OSV.dev · 实时热榜

Affected packages: Debian:11/p11-kit、Debian:12/p11-kit、Debian:13/p11-kit、Debian:14/p11-kit Attributes: No fix available

Affected packages: Debian:11/dnsdist、Debian:11/pdns、Debian:11/pdns-recursor、Debian:12/dnsdist、Debian:12/pdns、... 7 more Attributes: No fix available

Affected packages: Echo:PyPi/pypdf Attributes: Fix available

Affected packages: Echo/apr-util Attributes: No fix available

SQL injection via the :comment option in Postgrex.stream/4 Affected packages: Hex/postgrex、github.com/elixir-ecto/postgrex Attributes: Fix available、Severity - 5.9 (Medium)

Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service Affected packages: Hex/html_sanitize_ex、github.com/rrrene/html_sanitize_ex Attributes: Fix available、Severity - 8.2 (High)

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool Affected packages: Go/github.com/traefik/traefik、Go/github.com/traefik/traefik/v2、Go/github.com/traefik/traefik/v3 Attributes: Fix available、Severity - 7.0 (High)

Contao crawler leaks auth credentials to external hosts Affected packages: Packagist/contao/contao、Packagist/contao/core-bundle Attributes: Fix available、Severity - 2.6 (Low)

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported Affected packages: npm/js-yaml Attributes: Fix available、Severity - 7.5 (High)

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port Affected packages: Go/github.com/traefik/traefik/v3 Attributes: Fix available、Severity - 6.3 (Medium)

Mermaid allows CSS injection applying to sibling elements of the diagram Affected packages: npm/mermaid Attributes: Fix available、Severity - 5.3 (Medium)

Statamic: Account takeover via OAuth email matching without email-verification check Affected packages: Packagist/statamic/cms Attributes: Fix available、Severity - 8.1 (High)

Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts Affected packages: Packagist/craftcms/cms Attributes: Fix available、Severity - 6.9 (Medium)

Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets Affected packages: Packagist/craftcms/cms Attributes: Fix available

node-re2: Out-of-bounds heap read in ` replace ` / ` split ` via a ` Buffer ` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript Affected packages: npm/re2 Attributes: Fix available、Severity - 5.1 (Medium)

league/commonmark: Denial of service via deeply nested XML output Affected packages: Packagist/league/commonmark Attributes: Fix available、Severity - 5.3 (Medium)

jsoup: Cleaner may expose markup with custom raw-text elements Affected packages: Maven/org.jsoup:jsoup Attributes: Fix available、Severity - 4.7 (Medium)

Smarty Security stream restriction bypass through stream: resource Affected packages: Packagist/smarty/smarty Attributes: Fix available、Severity - 6.9 (Medium)

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics Affected packages: Packagist/craftcms/cms Attributes: Fix available、Severity - 5.3 (Medium)

Nx: Zip-Slip in the self-hosted remote cache Affected packages: npm/@nx/azure-cache、npm/@nx/gcs-cache、npm/@nx/powerpack-azure-cache、npm/@nx/powerpack-gcs-cache、npm/@nx/powerpack-s3-cache、... 4 more Attributes: Fix available、Severity - 8.7 (High)

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth Affected packages: Go/github.com/traefik/traefik/v2、Go/github.com/traefik/traefik/v3 Attributes: Fix available、Severity - 7.8 (High)

Affected packages: Julia/FFMPEG_jll、Julia/FFMPEG_nogpl_jll Attributes: Fix available、Severity - 5.4 (Medium)

Affected packages: Julia/libheif_jll Attributes: Fix available、Severity - 7.1 (High)

Malicious code in idnna (PyPI) Affected packages: PyPI/idnna Attributes: No fix available

Malicious code in fast-hashes (PyPI) Affected packages: PyPI/fast-hashes Attributes: No fix available

Malicious code in yakuza0 (npm) Affected packages: npm/yakuza0 Attributes: No fix available

Updated python-django packages fix security vulnerabilities Affected packages: Mageia:10/python-django Attributes: Fix available

Affected packages: MinimOS/traefik-2 Attributes: No fix available

Affected packages: MinimOS/vault-k8s Attributes: Fix available

Affected packages: MinimOS/elasticsearch-9.3 Attributes: No fix available

busybox security update Affected packages: openEuler:20.03-LTS-SP4/busybox、openEuler:22.03-LTS-SP4/busybox、openEuler:24.03-LTS-SP1/busybox、openEuler:24.03-LTS-SP3/busybox、openEuler:24.03-LTS-SP4/busybox Attributes: Fix available、Severity - 5.1 (Medium)

Red Hat Security Advisory: postfix security update Affected packages: Red Hat:enterprise_linux_eus:10.0/postfix Attributes: Fix available、Severity - 7.5 (High)

CVE-2023-44271 in pillow - Patched by Root Affected packages: Root:PyPI/pillow、Root:PyPI/rootio-pillow Attributes: Fix available

Moderate: kernel security, bug fix, and enhancement update Affected packages: Rocky Linux:9/kernel Attributes: Fix available、Severity - 7.1 (High)

Affected packages: Debian:11/libvirt、Debian:12/libvirt、Debian:13/libvirt、Debian:14/libvirt Attributes: No fix available

Affected packages: Debian:11/wordpress、Debian:12/wordpress、Debian:13/wordpress、Debian:14/wordpress Attributes: No fix available

Affected packages: Echo/apr-util Attributes: No fix available

Affected packages: Echo:PyPi/pypdf Attributes: Fix available

Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service Affected packages: Hex/html_sanitize_ex、github.com/rrrene/html_sanitize_ex Attributes: Fix available、Severity - 8.2 (High)

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence Affected packages: Packagist/statamic/cms Attributes: Fix available、Severity - 4.3 (Medium)

Mermaid Architecture diagrams are vulnerable to prototype pollution Affected packages: npm/mermaid Attributes: Fix available、Severity - 6.5 (Medium)

Traefik: ` allowCrossNamespace=false ` bypass via ` @kubernetescrd ` TraefikService backendRef Affected packages: Go/github.com/traefik/traefik、Go/github.com/traefik/traefik/v2、Go/github.com/traefik/traefik/v3 Attributes: Fix available、Severity - 4.8 (Medium)

h2: Duplicate Host header could facilitate request smuggling Affected packages: PyPI/h2 Attributes: Fix available、Severity - 5.3 (Medium)

Craft CMS: Incorrect path validation could potentially lead to path traversal Affected packages: Packagist/craftcms/cms Attributes: Fix available、Severity - 2.1 (Low)

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length Affected packages: npm/re2 Attributes: Fix available、Severity - 6.2 (Medium)

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware Affected packages: Go/github.com/traefik/traefik、Go/github.com/traefik/traefik/v2、Go/github.com/traefik/traefik/v3 Attributes: Fix available、Severity - 9.1 (Critical)

Smarty: Symlink path traversal out of trusted directories Affected packages: Packagist/smarty/smarty Attributes: Fix available、Severity - 6.9 (Medium)

league/commonmark: Denial of service via colliding heading slugs Affected packages: Packagist/league/commonmark Attributes: Fix available、Severity - 7.5 (High)

Craft CMS: Arbitrary user password reset leading to administrator account takeover Affected packages: Packagist/craftcms/cms Attributes: Fix available

Mermaid radar diagrams are vulnerable to DoS Affected packages: npm/mermaid Attributes: Fix available、Severity - 5.3 (Medium)