OSV.dev · 实时热榜

asyncssh has SCP Path Traversal to Arbitrary File Write Affected packages: PyPI/asyncssh Attributes: Fix available、Severity - 8.1 (High)

senaite.core Vulnerable to Eval Injection and Missing Authorization Affected packages: PyPI/senaite-core Attributes: No fix available、Severity - 9.8 (Critical)

cakephp/debug_kit: MailPreview contains unsafe reflection Affected packages: Packagist/cakephp/debug_kit Attributes: Fix available、Severity - 4.3 (Medium)

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution Affected packages: PyPI/asyncssh Attributes: Fix available、Severity - 5.9 (Medium)

Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root Affected packages: Go/github.com/cloudreve/Cloudreve/v3、Go/github.com/cloudreve/Cloudreve/v4 Attributes: Fix available、Severity - 7.1 (High)

SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed Affected packages: npm/suneditor Attributes: Fix available、Severity - 8.5 (High)

Affected packages: Debian:11/adminer、Debian:12/adminer、Debian:13/adminer、Debian:14/adminer Attributes: Fix available

Affected packages: Debian:11/adminer、Debian:12/adminer、Debian:13/adminer、Debian:14/adminer Attributes: Fix available

Affected packages: Debian:11/adminer、Debian:12/adminer、Debian:13/adminer、Debian:14/adminer Attributes: Fix available

Affected packages: Debian:11/adminer、Debian:12/adminer、Debian:13/adminer、Debian:14/adminer Attributes: Fix available

Affected packages: Debian:11/sqlite3、Debian:12/sqlite3、Debian:13/sqlite3、Debian:14/sqlite3 Attributes: No fix available

Affected packages: Debian:11/ruby-doorkeeper-openid-connect、Debian:12/ruby-doorkeeper-openid-connect、Debian:13/ruby-doorkeeper-openid-connect、Debian:14/ruby-doorkeeper-openid-connect Attributes: Fix available

Affected packages: Debian:11/tiff、Debian:12/tiff、Debian:13/tiff、Debian:14/tiff Attributes: Fix available

Affected packages: Debian:13/oras、Debian:14/oras Attributes: Fix available

Affected packages: Debian:11/adminer、Debian:12/adminer、Debian:13/adminer、Debian:14/adminer Attributes: Fix available

Affected packages: Debian:11/wget、Debian:12/wget、Debian:13/wget、Debian:14/wget Attributes: No fix available

Affected packages: Bitnami/jre Attributes: No fix available、Severity - 7.5 (High)

Affected packages: Bitnami/jre Attributes: Fix available、Severity - 5.3 (Medium)

Affected packages: Bitnami/java Attributes: No fix available、Severity - 7.5 (High)

Affected packages: Bitnami/java Attributes: Fix available、Severity - 5.3 (Medium)

Affected packages: Bitnami/java-min Attributes: Fix available、Severity - 3.7 (Low)

Affected packages: Bitnami/java-min Attributes: Fix available、Severity - 6.8 (Medium)

Affected packages: Bitnami/java-min Attributes: No fix available、Severity - 7.5 (High)

Affected packages: Bitnami/java-min Attributes: Fix available、Severity - 5.3 (Medium)

Affected packages: Bitnami/jre Attributes: Fix available、Severity - 3.7 (Low)

Affected packages: Bitnami/jre Attributes: Fix available、Severity - 6.8 (Medium)

LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates Affected packages: Packagist/librenms/librenms Attributes: Fix available、Severity - 7.1 (High)

OpenSTAManager has HTML Injection in modules/utenti/edit.php Affected packages: Packagist/devcode-it/openstamanager Attributes: Fix available、Severity - 3.5 (Low)

Malicious code in svelte-vli-ui (npm) Affected packages: npm/svelte-vli-ui Attributes: No fix available

Important: gstreamer1-plugins-good security update Affected packages: Rocky Linux:10/gstreamer1-plugins-good Attributes: Fix available、Severity - 8.8 (High)

Moderate: polkit security update Affected packages: Rocky Linux:10/polkit Attributes: Fix available、Severity - 5.5 (Medium)

Important: go-toolset:rhel8 security, bug fix, and enhancement update Affected packages: Rocky Linux:8/delve Attributes: Fix available、Severity - 8.1 (High)