OSV.dev · 实时热榜

Livebook Teams identity callback lacks state binding, allowing login CSRF Affected packages: Hex/livebook、github.com/livebook-dev/livebook Attributes: Fix available、Severity - 6.8 (Medium)

Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service Affected packages: Hex/html_sanitize_ex、github.com/rrrene/html_sanitize_ex Attributes: Fix available、Severity - 8.2 (High)

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host Affected packages: npm/@nuxt/devtools Attributes: Fix available、Severity - 9.6 (Critical)

Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass Affected packages: Go/github.com/traefik/traefik/v3 Attributes: Fix available、Severity - 5.3 (Medium)

rclone: Local Encoding Path Traversal Affected packages: Go/github.com/rclone/rclone Attributes: Fix available、Severity - 6.9 (Medium)

rclone local ` --metadata ` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote Affected packages: Go/github.com/rclone/rclone Attributes: Fix available、Severity - 3.6 (Low)

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path Affected packages: npm/electron Attributes: Fix available、Severity - 7.2 (High)

Electron: contextBridge object copy honors prototype setters Affected packages: npm/electron Attributes: Fix available、Severity - 5.4 (Medium)

rclone ` serve restic --private-repos ` authorization bypass: ` .. ` in the URL path lets an authenticated user read, overwrite and delete other users' repositories Affected packages: Go/github.com/rclone/rclone Attributes: Fix available、Severity - 8.8 (High)

Electron: Extension tab APIs operate across session boundaries Affected packages: npm/electron Attributes: Fix available、Severity - 6.6 (Medium)

Electron: Sandboxed iframes can launch external protocol handlers Affected packages: npm/electron Attributes: Fix available、Severity - 5.4 (Medium)

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session Affected packages: npm/electron Attributes: Fix available、Severity - 5.9 (Medium)

Electron: window.open features string controls some window options considered privileged Affected packages: npm/electron Attributes: Fix available、Severity - 5.3 (Medium)

Electron: Cross-origin iframe can position native autofill popup Affected packages: npm/electron Attributes: Fix available、Severity - 3.1 (Low)

Deno: ` fetch() ` API sandbox bypass via missing DNS resolution check Affected packages: Julia/Deno_jll Attributes: Fix available、Severity - 5.2 (Medium)

GMP has an integer overflow with crafted inputs on 32-bit builds in ` int_raw.c ` , leading to buffer overflow Affected packages: Julia/GCCBootstrap_jll、Julia/GMP_jll、Julia/LibStdCxx_jll Attributes: Fix available、Severity - 7.5 (High)

Malicious code in llm-interceptor (npm) Affected packages: npm/llm-interceptor Attributes: No fix available

Malicious code in uncrypt (PyPI) Affected packages: PyPI/uncrypt Attributes: No fix available

Malicious code in decapod-common (PyPI) Affected packages: PyPI/decapod-common Attributes: No fix available

Malicious code in wallet-monitor-snap (npm) Affected packages: npm/wallet-monitor-snap Attributes: No fix available

Malicious code in agenttunnels (npm) Affected packages: npm/agenttunnels Attributes: No fix available

Malicious code in @holocronlab/botruntime-runtime (npm) Affected packages: npm/@holocronlab/botruntime-runtime Attributes: No fix available

Affected packages: MinimOS/opensearch-3、MinimOS/opensearch-3-alerting、MinimOS/opensearch-3-anomaly-detection、MinimOS/opensearch-3-crypto-kms、MinimOS/opensearch-3-discovery-ec2、... 11 more Attributes: Fix available

Affected packages: MinimOS/portainer-ce-2.39 Attributes: Fix available

Affected packages: MinimOS/gnutar、MinimOS/gnutar-doc、MinimOS/gnutar-rmt、MinimOS/tar Attributes: Fix available

Affected packages: MinimOS/py3.10-pip-base、MinimOS/py3.11-pip-base、MinimOS/py3.12-pip-base、MinimOS/py3.13-pip-base、MinimOS/py3.14-pip-base Attributes: Fix available

Affected packages: MinimOS/teleport-18 Attributes: Fix available

Important: sg3_utils security, bug fix, and enhancement update Affected packages: Rocky Linux:10/sg3_utils Attributes: Fix available、Severity - 7.6 (High)

CVE-2026-40200 in musl - Patched by Root Affected packages: Root:Alpine:3.18/musl、Root:Alpine:3.18/rootio-musl Attributes: Fix available、Severity - 7.8 (High)

CVE-2004-0230 in linux - Patched by Root Affected packages: Root:Debian:12/linux、Root:Debian:12/rootio-linux Attributes: Fix available

A ` BigInt ` division panics, and two neighbouring operations answer wrongly in silence Affected packages: crates.io/viperjs Attributes: Fix available、Severity - 7.5 (High)

Affected packages: Debian:13/linux、Debian:14/linux Attributes: Fix available

JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts Affected packages: Hex/livebook、github.com/livebook-dev/livebook Attributes: Fix available、Severity - 8.6 (High)

Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service Affected packages: Hex/html_sanitize_ex、github.com/rrrene/html_sanitize_ex Attributes: Fix available、Severity - 8.2 (High)

rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution Affected packages: Go/github.com/rclone/rclone Attributes: Fix available、Severity - 8.0 (High)

Nuxt: Unauthorized Component Instantiation via Server Island Props Affected packages: npm/nuxt Attributes: Fix available、Severity - 4.8 (Medium)

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter Affected packages: npm/electron Attributes: Fix available、Severity - 5.7 (Medium)

rclone archive extract allows S3 destination prefix escape via crafted archive paths Affected packages: Go/github.com/rclone/rclone Attributes: Fix available、Severity - 5.0 (Medium)

Electron: shell.openPath path validation bypass via embedded null byte Affected packages: npm/electron Attributes: Fix available、Severity - 6.0 (Medium)

Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin Affected packages: npm/electron Attributes: Fix available、Severity - 5.9 (Medium)

Electron: DevTools embedder handler executes arbitrary files via shell open Affected packages: npm/electron Attributes: Fix available、Severity - 6.9 (Medium)

rclone: Verbose Stack Trace Disclosure in RC API Error Responses Affected packages: Go/github.com/rclone/rclone Attributes: Fix available、Severity - 2.7 (Low)

Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion Affected packages: Go/Traefik Attributes: Fix available、Severity - 5.3 (Medium)

Electron: HTTP redirect followed into local file loader Affected packages: npm/electron Attributes: Fix available、Severity - 5.9 (Medium)

Deno: WebSocket API sandbox bypass via missing post-DNS check Affected packages: Julia/Deno_jll Attributes: Fix available、Severity - 5.2 (Medium)

7-Zip for Windows fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive Affected packages: Julia/p7zip_jll Attributes: No fix available、Severity - 4.8 (Medium)

Malicious code in kepler (npm) Affected packages: npm/kepler Attributes: No fix available

Malicious code in golaaa (npm) Affected packages: npm/golaaa Attributes: No fix available

Malicious code in @activepieces/piece-google-bigquery (npm) Affected packages: npm/@activepieces/piece-google-bigquery Attributes: No fix available

Malicious code in @innocarpe/deepseek-build (npm) Affected packages: npm/@innocarpe/deepseek-build Attributes: No fix available