Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
π GNA-1 (CIRCL)
Select from 85 available sources using the dropdown above.
OSV Homebrew πΊ is not individually searchable yet β the search will cover the sources available on the search page.
| ID | Description | Published | Updated |
|---|---|---|---|
| brew-zabbix-cli-cve-2026-64847 | AnyIO process-pool workers can block indefinitely on undrained stderr | 2026-09-18T19:40:19Z | 2026-09-18T19:40:19Z |
| brew-zabbix-cli-cve-2026-63374 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing | 2026-09-18T19:40:19Z | 2026-09-18T19:40:19Z |
| brew-zabbix-cli-cve-2026-63349 | AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups | 2026-09-18T19:40:19Z | 2026-09-18T19:40:19Z |
| brew-yewtube-cve-2026-64847 | AnyIO process-pool workers can block indefinitely on undrained stderr | 2026-09-18T19:37:42Z | 2026-09-18T19:37:42Z |
| brew-yewtube-cve-2026-63374 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing | 2026-09-18T19:37:42Z | 2026-09-18T19:37:42Z |
| brew-yewtube-cve-2026-63349 | AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups | 2026-09-18T19:37:42Z | 2026-09-18T19:37:42Z |
| brew-vnu-cve-2025-15104 | Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability | 2026-08-13T17:48:54Z | 2026-09-18T19:20:59Z |
| brew-torrra-cve-2026-64847 | AnyIO process-pool workers can block indefinitely on undrained stderr | 2026-09-18T19:08:42Z | 2026-09-18T19:08:42Z |
| brew-torrra-cve-2026-63374 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing | 2026-09-18T19:08:42Z | 2026-09-18T19:08:42Z |
| brew-toot-cve-2026-86000 | Soup Sieve: Polynomial-time ReDoS (O(nΒ²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns | 2026-09-18T19:08:04Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2026-85999 | Soup Sieve: Polynomial-time ReDoS (O(nΒ²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors) | 2026-09-18T19:08:04Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2026-49477 | Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2026-49476 | Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2026-44432 | urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2026-44431 | urllib3: Sensitive headers forwarded across origins in proxied low-level redirects | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2026-21441 | Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2025-66471 | urllib3 streaming API improperly handles highly compressed data | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2025-66418 | urllib3 allows an unbounded number of links in the decompression chain | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2025-50182 | urllib3 does not control redirects in browsers and Node.js | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2025-50181 | urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2024-37891 | urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2023-45803 | urllib3's request body not stripped after redirect from 303 status changes request method to GET | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2023-43804 | `Cookie` HTTP header isn't stripped on cross-origin redirects | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2021-33503 | Catastrophic backtracking in URL authority parser when passed URL containing many @ characters | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2021-28363 | Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection | 2026-08-13T17:44:33Z | 2026-09-18T19:08:04Z |
| brew-toot-cve-2026-7246 | 2026-08-13T17:44:33Z | 2026-09-18T19:07:07Z | |
| brew-toot-cve-2026-45409 | Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix | 2026-08-13T17:44:33Z | 2026-09-18T19:07:07Z |
| brew-toot-cve-2024-3651 | Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode | 2026-08-13T17:44:33Z | 2026-09-18T19:07:07Z |
| brew-theharvester-cve-2026-54283 | Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS | 2026-08-13T17:43:26Z | 2026-09-18T19:03:30Z |
| brew-theharvester-cve-2026-54282 | Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname | 2026-08-13T17:43:26Z | 2026-09-18T19:03:30Z |