OSV.dev · 实时热榜

Malicious code in @zzzgenesis00/docker-api-client (npm) Affected packages: npm/@zzzgenesis00/docker-api-client Attributes: No fix available

Malicious code in @zzzgenesis00/mnemonic-to-key (npm) Affected packages: npm/@zzzgenesis00/mnemonic-to-key Attributes: No fix available

Malicious code in bcore-bravo-eslint-config (npm) Affected packages: npm/bcore-bravo-eslint-config Attributes: No fix available

Malicious code in beaver-ui-card-large (npm) Affected packages: npm/beaver-ui-card-large Attributes: No fix available

Malicious code in ckcc-protocol (npm) Affected packages: npm/ckcc-protocol Attributes: No fix available

Malicious code in hwi-lib (npm) Affected packages: npm/hwi-lib Attributes: No fix available

Malicious code in ledger-lib (npm) Affected packages: npm/ledger-lib Attributes: No fix available

Malicious code in sso-tramvai-module-context-auth (npm) Affected packages: npm/sso-tramvai-module-context-auth Attributes: No fix available

Malicious code in trezor-lib (npm) Affected packages: npm/trezor-lib Attributes: No fix available

Malicious code in volna-boxy-di-test (npm) Affected packages: npm/volna-boxy-di-test Attributes: No fix available

Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated ` overrideConfig ` Spread in Prediction API Affected packages: npm/flowise Attributes: Fix available、Severity - 8.8 (High)

Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses Affected packages: npm/flowise Attributes: Fix available、Severity - 7.6 (High)

Flowise RCE via SQLite Record Manager Node Affected packages: npm/flowise、npm/flowise-components Attributes: Fix available、Severity - 9.4 (Critical)

Malicious code in @zzzgenesis00/playwrite (npm) Affected packages: npm/@zzzgenesis00/playwrite Attributes: No fix available

Malicious code in boardwalk-js-tests (npm) Affected packages: npm/boardwalk-js-tests Attributes: No fix available

Malicious code in checkout-create-pos-order-am (npm) Affected packages: npm/checkout-create-pos-order-am Attributes: No fix available

Malicious code in hubert-appointment-v2-task-create-am (npm) Affected packages: npm/hubert-appointment-v2-task-create-am Attributes: No fix available

Malicious code in bigops-eslint (npm) Affected packages: npm/bigops-eslint Attributes: No fix available

Malicious code in greatcall-customers-commandapi (npm) Affected packages: npm/greatcall-customers-commandapi Attributes: No fix available

Flowise: ` DELETE /api/v1/chatflows/:id ` does not validate resource type, allowing ` agentflows:delete ` and ` chatflows:delete ` to delete each other’s flow type Affected packages: npm/flowise Attributes: Fix available、Severity - 7.1 (High)

Flowise: Remote Code Execution Vulnerability in CSVAgent Affected packages: npm/flowise、npm/flowise-components Attributes: Fix available、Severity - 9.4 (Critical)

Updated acl attr packages fix security vulnerabilities Affected packages: Mageia:10/acl、Mageia:10/attr、Mageia:9/acl、Mageia:9/attr Attributes: Fix available

Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) Affected packages: npm/flowise、npm/flowise-components Attributes: Fix available、Severity - 8.7 (High)

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified Affected packages: npm/flowise、npm/flowise-components Attributes: Fix available、Severity - 9.2 (Critical)

Affected packages: MinimOS/nextflow-26.04 Attributes: No fix available

Affected packages: MinimOS/nextflow-fips-25.10 Attributes: No fix available

Affected packages: MinimOS/nextflow-25.10 Attributes: No fix available

Affected packages: MinimOS/nextflow-fips-25.10 Attributes: No fix available

Affected packages: MinimOS/nextflow-25.10 Attributes: No fix available

Affected packages: MinimOS/nextflow-fips-25.10 Attributes: No fix available

Updated php packages fix security vulnerabilities Affected packages: Mageia:9/php Attributes: Fix available

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE Affected packages: npm/flowise、npm/flowise-components Attributes: Fix available、Severity - 9.5 (Critical)

Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override Affected packages: npm/flowise、npm/flowise-components Attributes: Fix available、Severity - 9.4 (Critical)

Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update Affected packages: Red Hat:rhel_eus:9.6::appstream/gstreamer1-plugins-ugly-free、Red Hat:rhel_eus:9.6::appstream/gstreamer1-plugins-ugly-free-debuginfo、Red Hat:rhel_eus:9.6::appstream/gstreamer1-plugins-ugly-free-debugsource Attributes: Fix available、Severity - 7.1 (High)

Red Hat Security Advisory: go-toolset:rhel8 security update Affected packages: Red Hat:rhel_aus:8.6::appstream/delve、Red Hat:rhel_aus:8.6::appstream/delve-debuginfo、Red Hat:rhel_aus:8.6::appstream/delve-debugsource、Red Hat:rhel_aus:8.6::appstream/go-toolset、Red Hat:rhel_aus:8.6::appstream/golang、... 28 more Attributes: Fix available、Severity - 8.6 (High)

Red Hat Security Advisory: skopeo security update Affected packages: Red Hat:rhel_eus:9.6::appstream/skopeo、Red Hat:rhel_eus:9.6::appstream/skopeo-debuginfo、Red Hat:rhel_eus:9.6::appstream/skopeo-debugsource、Red Hat:rhel_eus:9.6::appstream/skopeo-tests Attributes: Fix available、Severity - 7.5 (High)

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation Affected packages: npm/flowise、npm/flowise-components Attributes: Fix available、Severity - 9.4 (Critical)

Flowise: Authenticated arbitrary file write in the ` S3 Directory ` document loader via unsanitized S3 object keys Affected packages: npm/flowise、npm/flowise-components Attributes: Fix available、Severity - 7.2 (High)

Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure Affected packages: npm/flowise Attributes: Fix available、Severity - 7.1 (High)

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store Affected packages: npm/flowise Attributes: Fix available、Severity - 7.1 (High)

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history Affected packages: npm/flowise Attributes: Fix available、Severity - 8.3 (High)

Flowise: Incomplete Credential Redaction Exposes Secrets via API Affected packages: npm/flowise Attributes: Fix available、Severity - 6.5 (Medium)

Flowise: Cross-Workspace OAuth2 Credential Metadata Leak Affected packages: npm/flowise Attributes: Fix available、Severity - 7.6 (High)

Low: kernel security, bug fix, and enhancement update Affected packages: Rocky Linux:9/kernel Attributes: Fix available、Severity - 5.5 (Medium)

Affected packages: MinimOS/nextflow-26.04 Attributes: No fix available

Affected packages: MinimOS/nextflow-25.10 Attributes: No fix available

Ghost: Server-side request forgery via DNS rebinding in external request handling Affected packages: npm/ghost Attributes: Fix available、Severity - 4.0 (Medium)

Ghost: Mobiledoc image-size fetch SSRF Affected packages: npm/ghost Attributes: Fix available、Severity - 5.4 (Medium)

Ghost: Private IP filtering bypass to make server-side requests to internal services Affected packages: npm/ghost Attributes: Fix available、Severity - 5.8 (Medium)

Malicious code in @zzzgenesis00/crypto-config (npm) Affected packages: npm/@zzzgenesis00/crypto-config Attributes: No fix available