OSV.dev · 实时热榜

Affected packages: Debian:13/openssl、Debian:14/openssl Attributes: Fix available

Affected packages: Debian:11/gpac Attributes: No fix available

Affected packages: Debian:11/openexr、Debian:12/openexr、Debian:13/openexr、Debian:14/openexr Attributes: No fix available

Affected packages: Debian:11/openexr、Debian:12/openexr、Debian:13/openexr、Debian:14/openexr Attributes: No fix available

Affected packages: Debian:11/openssl、Debian:12/openssl、Debian:13/openssl、Debian:14/openssl Attributes: Fix available

Affected packages: Debian:13/openssl、Debian:14/openssl Attributes: Fix available

Affected packages: Debian:11/libyaml-perl、Debian:12/libyaml-perl、Debian:13/libyaml-perl、Debian:14/libyaml-perl Attributes: No fix available

Affected packages: Debian:11/tomcat9、Debian:12/tomcat10、Debian:12/tomcat9、Debian:13/tomcat10、Debian:13/tomcat11、... 4 more Attributes: Fix available

Affected packages: Debian:11/ruby-doorkeeper-openid-connect、Debian:12/ruby-doorkeeper-openid-connect、Debian:13/ruby-doorkeeper-openid-connect、Debian:14/ruby-doorkeeper-openid-connect Attributes: Fix available

Affected packages: Debian:11/chromium、Debian:12/chromium、Debian:13/chromium、Debian:14/chromium Attributes: No fix available

Affected packages: Debian:11/nltk、Debian:12/nltk、Debian:13/nltk、Debian:14/nltk Attributes: Fix available

Affected packages: Debian:11/rclone、Debian:12/rclone、Debian:13/rclone Attributes: No fix available

Affected packages: Debian:11/emacs、Debian:12/emacs、Debian:13/emacs、Debian:14/emacs Attributes: No fix available

Affected packages: Debian:11/keystone、Debian:12/keystone、Debian:13/keystone、Debian:14/keystone Attributes: No fix available

Affected packages: Echo/libdbi-perl Attributes: Fix available

Affected packages: Echo/webkit2gtk Attributes: No fix available

Affected packages: Echo/openssl Attributes: Fix available

Affected packages: Echo/libheif Attributes: Fix available

Affected packages: Echo/libyaml-perl Attributes: No fix available

Affected packages: Echo/openexr Attributes: No fix available

asyncssh has SCP Path Traversal to Arbitrary File Write Affected packages: PyPI/asyncssh Attributes: Fix available、Severity - 8.1 (High)

mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable Affected packages: Go/github.com/sonirico/mcp-shell Attributes: Fix available、Severity - 8.4 (High)

@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint Affected packages: npm/@arikusi/deepseek-mcp-server Attributes: Fix available、Severity - 5.3 (Medium)

IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries Affected packages: Maven/org.codehaus.izpack:izpack-installer Attributes: No fix available、Severity - 7.4 (High)

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access Affected packages: PyPI/chainlit Attributes: Fix available、Severity - 7.2 (High)

JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login Affected packages: PyPI/jupyterhub Attributes: Fix available、Severity - 5.3 (Medium)

utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins Affected packages: PyPI/utcp-gql、PyPI/utcp-websocket Attributes: Fix available、Severity - 4.7 (Medium)

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()` Affected packages: PyPI/qwed Attributes: Fix available、Severity - 8.8 (High)

gRPC Erlang package has unbounded request body accumulation in `read_full_body/3` Affected packages: Hex/grpc Attributes: Fix available、Severity - 8.7 (High)

Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript Affected packages: npm/@platejs/media Attributes: Fix available、Severity - 8.7 (High)

mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment Affected packages: PyPI/mcp-contextforge-gateway Attributes: Fix available

SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed Affected packages: npm/suneditor Attributes: Fix available、Severity - 8.5 (High)

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses Affected packages: PyPI/openwisp-ipam Attributes: Fix available、Severity - 5.3 (Medium)

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls Affected packages: PyPI/djust Attributes: Fix available、Severity - 8.2 (High)

Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5 Affected packages: Go/github.com/labstack/echo/v4、Go/github.com/labstack/echo/v5 Attributes: Fix available

Malicious code in wm-eslint-fe (npm) Affected packages: npm/wm-eslint-fe Attributes: No fix available

Malicious code in array-shuffler-utils-99 (npm) Affected packages: npm/array-shuffler-utils-99 Attributes: No fix available

Malicious code in rce-test (PyPI) Affected packages: PyPI/rce-test Attributes: No fix available

Malicious code in @fongsidev/scraper (npm) Affected packages: npm/@fongsidev/scraper Attributes: No fix available

Affected packages: MinimOS/openfga-fips Attributes: Fix available

Affected packages: MinimOS/corretto-fips-config-17 Attributes: Fix available

Red Hat Security Advisory: httpd security update Affected packages: Red Hat:enterprise_linux:10.2/httpd、Red Hat:enterprise_linux:10.2/httpd-core、Red Hat:enterprise_linux:10.2/httpd-core-debuginfo、Red Hat:enterprise_linux:10.2/httpd-debuginfo、Red Hat:enterprise_linux:10.2/httpd-debugsource、... 15 more Attributes: Fix available、Severity - 4.6 (Medium)

Important: golang security update Affected packages: Rocky Linux:10/golang Attributes: Fix available、Severity - 7.5 (High)

Moderate: assertj-core security update Affected packages: Rocky Linux:10/assertj-core Attributes: Fix available、Severity - 6.1 (Medium)

Important: gstreamer1-plugins-base security update Affected packages: Rocky Linux:8/gstreamer1-plugins-base Attributes: Fix available、Severity - 7.8 (High)

AIKIDO-2026-961622 in @fastify/busboy - Patched by Root Affected packages: Root:npm/@fastify/busboy、Root:npm/@rootio/fastify__busboy Attributes: Fix available

CVE-2004-0230 in linux - Patched by Root Affected packages: Root:Debian:13/linux、Root:Debian:13/rootio-linux Attributes: Fix available

Affected packages: Debian:11/adminer、Debian:12/adminer、Debian:13/adminer、Debian:14/adminer Attributes: Fix available

Affected packages: Debian:11/openexr、Debian:12/openexr、Debian:13/openexr、Debian:14/openexr Attributes: No fix available

Affected packages: Debian:11/openexr、Debian:12/openexr、Debian:13/openexr、Debian:14/openexr Attributes: No fix available