OSV.dev · 实时热榜
- 01GHSA-3p64-6gvh-82v5 · MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth Affected packages: npm/mlflow Attributes: Fix available、Severity - 6.5 (Medium)
最高第 2 名06:03 达到06:03 首次观测上榜10:19 观测离榜累计约4小时16分 - 02GHSA-7gwp-5pfp-969j · MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) Affected packages: PyPI/mlflow Attributes: Fix available、Severity - 9.3 (Critical)
最高第 3 名06:03 达到06:03 首次观测上榜10:19 观测离榜累计约4小时16分 - 03GHSA-8g4w-4ffg-8vgx · 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint Affected packages: npm/9router Attributes: No fix available、Severity - 8.6 (High)
最高第 4 名06:03 达到06:03 首次观测上榜10:19 观测离榜累计约4小时16分 - 04GHSA-8qf9-62x2-82pp · chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots Affected packages: npm/chrome-devtools-mcp Attributes: Fix available、Severity - 6.1 (Medium)
最高第 7 名06:03 达到06:03 首次观测上榜10:19 观测离榜累计约4小时16分 - 05GHSA-gc95-3vw8-vg43 · docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service Affected packages: Maven/org.docx4j:docx4j-core Attributes: Fix available、Severity - 7.5 (High)
最高第 9 名06:03 达到06:03 首次观测上榜10:19 观测离榜累计约4小时16分 - 06GHSA-gqch-g4w5-7qcw · MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id Affected packages: npm/mlflow Attributes: Fix available、Severity - 7.1 (High)
最高第 1 名06:03 达到06:03 首次观测上榜10:19 观测离榜累计约4小时16分 - 07GHSA-mpwr-8vm7-h73f · package pkcs12: Authentication bypass in Decode functions
package pkcs12: Authentication bypass in Decode functions Affected packages: Go/software.sslmate.com/src/go-pkcs12 Attributes: Fix available、Severity - 6.3 (Medium)
最高第 8 名06:03 达到06:03 首次观测上榜10:19 观测离榜累计约4小时16分 - 08GHSA-p28p-j94q-pg32 · http4k: `DigestAuthProvider.verify` did not bind to request URI
http4k: `DigestAuthProvider.verify` did not bind to request URI Affected packages: Maven/org.http4k:http4k-security-digest Attributes: Fix available、Severity - 8.1 (High)
最高第 5 名06:03 达到06:03 首次观测上榜10:19 观测离榜累计约4小时16分 - 09GHSA-vxxm-wwqh-mh47 · http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI Affected packages: Maven/org.http4k:http4k-security-digest Attributes: Fix available、Severity - 6.5 (Medium)
最高第 6 名06:03 达到06:03 首次观测上榜10:19 观测离榜累计约4小时16分 - 10ECHO-e07c-2fba-e60c · Echo/dnsmasq
Affected packages: Echo/dnsmasq Attributes: No fix available
最高第 1 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 11MINI-263c-frj3-4m39 · MinimOS/apache-hop
Affected packages: MinimOS/apache-hop Attributes: Fix available
最高第 12 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 12MINI-2h56-fx32-4fm9 · MinimOS/apache-hop
Affected packages: MinimOS/apache-hop Attributes: Fix available
最高第 13 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 13MINI-5h9f-94j9-rfg9 · MinimOS/fluent-operator
Affected packages: MinimOS/fluent-operator Attributes: Fix available
最高第 2 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 14MINI-73cj-83m4-3fxh · MinimOS/fluent-operator
Affected packages: MinimOS/fluent-operator Attributes: Fix available
最高第 3 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 15MINI-7fj7-vxcv-rgmr · MinimOS/frankenphp-8.3
Affected packages: MinimOS/frankenphp-8.3 Attributes: Fix available
最高第 4 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 16MINI-8frp-hrvm-935q · MinimOS/fluent-operator-fips
