OSV.dev · 实时热榜

Keycloak-services: keycloak-services: client access-type policy condition bypass during client update Affected packages: Bitnami/keycloak Attributes: Fix available、Severity - 6.5 (Medium)

zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits Affected packages: Bitnami/python Attributes: No fix available、Severity - 2.1 (Low)

Apache Tomcat: Authenticated WebSocket session survives end of HTTP session Affected packages: Bitnami/tomcat Attributes: Fix available、Severity - 6.8 (Medium)

Affected packages: Debian:11/libhtml-formfu-perl、Debian:12/libhtml-formfu-perl、Debian:13/libhtml-formfu-perl、Debian:14/libhtml-formfu-perl Attributes: No fix available

Affected packages: Debian:13/open62541、Debian:14/open62541 Attributes: No fix available

Affected packages: Echo/keycloak-25 Attributes: Fix available

AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error Affected packages: Hex/ash_ai、github.com/ash-project/ash_ai Attributes: Fix available、Severity - 7.1 (High)

Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names Affected packages: Hex/ash_graphql、github.com/ash-project/ash_graphql Attributes: Fix available、Severity - 6.9 (Medium)

rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres Affected packages: Hex/ash_postgres、github.com/ash-project/ash_postgres Attributes: Fix available、Severity - 7.2 (High)

MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header Affected packages: Hex/ash_ai、github.com/ash-project/ash_ai Attributes: Fix available、Severity - 7.4 (High)

Cloaked plaintext leaks through a non-sensitive action argument in AshCloak Affected packages: Hex/ash_cloak、github.com/ash-project/ash_cloak Attributes: Fix available、Severity - 2.1 (Low)

AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass Affected packages: Hex/ash_admin、github.com/ash-project/ash_admin Attributes: Fix available、Severity - 2.1 (Low)

Path traversal in AshAdmin file uploads via unsanitized client filename Affected packages: Hex/ash_admin、github.com/ash-project/ash_admin Attributes: Fix available、Severity - 8.3 (High)

AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data Affected packages: Hex/ash_phoenix、github.com/ash-project/ash_phoenix Attributes: Fix available、Severity - 2.3 (Low)

Malicious code in tronlinker (PyPI) Affected packages: PyPI/tronlinker Attributes: No fix available

Malicious code in pyservercheck (PyPI) Affected packages: PyPI/pyservercheck Attributes: No fix available

Affected packages: MinimOS/argocd-3.5、MinimOS/argocd-3.5-compat Attributes: Fix available

Affected packages: MinimOS/weaviate-1.39 Attributes: Fix available

Red Hat Security Advisory: rhc security update Affected packages: Red Hat:enterprise_linux_eus:10.0/rhc、Red Hat:enterprise_linux_eus:10.0/rhc-debuginfo、Red Hat:enterprise_linux_eus:10.0/rhc-debugsource Attributes: Fix available、Severity - 8.8 (High)

Moderate: pipewire security update Affected packages: Rocky Linux:9/pipewire Attributes: Fix available、Severity - 6.5 (Medium)

AIKIDO-2026-61483 in spring-security-oauth2-jose - Patched by Root Affected packages: Root:Maven/io.root.spring-security-oauth2-jose、Root:Maven/spring-security-oauth2-jose Attributes: Fix available

CVE-2026-23745 in tar - Patched by Root Affected packages: Root:npm/@rootio/tar、Root:npm/tar Attributes: Fix available、Severity - 6.1 (Medium)

CVE-2025-29087 in sqlite - Patched by Root Affected packages: Root:Alpine:3.18/rootio-sqlite、Root:Alpine:3.18/sqlite Attributes: Fix available、Severity - 7.5 (High)

CVE-2026-1642 in nginx - Patched by Root Affected packages: Root:Alpine:3.20/nginx、Root:Alpine:3.20/rootio-nginx Attributes: Fix available

CVE-2026-63382 in libevent - Patched by Root Affected packages: Root:Debian:12/libevent、Root:Debian:12/rootio-libevent Attributes: Fix available

Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes Affected packages: Bitnami/keycloak Attributes: Fix available、Severity - 6.5 (Medium)

zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits Affected packages: Bitnami/python-min Attributes: No fix available、Severity - 2.1 (Low)

Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset Affected packages: Bitnami/tomcat Attributes: Fix available、Severity - 7.5 (High)

Affected packages: Echo/keycloak-25 Attributes: Fix available

EEx template evaluation of prompt content in AshAi enables remote code execution Affected packages: Hex/ash_ai、github.com/ash-project/ash_ai Attributes: Fix available、Severity - 10.0 (Critical)

Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read Affected packages: Hex/ash_graphql、github.com/ash-project/ash_graphql Attributes: Fix available、Severity - 7.1 (High)

Unsafe deserialization of decrypted terms enables node DoS in AshCloak Affected packages: Hex/ash_cloak、github.com/ash-project/ash_cloak Attributes: Fix available、Severity - 5.9 (Medium)

AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle Affected packages: Hex/ash_admin、github.com/ash-project/ash_admin Attributes: Fix available、Severity - 2.3 (Low)

AshAi echoes raw tool exception messages into the conversation, disclosing internal details Affected packages: Hex/ash_ai、github.com/ash-project/ash_ai Attributes: Fix available、Severity - 5.3 (Medium)

Query-parameter injection in AshAdmin row-action links via unencoded string primary keys Affected packages: Hex/ash_admin、github.com/ash-project/ash_admin Attributes: Fix available、Severity - 2.0 (Low)

Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain Affected packages: Hex/ash_phoenix、github.com/ash-project/ash_phoenix Attributes: Fix available、Severity - 7.6 (High)

Affected packages: MinimOS/vela-core-1.10 Attributes: Fix available

Affected packages: MinimOS/amazon-cloudwatch-agent Attributes: Fix available

Affected packages: MinimOS/weaviate-fips-1.38 Attributes: Fix available

Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update Affected packages: Red Hat:rhel_e4s:9.2::baseos/sg3_utils、Red Hat:rhel_e4s:9.2::baseos/sg3_utils-debuginfo、Red Hat:rhel_e4s:9.2::baseos/sg3_utils-debugsource、Red Hat:rhel_e4s:9.2::baseos/sg3_utils-libs、Red Hat:rhel_e4s:9.2::baseos/sg3_utils-libs-debuginfo Attributes: Fix available、Severity - 7.6 (High)

Moderate: libxml2 security update Affected packages: Rocky Linux:9/libxml2 Attributes: Fix available、Severity - 5.9 (Medium)

CVE-2024-43414 in @apollo/gateway - Patched by Root Affected packages: Root:npm/@apollo/gateway、Root:npm/@apollo/query-planner、Root:npm/@rootio/apollo__gateway、Root:npm/@rootio/apollo__query-planner Attributes: Fix available

CVE-2026-23950 in tar - Patched by Root Affected packages: Root:npm/@rootio/tar、Root:npm/tar Attributes: Fix available、Severity - 8.8 (High)

CVE-2026-11824 in sqlite - Patched by Root Affected packages: Root:Alpine:3.18/rootio-sqlite、Root:Alpine:3.18/sqlite Attributes: Fix available

CVE-2026-27651 in nginx - Patched by Root Affected packages: Root:Alpine:3.20/nginx、Root:Alpine:3.20/rootio-nginx Attributes: Fix available

CVE-2026-63383 in libevent - Patched by Root Affected packages: Root:Debian:12/libevent、Root:Debian:12/rootio-libevent Attributes: Fix available

Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation Affected packages: Bitnami/keycloak Attributes: Fix available、Severity - 7.2 (High)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana Affected packages: Bitnami/kibana Attributes: Fix available、Severity - 4.2 (Medium)

Apache Tomcat: Principal lookup can fail open in some cases Affected packages: Bitnami/tomcat Attributes: Fix available、Severity - 8.1 (High)

Affected packages: Echo/keycloak-25 Attributes: Fix available