OSV.dev · 实时热榜

Affected packages: Chainguard/flux-notification-controller、Wolfi/flux-notification-controller Attributes: Fix available

Affected packages: Debian:11/libvirt、Debian:12/libvirt、Debian:13/libvirt、Debian:14/libvirt Attributes: No fix available

Affected packages: Debian:11/libheif、Debian:12/libheif、Debian:13/libheif、Debian:14/libheif Attributes: Fix available

Affected packages: Echo/ffmpeg Attributes: No fix available

Affected packages: Echo/zip Attributes: No fix available

Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation Affected packages: Hex/absinthe_federation、github.com/divvypayhq/absinthe_federation Attributes: Fix available、Severity - 8.7 (High)

API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion) Affected packages: Packagist/api-platform/core Attributes: Fix available、Severity - 6.5 (Medium)

Hono: ` memo() ` retains SSR output across requests, leading to cross-user data disclosure Affected packages: npm/hono Attributes: Fix available、Severity - 4.8 (Medium)

pypdf: Possible large memory usage for large /ToUnicode streams Affected packages: PyPI/pypdf Attributes: Fix available、Severity - 4.8 (Medium)

pypdf: Possible long runtimes/large memory usage for large CID font width ranges Affected packages: PyPI/pypdf Attributes: Fix available、Severity - 4.8 (Medium)

pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors Affected packages: PyPI/pymdown-extensions Attributes: Fix available、Severity - 7.5 (High)

Smarty Security stream restriction bypass through stream: resource Affected packages: Packagist/smarty/smarty Attributes: Fix available、Severity - 6.9 (Medium)

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution Affected packages: PyPI/gitpython Attributes: Fix available、Severity - 8.8 (High)

An issue was discovered in freedesktop poppler v25.04.0. The heap memory containing PDF stream... Affected packages: Julia/Cairo_NoGPL_jll、Julia/Cairo_jll Attributes: No fix available、Severity - 2.9 (Low)

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream... Affected packages: Julia/CURL_jll、Julia/LibCURL_jll Attributes: Fix available、Severity - 9.8 (Critical)

Malicious code in @decido/backend-core (npm) Affected packages: npm/@decido/backend-core Attributes: No fix available

Malicious code in @mrbenty8jf1p9y5/oidc-bind-canary (npm) Affected packages: npm/@mrbenty8jf1p9y5/oidc-bind-canary Attributes: No fix available

Malicious code in @coralxyz/anchor (npm) Affected packages: npm/@coralxyz/anchor Attributes: No fix available

Affected packages: MinimOS/litellm-1.87 Attributes: No fix available

Affected packages: MinimOS/opensearch-dashboards-fips-3-plugin-reports Attributes: No fix available

Affected packages: MinimOS/gotenberg、MinimOS/gotenberg-libreoffice Attributes: Fix available

Affected packages: MinimOS/confluent-common-docker-8.1 Attributes: Fix available

Red Hat Security Advisory: kernel security, bug fix, and enhancement update Affected packages: Red Hat:rhel_e4s:9.2::appstream/bpftool-debuginfo、Red Hat:rhel_e4s:9.2::appstream/kernel-64k-debug-debuginfo、Red Hat:rhel_e4s:9.2::appstream/kernel-64k-debug-devel、Red Hat:rhel_e4s:9.2::appstream/kernel-64k-debug-devel-matched、Red Hat:rhel_e4s:9.2::appstream/kernel-64k-debuginfo、... 66 more Attributes: Fix available、Severity - 8.4 (High)

Red Hat Security Advisory: kernel security, bug fix, and enhancement update Affected packages: Red Hat:rhel_e4s:9.4::appstream/bpftool-debuginfo、Red Hat:rhel_e4s:9.4::appstream/kernel-64k-debug-debuginfo、Red Hat:rhel_e4s:9.4::appstream/kernel-64k-debug-devel、Red Hat:rhel_e4s:9.4::appstream/kernel-64k-debug-devel-matched、Red Hat:rhel_e4s:9.4::appstream/kernel-64k-debuginfo、... 119 more Attributes: Fix available、Severity - 8.4 (High)