Affected packages: MinimOS/fluent-operator-fips Attributes: Fix available
最高第 5 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 17MINI-f8qq-x2mm-xpvx · MinimOS/frankenphp-8.3
Affected packages: MinimOS/frankenphp-8.3 Attributes: Fix available
最高第 6 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 18MINI-gvc8-qpj6-wm25 · MinimOS/fluent-operator
Affected packages: MinimOS/fluent-operator Attributes: Fix available
最高第 7 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 19MINI-hw8j-688h-5j4m · MinimOS/fluent-operator-fips
Affected packages: MinimOS/fluent-operator-fips Attributes: Fix available
最高第 8 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 20MINI-j3fh-vr4c-7r4v · MinimOS/fluent-operator-fips
Affected packages: MinimOS/fluent-operator-fips Attributes: Fix available
最高第 9 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 21MINI-wjw5-4frv-7p58 · MinimOS/frankenphp-8.2
Affected packages: MinimOS/frankenphp-8.2 Attributes: Fix available
最高第 10 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 22MINI-x7hh-8vvv-7h5h · MinimOS/frankenphp-8.2
Affected packages: MinimOS/frankenphp-8.2 Attributes: Fix available
最高第 11 名10:19 达到10:19 首次观测上榜14:35 观测离榜累计约4小时16分 - 23ECHO-4612-02ee-2b3e · Echo/binutils
Affected packages: Echo/binutils Attributes: No fix available
最高第 1 名04:59 达到04:59 首次观测上榜08:43 观测离榜累计约3小时44分 - 24ECHO-9f82-dc11-1360 · Echo/systemd
Affected packages: Echo/systemd Attributes: No fix available
最高第 2 名04:59 达到04:59 首次观测上榜08:43 观测离榜累计约3小时44分 - 25MINI-3g2r-m98j-r8f3 · MinimOS/paketo-buildpacks-yarn-start
Affected packages: MinimOS/paketo-buildpacks-yarn-start Attributes: No fix available
最高第 1 名04:43 达到04:43 首次观测上榜08:27 观测离榜累计约3小时44分 - 26MINI-2hc7-qx7m-66jc · MinimOS/apache-hop
Affected packages: MinimOS/apache-hop Attributes: Fix available
最高第 14 名10:19 达到10:19 首次观测上榜13:47 观测离榜累计约3小时28分 - 27GHSA-g4w2-6h2r-3m3w · http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS Affected packages: Maven/org.http4k:http4k-core Attributes: Fix available、Severity - 7.5 (High)
最高第 10 名06:03 达到06:03 首次观测上榜08:59 观测离榜累计约2小时56分 - 28GHSA-j659-8xh6-5pq5 · atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard Affected packages: PyPI/atomic-agents-stack Attributes: Fix available、Severity - 8.7 (High)
最高第 11 名06:03 达到06:03 首次观测上榜08:59 观测离榜累计约2小时56分 - 29GHSA-xhcr-cqfr-m3hv · atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE) Affected packages: PyPI/atomic-agents-stack Attributes: Fix available、Severity - 8.7 (High)
最高第 12 名06:03 达到06:03 首次观测上榜08:59 观测离榜累计约2小时56分 - 30MINI-2hrw-cg64-69g9 · MinimOS/apache-hop
Affected packages: MinimOS/apache-hop Attributes: Fix available
最高第 15 名10:19 达到10:19 首次观测上榜13:15 观测离榜累计约2小时56分 - 31MINI-2hvq-2mxv-6c6j · MinimOS/apache-hop-fips
Affected packages: MinimOS/apache-hop-fips Attributes: Fix available
最高第 16 名10:19 达到10:19 首次观测上榜13:15 观测离榜累计约2小时56分 - 32MINI-293c-644p-3pw9 · MinimOS/portainer-agent-2.39
Affected packages: MinimOS/portainer-agent-2.39 Attributes: Fix available
最高第 3 名16:11 达到16:11 首次观测上榜18:35 观测离榜累计约2小时24分 - 33MINI-2cxp-rx47-m777 · MinimOS/paketo-buildpacks-go-dist-2.10.9
Affected packages: MinimOS/paketo-buildpacks-go-dist-2.10.9 Attributes: Fix available
最高第 5 名16:11 达到16:11 首次观测上榜18:35 观测离榜累计约2小时24分 - 34MINI-358v-fcf7-9hm9 · MinimOS/paketo-buildpacks-go-mod-vendor-1.1.21
