OSV.dev
feedUSosv
Google's Open Source Vulnerabilities database — advisories aggregated across open-source ecosystems (npm, PyPI, Go, …), keyed to affected package versions.
01
advisories (61,416)
Vendor and ecosystem advisories describing this.
- EEF-CVE-2026-97200
- EEF-CVE-2026-115693
- EEF-CVE-2026-113440
- EEF-CVE-2026-115700
- EEF-CVE-2026-112880
- EEF-CVE-2026-108529
- EEF-CVE-2026-110499
- EEF-CVE-2026-109584
- EEF-CVE-2026-111103
- EEF-CVE-2026-111101
- EEF-CVE-2026-113436
- EEF-CVE-2026-110314
- EEF-CVE-2026-114213
- EEF-CVE-2026-114216
- EEF-CVE-2026-115269
- EEF-CVE-2026-108525
- BIT-parse-2026-112769
- BIT-parse-2026-112768
- EEF-CVE-2026-96581
- BIT-pillow-2026-112901
showing 20 of 61,416
02
product assertions (12,636)
Products and version ranges known to be affected.
- Bitnami abantecart
- Bitnami activemq
- Bitnami airflow
- Bitnami akeneo
- Bitnami alertmanager
- Bitnami alfresco
- Bitnami apache
- Bitnami apisix
- Bitnami apisix_dashboard
- Bitnami appsmith
- Bitnami apr
- Bitnami apr-util
- Bitnami arangodb
- Bitnami argo-cd
- Bitnami argo-workflows
- Bitnami artifactory
- Bitnami aspnet-core
- Bitnami authentik
- Bitnami azure-cli
- Bitnami bpftool
showing 20 of 12,636
03
CVE links (43,534)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-97200US | — | — | ||
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or hi… | ||||
| CVE-2026-115700US | — | — | ||
Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trai… | ||||
| CVE-2026-115693US | — | — | ||
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a c… | ||||
| CVE-2026-115269US | — | — | ||
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream proc… | ||||
| CVE-2026-114216US | — | — | ||
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remot… | ||||
| CVE-2026-114213US | — | — | ||
Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust serve… | ||||
| CVE-2026-113440US | — | — | ||
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same… | ||||
| CVE-2026-113436US | — | — | ||
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length… | ||||
| CVE-2026-112880US | — | — | ||
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting… | ||||
| CVE-2026-111103US | — | — | ||
Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a… | ||||
| CVE-2026-111101US | — | — | ||
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server… | ||||
| CVE-2026-110499US | — | — | ||
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection m… | ||||
| CVE-2026-110314US | — | — | ||
Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code aft… | ||||
| CVE-2026-109584US | — | — | ||
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust s… | ||||
| CVE-2026-108529US | — | — | ||
Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS o… | ||||
| CVE-2026-108525US | — | — | ||
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory… | ||||
| CVE-2026-96581US | — | — | ||
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upser… | ||||
| CVE-2026-115635US | —OT elevated | — | ||
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert.
When Ash.bulk_create/4 or a single create… | ||||
| CVE-2026-115627US | —OT elevated | — | ||
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows.
When… | ||||
| CVE-2026-114214US | —OT elevated | — | ||
Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.
When a has_many… | ||||
showing 20 of 43,534