Moderate: kernel security, bug fix, and enhancement update Affected packages: Rocky Linux:9/kernel Attributes: Fix available、Severity - 7.1 (High)

Moderate: kernel security, bug fix, and enhancement update Affected packages: Rocky Linux:10/kernel Attributes: Fix available、Severity - 7.5 (High)

Affected packages: Chainguard/flux-notification-controller、Wolfi/flux-notification-controller Attributes: Fix available

Affected packages: Debian:11/libimager-perl、Debian:12/libimager-perl、Debian:13/libimager-perl、Debian:14/libimager-perl Attributes: No fix available

Affected packages: Debian:11/libheif、Debian:12/libheif、Debian:13/libheif、Debian:14/libheif Attributes: Fix available

Affected packages: Echo/ffmpeg Attributes: No fix available

SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header Affected packages: npm/@sveltejs/kit Attributes: Fix available、Severity - 5.3 (Medium)

Hono: Proxy Helper does not remove response headers listed in the ` Connection ` header Affected packages: npm/hono Attributes: Fix available、Severity - 3.7 (Low)

Smarty: Symlink path traversal out of trusted directories Affected packages: Packagist/smarty/smarty Attributes: Fix available、Severity - 6.9 (Medium)

GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE) Affected packages: PyPI/gitpython Attributes: Fix available、Severity - 8.8 (High)

CodeIgniter: Uploaded file extension validation bypass in ` is_image ` and ` mime_in ` rules Affected packages: Packagist/codeigniter4/framework Attributes: Fix available、Severity - 9.8 (Critical)

Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state Affected packages: Maven/io.netty:netty-codec-redis Attributes: Fix available、Severity - 6.5 (Medium)

go-git: Malicious reference names may modify files outside the reference storage Affected packages: Go/github.com/go-git/go-git/v5、Go/github.com/go-git/go-git/v6 Attributes: Fix available、Severity - 6.3 (Medium)

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain Affected packages: npm/crypto-js Attributes: Fix available、Severity - 9.0 (Critical)

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte... Affected packages: Julia/coreutils_jll Attributes: No fix available、Severity - 4.6 (Medium)

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote... Affected packages: Julia/CURL_jll、Julia/LibCURL_jll Attributes: Fix available、Severity - 7.5 (High)

Malicious code in @depup/memfs (npm) Affected packages: npm/@depup/memfs Attributes: No fix available

Malicious code in titan-exchange-shared-permissions (npm) Affected packages: npm/titan-exchange-shared-permissions Attributes: No fix available

Affected packages: MinimOS/litellm-1.86 Attributes: No fix available

Affected packages: MinimOS/external-secrets-operator-fips Attributes: Fix available

Affected packages: MinimOS/opensearch-dashboards-fips-3-plugin-assistant、MinimOS/opensearch-dashboards-fips-3-plugin-investigation、MinimOS/opensearch-dashboards-fips-3-plugin-observability、MinimOS/opensearch-dashboards-fips-3-plugin-reports Attributes: No fix available

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Affected packages: Red Hat:rhel_e4s:9.2::nfv/kernel-rt、Red Hat:rhel_e4s:9.2::nfv/kernel-rt-core、Red Hat:rhel_e4s:9.2::nfv/kernel-rt-debug、Red Hat:rhel_e4s:9.2::nfv/kernel-rt-debug-core、Red Hat:rhel_e4s:9.2::nfv/kernel-rt-debug-debuginfo、... 27 more Attributes: Fix available、Severity - 8.4 (High)

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Affected packages: Red Hat:hummingbird:1/policycoreutils、Red Hat:hummingbird:1/policycoreutils-dbus Attributes: Fix available、Severity - 4.4 (Medium)

Affected packages: Chainguard/tensorflow-cpu-jupyter Attributes: Fix available

Affected packages: Echo/ffmpeg Attributes: No fix available

Hono: Algorithmic Complexity DoS in Language Middleware Affected packages: npm/hono Attributes: Fix available、Severity - 5.3 (Medium)