Affected packages: MinimOS/paketo-buildpacks-go-mod-vendor-1.1.21 Attributes: Fix available
最高第 6 名16:11 达到16:11 首次观测上榜18:35 观测离榜累计约2小时24分 - 35MINI-3c8w-m6ch-mm23 · MinimOS/paketo-buildpacks-go-mod-vendor-1.1.21
Affected packages: MinimOS/paketo-buildpacks-go-mod-vendor-1.1.21 Attributes: Fix available
最高第 7 名16:11 达到16:11 首次观测上榜18:35 观测离榜累计约2小时24分 - 36MINI-3g7w-jrjq-p267 · MinimOS/paketo-buildpacks-go-build-2.4.20
Affected packages: MinimOS/paketo-buildpacks-go-build-2.4.20 Attributes: Fix available
最高第 8 名16:11 达到16:11 首次观测上榜18:35 观测离榜累计约2小时24分 - 37MINI-4crh-crpv-4q84 · MinimOS/paketo-buildpacks-go-mod-vendor-1.1.21
Affected packages: MinimOS/paketo-buildpacks-go-mod-vendor-1.1.21 Attributes: Fix available
最高第 9 名16:11 达到16:11 首次观测上榜18:35 观测离榜累计约2小时24分 - 38MINI-7j6q-29j2-4397 · MinimOS/registration-operator
Affected packages: MinimOS/registration-operator Attributes: Fix available
最高第 1 名16:11 达到16:11 首次观测上榜18:35 观测离榜累计约2小时24分 - 39MINI-c89j-6m25-p2v8 · MinimOS/portainer-agent-2.39
Affected packages: MinimOS/portainer-agent-2.39 Attributes: Fix available
最高第 4 名16:11 达到16:11 首次观测上榜18:35 观测离榜累计约2小时24分 - 40MINI-h8jg-3778-jh79 · MinimOS/registration-operator
Affected packages: MinimOS/registration-operator Attributes: Fix available
最高第 2 名16:11 达到16:11 首次观测上榜18:35 观测离榜累计约2小时24分 - 41MINI-3vp8-px7c-x2j2 · MinimOS/paketo-buildpacks-yarn-start
Affected packages: MinimOS/paketo-buildpacks-yarn-start Attributes: No fix available
最高第 2 名04:43 达到04:43 首次观测上榜07:07 观测离榜累计约2小时24分 - 42MINI-4fxf-mmpc-7xw8 · MinimOS/paketo-buildpacks-go-dist-2.10.9
Affected packages: MinimOS/paketo-buildpacks-go-dist-2.10.9 Attributes: Fix available
最高第 10 名16:11 达到16:11 首次观测上榜18:19 观测离榜累计约2小时8分 - 43MINI-5942-67vq-m7q8 · MinimOS/paketo-buildpacks-go-build-2.4.20
Affected packages: MinimOS/paketo-buildpacks-go-build-2.4.20 Attributes: Fix available
最高第 11 名16:11 达到16:11 首次观测上榜18:19 观测离榜累计约2小时8分 - 44MINI-45g6-v8h4-75g2 · MinimOS/velero
Affected packages: MinimOS/velero Attributes: Fix available
最高第 4 名20:11 达到20:11 首次观测上榜22:19 观测离榜累计约2小时8分 - 45MINI-9fqc-r248-9q6c · MinimOS/velero
Affected packages: MinimOS/velero Attributes: Fix available
最高第 1 名20:11 达到20:11 首次观测上榜22:19 观测离榜累计约2小时8分 - 46MINI-ccxp-46cv-6h4x · MinimOS/metrics-server
Affected packages: MinimOS/metrics-server Attributes: Fix available
最高第 2 名20:11 达到20:11 首次观测上榜22:19 观测离榜累计约2小时8分 - 47MINI-rpqp-2vvq-c5p5 · MinimOS/kube-state-metrics
Affected packages: MinimOS/kube-state-metrics Attributes: Fix available
最高第 3 名20:11 达到20:11 首次观测上榜22:19 观测离榜累计约2小时8分 - 48JLSEC-2026-1344 · TOCTOU in GNU tar allows unauthorized file modification by a local attacker
TOCTOU in GNU tar allows unauthorized file modification by a local attacker Affected packages: Julia/Tar_jll Attributes: No fix available、Severity - 4.4 (Medium)
最高第 1 名08:27 达到08:27 首次观测上榜10:19 观测离榜累计约1小时52分 - 49GHSA-8c42-7qj2-3j46 · Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite Affected packages: Maven/io.netty:netty-codec-http Attributes: Fix available、Severity - 6.5 (Medium)
最高第 1 名02:35 达到02:35 首次观测上榜04:27 观测离榜累计约1小时52分 - 50MAL-2026-14100 · Malicious code in socks5901 (PyPI)
Malicious code in socks5901 (PyPI) Affected packages: PyPI/socks5901 Attributes: No fix available
最高第 13 名07:07 达到07:07 首次观测上榜08:59 观测离榜累计约1小时52分