Packagist Maven NuGet RubyGems
    KEV Jan 23, 2025