OSV.dev · 实时热榜

TuxCare security update for @angular (2 CVEs) Affected packages: TuxCare:npm/@angular/animations、TuxCare:npm/@angular/bazel、TuxCare:npm/@angular/benchpress、TuxCare:npm/@angular/common、TuxCare:npm/@angular/compiler、... 13 more Attributes: Fix available

Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts Affected packages: Go/github.com/authorizerdev/authorizer Attributes: Fix available、Severity - 8.7 (High)

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info Affected packages: npm/@ooples/token-optimizer-mcp Attributes: Fix available、Severity - 8.4 (High)

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users Affected packages: crates.io/surrealdb Attributes: Fix available、Severity - 6.5 (Medium)

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`) Affected packages: PyPI/mcp-contextforge-gateway Attributes: Fix available、Severity - 6.6 (Medium)

s2n-quic has excessive memory allocation Affected packages: crates.io/s2n-quic Attributes: Fix available、Severity - 6.9 (Medium)

OpenAM Insecure SSO Cookie Initialization Affected packages: Maven/org.openidentityplatform.openam:openam-core Attributes: Fix available、Severity - 7.0 (High)

Excessive memory allocation during VP8L decoding in golang.org/x/image Affected packages: Go/golang.org/x/image Attributes: Fix available

Malicious code in @divineubg/divine (npm) Affected packages: npm/@divineubg/divine Attributes: No fix available

Malicious code in @velliajs/discord (npm) Affected packages: npm/@velliajs/discord Attributes: No fix available

Malicious code in require-i18next (npm) Affected packages: npm/require-i18next Attributes: No fix available

Malicious code in depcruise-baseline (npm) Affected packages: npm/depcruise-baseline Attributes: No fix available

Malicious code in gunzip-js (npm) Affected packages: npm/gunzip-js Attributes: No fix available

Affected packages: MinimOS/go-jsonnet-fips Attributes: Fix available

Affected packages: MinimOS/argo-workflow-controller-fips-4.1 Attributes: Fix available

Affected packages: MinimOS/traefik-2 Attributes: No fix available

Affected packages: MinimOS/cluster-api-aws-controller-fips-2.11 Attributes: Fix available

Affected packages: MinimOS/datadog-agent、MinimOS/datadog-cluster-agent Attributes: No fix available

Affected packages: MinimOS/hubble-fips Attributes: No fix available

Affected packages: MinimOS/pdfcpu-0.12 Attributes: No fix available

Affected packages: MinimOS/k3s-fips-1.33、MinimOS/k3s-fips-1.33-multicall Attributes: No fix available

Affected packages: MinimOS/weaviate-fips-1.36 Attributes: No fix available

Affected packages: MinimOS/loki-fips-3.4、MinimOS/loki-fips-3.4-canary、MinimOS/loki-fips-3.4-logcli、MinimOS/loki-fips-3.4-promtail Attributes: No fix available

Affected packages: MinimOS/knative-eventing-1.21-channel-controller、MinimOS/knative-eventing-1.21-channel-dispatcher、MinimOS/knative-eventing-1.21-controller、MinimOS/knative-eventing-1.21-event-display、MinimOS/knative-eventing-1.21-filter、... 6 more Attributes: No fix available

Affected packages: MinimOS/prometheus-node-exporter-fips-1.9 Attributes: No fix available

Affected packages: MinimOS/kyverno-fips-1.15、MinimOS/kyverno-fips-background-controller-1.15、MinimOS/kyverno-fips-cleanup-controller-1.15、MinimOS/kyverno-fips-cli-1.15、MinimOS/kyverno-fips-init-container-1.15、... 1 more Attributes: No fix available

Affected packages: MinimOS/go-fips-1.24、MinimOS/go-fips-wrapper-1.24 Attributes: No fix available

Affected packages: MinimOS/redpanda-25.1-fips Attributes: No fix available

Affected packages: MinimOS/minio-fips Attributes: No fix available

Affected packages: MinimOS/kubevirt-virt-controller-fips-1.6 Attributes: No fix available

Affected packages: MinimOS/cluster-api-azure-controller Attributes: No fix available

Affected packages: MinimOS/coredns-1.14、MinimOS/kuma-coredns-1.14 Attributes: Fix available

Affected packages: MinimOS/kube-apiserver-fips-1.33、MinimOS/kube-controller-manager-fips-1.33、MinimOS/kube-proxy-fips-1.33、MinimOS/kube-scheduler-fips-1.33、MinimOS/kubectl-fips-1.33、... 1 more Attributes: No fix available

Affected packages: MinimOS/etcd-fips-3.4 Attributes: No fix available

Affected packages: MinimOS/flink-2.0 Attributes: No fix available

Affected packages: MinimOS/eks-distro-1.34-coredns-1.12.4、MinimOS/eks-distro-1.34-coredns-1.13.2、MinimOS/eks-distro-1.34-coredns-1.14.2 Attributes: No fix available

Affected packages: MinimOS/neo4j-4.4 Attributes: No fix available

Affected packages: MinimOS/coredns-fips-1.13、MinimOS/kuma-coredns-fips-1.13 Attributes: No fix available

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Affected packages: Red Hat:hummingbird:1/aspnetcore-runtime-10.0、Red Hat:hummingbird:1/dotnet10.0 Attributes: Fix available、Severity - 7.8 (High)

Important: .NET 8.0 security, bug fix, and enhancement update Affected packages: Rocky Linux:9/dotnet8.0 Attributes: Fix available、Severity - 7.8 (High)

TuxCare security update for @angular (1 CVE) Affected packages: TuxCare:npm/@angular/animations、TuxCare:npm/@angular/benchpress、TuxCare:npm/@angular/common、TuxCare:npm/@angular/compiler、TuxCare:npm/@angular/compiler-cli、... 11 more Attributes: Fix available

Affected packages: Echo/postgis Attributes: No fix available

Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints Affected packages: npm/@ooples/token-optimizer-mcp Attributes: Fix available、Severity - 5.3 (Medium)

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets" Affected packages: Maven/com.mchange:mchange-commons-java Attributes: Fix available、Severity - 7.1 (High)

Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter Affected packages: Go/github.com/hyperledger/fabric-ca Attributes: Fix available、Severity - 6.3 (Medium)

Malicious code in @devmikets/hyperliquid-sdk (npm) Affected packages: npm/@devmikets/hyperliquid-sdk Attributes: No fix available

Malicious code in @guangnao/agent-proxy (npm) Affected packages: npm/@guangnao/agent-proxy Attributes: No fix available

Malicious code in depcruise-fmt (npm) Affected packages: npm/depcruise-fmt Attributes: No fix available

Affected packages: MinimOS/gotenberg-libreoffice-fips Attributes: Fix available

Affected packages: MinimOS/coredns-fips-1.14、MinimOS/kuma-coredns-fips-1.14 Attributes: Fix available