OSV.dev · 实时热榜

TuxCare security update for org.springframework (14 CVEs) Affected packages: TuxCare:Maven/org.springframework:framework-docs、TuxCare:Maven/org.springframework:spring-aop、TuxCare:Maven/org.springframework:spring-aspects、TuxCare:Maven/org.springframework:spring-beans、TuxCare:Maven/org.springframework:spring-context、... 20 more Attributes: Fix available

Affected packages: Debian:11/libimager-perl、Debian:12/libimager-perl、Debian:13/libimager-perl、Debian:14/libimager-perl Attributes: No fix available

Affected packages: Debian:11/libimager-perl、Debian:12/libimager-perl、Debian:13/libimager-perl、Debian:14/libimager-perl Attributes: No fix available

Affected packages: Debian:11/openssl、Debian:12/openssl、Debian:13/openssl、Debian:14/openssl Attributes: No fix available

Affected packages: Debian:11/expat、Debian:12/expat、Debian:13/expat、Debian:14/expat Attributes: No fix available

Affected packages: Echo/busybox Attributes: No fix available

Affected packages: Echo/expat Attributes: No fix available

Affected packages: Echo/expat Attributes: No fix available

On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay Affected packages: Hex/mpp、github.com/zenhive/mpp Attributes: Fix available、Severity - 8.7 (High)

SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses Affected packages: npm/mcp-searxng Attributes: Fix available、Severity - 5.5 (Medium)

langgraph-api: Incomplete assistant authorization in LangGraph Server run creation Affected packages: PyPI/langgraph-api Attributes: Fix available、Severity - 5.9 (Medium)

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root Affected packages: npm/@tinacms/cli Attributes: Fix available、Severity - 6.5 (Medium)

logto-tunnel serves files outside --experience-path via path traversal Affected packages: npm/@logto/tunnel Attributes: Fix available、Severity - 8.7 (High)

SearXNG MCP Server: Additional hardened-mode SSRF bypasses Affected packages: npm/mcp-searxng Attributes: Fix available、Severity - 6.3 (Medium)

aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers... Affected packages: Julia/Aria2_jll Attributes: Fix available、Severity - 5.3 (Medium)

Malicious code in express-route-engine (npm) Affected packages: npm/express-route-engine Attributes: No fix available

Malicious code in @httttt/mcp-demo (npm) Affected packages: npm/@httttt/mcp-demo Attributes: No fix available

Malicious code in frenchworldcupwin (npm) Affected packages: npm/frenchworldcupwin Attributes: No fix available

Affected packages: MinimOS/vsphere-csi-syncer-3.6 Attributes: Fix available

Affected packages: MinimOS/mongodb-kubernetes-operator-fips、MinimOS/mongodb-kubernetes-operator-fips-readinessprobe、MinimOS/mongodb-kubernetes-operator-fips-version-upgrade-post-start-hook Attributes: No fix available

Affected packages: MinimOS/flipt-fips-1 Attributes: No fix available

Affected packages: MinimOS/kubevirt-virt-controller-fips-1.6 Attributes: No fix available

Affected packages: MinimOS/redpanda-25.1-fips Attributes: No fix available

Affected packages: MinimOS/knative-net-kourier-fips-1.21 Attributes: No fix available

Affected packages: MinimOS/weaviate-fips-1.36 Attributes: No fix available

Affected packages: MinimOS/percona-server-8.0、MinimOS/percona-server-8.0-client、MinimOS/percona-server-8.0-dev、MinimOS/percona-server-8.0-doc、MinimOS/percona-server-8.0-shared Attributes: No fix available

Affected packages: MinimOS/loki-fips-3.5、MinimOS/loki-fips-3.5-canary、MinimOS/loki-fips-3.5-logcli、MinimOS/loki-fips-3.5-promtail Attributes: No fix available

Affected packages: MinimOS/ingress-nginx-controller-fips-1.15、MinimOS/ingress-nginx-custom-error-pages-fips-1.15 Attributes: No fix available

sqlite security update Affected packages: openEuler:20.03-LTS-SP4/sqlite、openEuler:22.03-LTS-SP4/sqlite、openEuler:24.03-LTS-SP1/sqlite、openEuler:24.03-LTS-SP3/sqlite、openEuler:24.03-LTS-SP4/sqlite Attributes: Fix available、Severity - 6.1 (Medium)

Red Hat Security Advisory: yelp security update Affected packages: Red Hat:rhel_els:7/yelp、Red Hat:rhel_els:7/yelp-debuginfo、Red Hat:rhel_els:7/yelp-devel、Red Hat:rhel_els:7/yelp-libs Attributes: Fix available、Severity - 7.1 (High)

Moderate: java-21-openjdk security update Affected packages: Rocky Linux:8/java-21-openjdk Attributes: Fix available、Severity - 6.8 (Medium)

Important: mysql:8.4 security, bug fix, and enhancement update Affected packages: Rocky Linux:8/mecab、Rocky Linux:8/mecab-ipadic Attributes: Fix available、Severity - 8.4 (High)

Important: mysql:8.4 security, bug fix, and enhancement update Affected packages: Rocky Linux:9/mecab、Rocky Linux:9/mecab-ipadic、Rocky Linux:9/perl-DBD-MySQL、Rocky Linux:9/rapidjson Attributes: Fix available、Severity - 8.4 (High)

CVE-2023-34152 in imagemagick - Patched by Root Affected packages: Root:Debian:11/imagemagick、Root:Debian:11/rootio-imagemagick Attributes: Fix available、Severity - 9.8 (Critical)

CVE-2025-30258 in gnupg2 - Patched by Root Affected packages: Root:Debian:11/gnupg2、Root:Debian:11/rootio-gnupg2 Attributes: Fix available、Severity - 4.7 (Medium)

CVE-2021-31879 in wget - Patched by Root Affected packages: Root:Ubuntu:24.04/rootio-wget、Root:Ubuntu:24.04/wget Attributes: Fix available

Affected packages: Debian:11/ceph、Debian:12/ceph、Debian:13/ceph、Debian:14/ceph Attributes: No fix available

Affected packages: Echo/expat Attributes: No fix available

Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain Affected packages: Hex/mpp、github.com/zenhive/mpp Attributes: Fix available、Severity - 8.3 (High)

langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication Affected packages: PyPI/langgraph-api Attributes: Fix available、Severity - 5.9 (Medium)

BuildKit has a possible runtime DoS via unbounded group parsing Affected packages: Go/github.com/moby/buildkit Attributes: Fix available、Severity - 2.3 (Low)

Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) Affected packages: npm/next-tinacms-azure、npm/next-tinacms-cloudinary、npm/next-tinacms-dos、npm/next-tinacms-s3 Attributes: Fix available、Severity - 5.4 (Medium)

SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off) Affected packages: npm/mcp-searxng Attributes: Fix available、Severity - 6.5 (Medium)

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems Affected packages: Packagist/getgrav/grav Attributes: Fix available、Severity - 8.2 (High)

Malicious code in x6842179305 (npm) Affected packages: npm/x6842179305 Attributes: No fix available

Malicious code in rc4-secure (PyPI) Affected packages: PyPI/rc4-secure Attributes: No fix available

Malicious code in libasync (PyPI) Affected packages: PyPI/libasync Attributes: No fix available

Malicious code in expect-dotenv (npm) Affected packages: npm/expect-dotenv Attributes: No fix available

Malicious code in test-flow-1 (npm) Affected packages: npm/test-flow-1 Attributes: No fix available

Affected packages: MinimOS/prometheus-node-exporter-fips-1.9 Attributes: No fix available