OSV.dev · 实时热榜

Important: php:8.2 security, bug fix, and enhancement update Affected packages: Rocky Linux:8/libzip、Rocky Linux:8/php-pear、Rocky Linux:8/php-pecl-apcu、Rocky Linux:8/php-pecl-rrd、Rocky Linux:8/php-pecl-xdebug3、... 1 more Attributes: Fix available、Severity - 7.4 (High)

Affected packages: Ubuntu:22.04:LTS/openssl、Ubuntu:24.04:LTS/edk2、Ubuntu:24.04:LTS/openssl、Ubuntu:26.04:LTS/edk2、Ubuntu:26.04:LTS/openssl、... 7 more Attributes: No fix available

Affected packages: MinimOS/prometheus-fips-2.53 Attributes: No fix available

Affected packages: MinimOS/prometheus-fips-2.53 Attributes: No fix available

Affected packages: MinimOS/prometheus-fips-2.53 Attributes: No fix available

Affected packages: MinimOS/prometheus-fips-2.53 Attributes: No fix available

Affected packages: Echo/libsoup3 Attributes: No fix available

Affected packages: MinimOS/openjdk-9、MinimOS/openjdk-9-default-jdk、MinimOS/openjdk-9-default-jvm、MinimOS/openjdk-9-demos、MinimOS/openjdk-9-doc、... 3 more Attributes: No fix available

Affected packages: MinimOS/openjdk-9、MinimOS/openjdk-9-default-jdk、MinimOS/openjdk-9-default-jvm、MinimOS/openjdk-9-demos、MinimOS/openjdk-9-doc、... 3 more Attributes: No fix available

Wagtail: Identification of documents by SHA1 hash Affected packages: PyPI/wagtail Attributes: Fix available、Severity - 3.7 (Low)

Wagtail: Improper restriction handling on descendant collections in Documents and Images API Affected packages: PyPI/wagtail Attributes: Fix available、Severity - 5.3 (Medium)

Wagtail: Improper restriction handling on Page translation API endpoint Affected packages: PyPI/wagtail Attributes: Fix available、Severity - 6.5 (Medium)

Wagtail: Improper permission handling when copying snippets Affected packages: PyPI/wagtail Attributes: Fix available、Severity - 6.5 (Medium)

Affected packages: MinimOS/openjdk-9、MinimOS/openjdk-9-default-jdk、MinimOS/openjdk-9-default-jvm、MinimOS/openjdk-9-demos、MinimOS/openjdk-9-doc、... 3 more Attributes: No fix available

Malicious code in reqcrypts (PyPI) Affected packages: PyPI/reqcrypts Attributes: No fix available

Affected packages: MinimOS/openjdk-9、MinimOS/openjdk-9-default-jdk、MinimOS/openjdk-9-default-jvm、MinimOS/openjdk-9-demos、MinimOS/openjdk-9-doc、... 3 more Attributes: No fix available

Malicious code in coin-fees (npm) Affected packages: npm/coin-fees Attributes: No fix available

gettext-converter: Prototype pollution in js2i18next() via crafted translation keys Affected packages: npm/gettext-converter Attributes: Fix available、Severity - 6.9 (Medium)

Affected packages: MinimOS/elasticsearch-fips-9.5 Attributes: Fix available

Affected packages: MinimOS/elastic-otel-collector-9.5 Attributes: Fix available

Affected packages: MinimOS/elastic-otel-collector-9.5 Attributes: Fix available

Affected packages: MinimOS/elastic-otel-collector-9.5 Attributes: Fix available

Affected packages: MinimOS/elasticsearch-fips-9.5 Attributes: Fix available

Malicious code in chai-as-soul (npm) Affected packages: npm/chai-as-soul Attributes: No fix available

Affected packages: MinimOS/openjdk-9、MinimOS/openjdk-9-default-jdk、MinimOS/openjdk-9-default-jvm、MinimOS/openjdk-9-demos、MinimOS/openjdk-9-doc、... 3 more Attributes: No fix available

