OSV.dev · 实时热榜

MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery Affected packages: npm/magicmirror Attributes: Fix available、Severity - 6.3 (Medium)

MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions Affected packages: npm/magicmirror Attributes: Fix available、Severity - 2.3 (Low)

MagicMirror: ssrf calendar .js Affected packages: npm/magicmirror Attributes: Fix available、Severity - 6.3 (Medium)

Affected packages: Debian:11/weechat、Debian:12/weechat、Debian:13/weechat、Debian:14/weechat Attributes: Fix available

Multiple denial of service vulnerabilities in rsc.io/pdf and forks Affected packages: Go/github.com/dslipak/pdf、Go/github.com/ledongthuc/pdf、Go/rsc.io/pdf Attributes: No fix available

Red Hat Security Advisory: python3 security update Affected packages: Red Hat:enterprise_linux:8::appstream/platform-python、Red Hat:enterprise_linux:8::appstream/platform-python-debug、Red Hat:enterprise_linux:8::appstream/platform-python-devel、Red Hat:enterprise_linux:8::appstream/python3-debuginfo、Red Hat:enterprise_linux:8::appstream/python3-debugsource、... 9 more Attributes: Fix available、Severity - 7.3 (High)

Red Hat Security Advisory: grafana-pcp security update Affected packages: Red Hat:rhel_eus:9.6::appstream/grafana-pcp、Red Hat:rhel_eus:9.6::appstream/grafana-pcp-debuginfo、Red Hat:rhel_eus:9.6::appstream/grafana-pcp-debugsource Attributes: Fix available、Severity - 8.2 (High)

Red Hat Security Advisory: kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_126_1, kpatch-patch-5_14_0-427_68_2, and kpatch-patch-5_14_0-427_84_1 security update Affected packages: Red Hat:rhel_e4s:9.4::baseos/kpatch-patch-5_14_0-427_100_1、Red Hat:rhel_e4s:9.4::baseos/kpatch-patch-5_14_0-427_100_1-debuginfo、Red Hat:rhel_e4s:9.4::baseos/kpatch-patch-5_14_0-427_100_1-debugsource、Red Hat:rhel_e4s:9.4::baseos/kpatch-patch-5_14_0-427_113_1、Red Hat:rhel_e4s:9.4::baseos/kpatch-patch-5_14_0-427_113_1-debuginfo、... 10 more Attributes: Fix available、Severity - 7.8 (High)

Red Hat Security Advisory: kpatch-patch-5_14_0-570_116_1, kpatch-patch-5_14_0-570_17_1, kpatch-patch-5_14_0-570_39_1, kpatch-patch-5_14_0-570_66_1, and kpatch-patch-5_14_0-570_94_1 security update Affected packages: Red Hat:rhel_eus:9.6::baseos/kpatch-patch-5_14_0-570_116_1、Red Hat:rhel_eus:9.6::baseos/kpatch-patch-5_14_0-570_116_1-debuginfo、Red Hat:rhel_eus:9.6::baseos/kpatch-patch-5_14_0-570_116_1-debugsource、Red Hat:rhel_eus:9.6::baseos/kpatch-patch-5_14_0-570_17_1、Red Hat:rhel_eus:9.6::baseos/kpatch-patch-5_14_0-570_17_1-debuginfo、... 10 more Attributes: Fix available、Severity - 7.8 (High)

Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Affected packages: Red Hat:enterprise_linux:8::appstream/gstreamer1-plugins-bad-free、Red Hat:enterprise_linux:8::appstream/gstreamer1-plugins-bad-free-debuginfo、Red Hat:enterprise_linux:8::appstream/gstreamer1-plugins-bad-free-debugsource、Red Hat:enterprise_linux:8::crb/gstreamer1-plugins-bad-free-debuginfo、Red Hat:enterprise_linux:8::crb/gstreamer1-plugins-bad-free-debugsource、... 1 more Attributes: Fix available、Severity - 7.6 (High)

Red Hat Security Advisory: kernel security, bug fix, and enhancement update Affected packages: Red Hat:rhel_e4s:9.4::appstream/bpftool-debuginfo、Red Hat:rhel_e4s:9.4::appstream/kernel-64k-debug-debuginfo、Red Hat:rhel_e4s:9.4::appstream/kernel-64k-debug-devel、Red Hat:rhel_e4s:9.4::appstream/kernel-64k-debug-devel-matched、Red Hat:rhel_e4s:9.4::appstream/kernel-64k-debuginfo、... 119 more Attributes: Fix available、Severity - 8.1 (High)

Red Hat Security Advisory: kernel security, bug fix, and enhancement update Affected packages: Red Hat:rhel_eus:9.6::appstream/kernel-64k-debug-debuginfo、Red Hat:rhel_eus:9.6::appstream/kernel-64k-debug-devel、Red Hat:rhel_eus:9.6::appstream/kernel-64k-debug-devel-matched、Red Hat:rhel_eus:9.6::appstream/kernel-64k-debuginfo、Red Hat:rhel_eus:9.6::appstream/kernel-64k-devel、... 155 more Attributes: Fix available、Severity - 7.1 (High)

Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Affected packages: Red Hat:rhel_e4s:9.2::appstream/gstreamer1-plugins-bad-free、Red Hat:rhel_e4s:9.2::appstream/gstreamer1-plugins-bad-free-debuginfo、Red Hat:rhel_e4s:9.2::appstream/gstreamer1-plugins-bad-free-debugsource Attributes: Fix available、Severity - 7.5 (High)

Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Affected packages: Red Hat:rhel_aus:8.4::appstream/gstreamer1-plugins-bad-free、Red Hat:rhel_aus:8.4::appstream/gstreamer1-plugins-bad-free-debuginfo、Red Hat:rhel_aus:8.4::appstream/gstreamer1-plugins-bad-free-debugsource、Red Hat:rhel_eus_long_life:8.4::appstream/gstreamer1-plugins-bad-free、Red Hat:rhel_eus_long_life:8.4::appstream/gstreamer1-plugins-bad-free-debuginfo、... 1 more Attributes: Fix available、Severity - 7.5 (High)

Affected packages: Debian:11/weechat、Debian:12/weechat、Debian:13/weechat、Debian:14/weechat Attributes: Fix available

MobSF's CSRF checks not enforced after Django migration Affected packages: PyPI/mobsf Attributes: Fix available、Severity - 6.5 (Medium)

MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads Affected packages: PyPI/mobsf Attributes: Fix available、Severity - 5.5 (Medium)

MobSF has SSRF port restriction bypass in assetlinks_check Affected packages: PyPI/mobsf Attributes: Fix available、Severity - 3.0 (Low)

LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module Affected packages: Packagist/librenms/librenms Attributes: Fix available、Severity - 8.6 (High)

GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data Affected packages: PyPI/geolens、PyPI/geolens-cli、npm/@geolens/sdk Attributes: Fix available、Severity - 7.5 (High)

MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables Affected packages: npm/magicmirror Attributes: Fix available、Severity - 4.3 (Medium)

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction Affected packages: PyPI/mobsf Attributes: Fix available、Severity - 4.9 (Medium)

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion in github.com/aws/aws-cdk-go/awscdk Affected packages: Go/github.com/aws/aws-cdk-go/awscdk、Go/github.com/aws/aws-cdk-go/awscdk/v2 Attributes: Fix available

Affected packages: MinimOS/vertical-pod-autoscaler、MinimOS/vertical-pod-autoscaler-recommender、MinimOS/vertical-pod-autoscaler-updater Attributes: Fix available

Affected packages: MinimOS/temporal-cassandra-tool-1.28、MinimOS/temporal-server-1.28 Attributes: Fix available

Malicious code in postcss-initialize-provider (npm) Affected packages: npm/postcss-initialize-provider Attributes: No fix available

Important: .NET 9.0 security, bug fix, and enhancement update Affected packages: Rocky Linux:9/dotnet9.0 Attributes: Fix available、Severity - 7.8 (High)

Important: .NET 10.0 security, bug fix, and enhancement update Affected packages: Rocky Linux:9/dotnet10.0 Attributes: Fix available、Severity - 7.8 (High)

Important: sg3_utils security, bug fix, and enhancement update Affected packages: Rocky Linux:8/sg3_utils Attributes: Fix available、Severity - 7.6 (High)

Important: gstreamer1-plugins-bad-free security update Affected packages: Rocky Linux:8/gstreamer1-plugins-bad-free Attributes: Fix available、Severity - 7.6 (High)

Affected packages: MinimOS/tdbg-1.31、MinimOS/temporal-cassandra-tool-1.31、MinimOS/temporal-server-1.31、MinimOS/temporal-sql-tool-1.31 Attributes: Fix available

Important: postgresql security update Affected packages: Rocky Linux:9/postgresql Attributes: Fix available、Severity - 7.5 (High)

Important: postgresql:12 security update Affected packages: Rocky Linux:8/pg_repack、Rocky Linux:8/pgaudit、Rocky Linux:8/postgres-decoderbufs、Rocky Linux:8/postgresql Attributes: Fix available、Severity - 7.5 (High)

JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go Affected packages: Go/github.com/google/cel-go Attributes: Fix available

Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi Affected packages: Go/github.com/getkin/kin-openapi Attributes: Fix available

TuxCare security update for orjson (2 CVEs) Affected packages: TuxCare:PyPI/orjson Attributes: Fix available

TuxCare security update for log4j:log4j (1 CVE) Affected packages: TuxCare:Maven/log4j:log4j Attributes: Fix available

Malicious code in nice-utils-helper (npm) Affected packages: npm/nice-utils-helper Attributes: No fix available

Malicious code in pump-fun-skills (npm) Affected packages: npm/pump-fun-skills Attributes: No fix available

Malicious code in de-morgan (npm) Affected packages: npm/de-morgan Attributes: No fix available

Malicious code in easydsbots (npm) Affected packages: npm/easydsbots Attributes: No fix available

Malicious code in electron-sessions (npm) Affected packages: npm/electron-sessions Attributes: No fix available

Malicious code in karma-proxy (npm) Affected packages: npm/karma-proxy Attributes: No fix available

Malicious code in no-for-of-loops (npm) Affected packages: npm/no-for-of-loops Attributes: No fix available

Malicious code in novel-suduko (npm) Affected packages: npm/novel-suduko Attributes: No fix available

Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False Affected packages: PyPI/lemur Attributes: Fix available、Severity - 4.3 (Medium)

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority Affected packages: PyPI/lemur Attributes: Fix available、Severity - 6.5 (Medium)

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it Affected packages: PyPI/lemur Attributes: Fix available、Severity - 7.3 (High)

linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE) Affected packages: PyPI/linuxfabrik-lib Attributes: Fix available、Severity - 5.5 (Medium)

Malicious code in api-rs-tuils (npm) Affected packages: npm/api-rs-tuils Attributes: No fix available