Affected packages: MinimOS/openjdk-9、MinimOS/openjdk-9-default-jdk、MinimOS/openjdk-9-default-jvm、MinimOS/openjdk-9-demos、MinimOS/openjdk-9-doc、... 3 more Attributes: No fix available

Affected packages: MinimOS/openjdk-9、MinimOS/openjdk-9-default-jdk、MinimOS/openjdk-9-default-jvm、MinimOS/openjdk-9-demos、MinimOS/openjdk-9-doc、... 3 more Attributes: No fix available

Affected packages: MinimOS/openjdk-9、MinimOS/openjdk-9-default-jdk、MinimOS/openjdk-9-default-jvm、MinimOS/openjdk-9-demos、MinimOS/openjdk-9-doc、... 3 more Attributes: No fix available

Affected packages: MinimOS/openjdk-9、MinimOS/openjdk-9-default-jdk、MinimOS/openjdk-9-default-jvm、MinimOS/openjdk-9-demos、MinimOS/openjdk-9-doc、... 3 more Attributes: No fix available

Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles Affected packages: Packagist/winter/wn-backend-module Attributes: Fix available、Severity - 4.5 (Medium)

Winter: Stored XSS through Backend List widget image columns Affected packages: Packagist/winter/wn-backend-module Attributes: Fix available、Severity - 2.0 (Low)

Winter: ImportExportController AJAX handlers bypass granular import/export permission gate Affected packages: Packagist/winter/wn-backend-module Attributes: Fix available、Severity - 5.3 (Medium)

Winter: Reflected XSS through the search query parameter in the backend Table widget Affected packages: Packagist/winter/wn-backend-module Attributes: Fix available、Severity - 4.5 (Medium)

Winter: My Account preview exposes another backend user's profile by record ID Affected packages: Packagist/winter/wn-backend-module Attributes: Fix available、Severity - 4.3 (Medium)

Winter: CSRF through AJAX handler names reachable as backend page actions Affected packages: Packagist/winter/wn-backend-module Attributes: Fix available、Severity - 6.1 (Medium)

Fleet: ORDER BY column injection on activity list endpoints Affected packages: Go/github.com/fleetdm/fleet/v4 Attributes: Fix available、Severity - 3.1 (Low)

Malicious code in @js-lib-team/env-parser (npm) Affected packages: npm/@js-lib-team/env-parser Attributes: No fix available

Malicious code in express-session-handler (npm) Affected packages: npm/express-session-handler Attributes: No fix available

Affected packages: MinimOS/openjdk-9、MinimOS/openjdk-9-default-jdk、MinimOS/openjdk-9-default-jvm、MinimOS/openjdk-9-demos、MinimOS/openjdk-9-doc、... 3 more Attributes: No fix available

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149) Affected packages: Packagist/winter/wn-system-module Attributes: Fix available、Severity - 8.4 (High)

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs Affected packages: Go/github.com/fleetdm/fleet/v4 Attributes: Fix available、Severity - 5.3 (Medium)

Malicious code in @next-fonts/font (npm) Affected packages: npm/@next-fonts/font Attributes: No fix available

Malicious code in mcq-session (npm) Affected packages: npm/mcq-session Attributes: No fix available

HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit Affected packages: Hex/bandit、github.com/mtrudel/bandit Attributes: Fix available、Severity - 8.7 (High)

HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit Affected packages: Hex/bandit、github.com/mtrudel/bandit Attributes: Fix available、Severity - 6.9 (Medium)

Malicious code in tailwind-animate-css-plugin (npm) Affected packages: npm/tailwind-animate-css-plugin Attributes: No fix available

Winter: Local File Inclusion through =include directives in JavaScript asset compilation Affected packages: Packagist/winter/wn-system-module Attributes: Fix available、Severity - 4.9 (Medium)

netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding Affected packages: Maven/io.netty.incubator:netty-incubator-codec-bhttp Attributes: Fix available、Severity - 7.5 (High)

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) Affected packages: Go/github.com/axllent/mailpit Attributes: Fix available、Severity - 6.5 (Medium)

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement Affected packages: Go/github.com/axllent/mailpit Attributes: Fix available、Severity - 5.3 (Medium)