OSV.dev · 实时热榜

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback Affected packages: Packagist/studio-42/elfinder Attributes: Fix available、Severity - 8.6 (High)

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking Affected packages: npm/@hono/oauth-providers Attributes: Fix available、Severity - 5.4 (Medium)

Affected packages: MinimOS/openclaw Attributes: Fix available

Affected packages: MinimOS/openclaw Attributes: Fix available

Affected packages: MinimOS/paketo-buildpacks-jam Attributes: Fix available

Affected packages: MinimOS/paketo-buildpacks-jam Attributes: Fix available

Affected packages: MinimOS/paketo-buildpacks-clojure-tools-2.17.12 Attributes: Fix available

Affected packages: MinimOS/paketo-buildpacks-apache-tomcat-8.10.4 Attributes: Fix available

Affected packages: MinimOS/openclaw Attributes: Fix available

Socket.IO: Engine.IO WebTransport SID DoS Affected packages: npm/engine.io Attributes: Fix available、Severity - 7.5 (High)

Affected packages: MinimOS/openclaw Attributes: Fix available

Affected packages: MinimOS/openclaw Attributes: Fix available

Kirby: File upload permissions are not checked during processing of chunk data Affected packages: Packagist/getkirby/cms Attributes: Fix available、Severity - 7.1 (High)

MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS Affected packages: npm/mysql2 Attributes: Fix available

decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input Affected packages: npm/decode-uri-component Attributes: Fix available、Severity - 6.6 (Medium)

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling Affected packages: Packagist/getkirby/cms Attributes: Fix available、Severity - 8.2 (High)

Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 2.1 (Low)

Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 5.9 (Medium)

Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 2.1 (Low)

Ash.Reactor change step fails open, skipping a change when its where guard raises Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 2.1 (Low)

ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 5.9 (Medium)

Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 5.9 (Medium)

Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 2.1 (Low)

Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 5.9 (Medium)

Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 2.1 (Low)

Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 5.9 (Medium)

Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 2.1 (Low)

Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 5.9 (Medium)

Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 5.9 (Medium)

Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 2.1 (Low)

Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 2.1 (Low)

Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 5.9 (Medium)

Malicious code in claude-channel-telegram (npm) Affected packages: npm/claude-channel-telegram Attributes: No fix available

Malicious code in nextjsupdater (npm) Affected packages: npm/nextjsupdater Attributes: No fix available

Important: nodejs:22 security update Affected packages: Rocky Linux:9/nodejs-nodemon、Rocky Linux:9/nodejs-packaging Attributes: Fix available、Severity - 7.5 (High)

Important: nodejs:24 security update Affected packages: Rocky Linux:9/nodejs-nodemon、Rocky Linux:9/nodejs-packaging Attributes: Fix available、Severity - 7.5 (High)

Important: xmlrpc-c security update Affected packages: Rocky Linux:9/xmlrpc-c Attributes: Fix available、Severity - 7.4 (High)

Moderate: dbus-broker security update Affected packages: Rocky Linux:9/dbus-broker Attributes: Fix available、Severity - 5.5 (Medium)

Important: freerdp security update Affected packages: Rocky Linux:9/freerdp Attributes: Fix available、Severity - 8.8 (High)

Important: iperf3 security update Affected packages: Rocky Linux:9/iperf3 Attributes: Fix available、Severity - 7.5 (High)

Moderate: tar security, bug fix, and enhancement update Affected packages: Rocky Linux:9/tar Attributes: Fix available、Severity - 5.0 (Medium)

Moderate: gzip security update Affected packages: Rocky Linux:9/gzip Attributes: Fix available、Severity - 6.0 (Medium)

Moderate: glib2 security update Affected packages: Rocky Linux:8/glib2 Attributes: Fix available、Severity - 7.3 (High)

Updated flatpak package fixes security vulnerabilities Affected packages: Mageia:10/flatpak Attributes: Fix available

Updated c-ares packages fix security vulnerabilities Affected packages: Mageia:10/c-ares Attributes: Fix available

Updated jbig2dec packages fix security vulnerabilities Affected packages: Mageia:10/jbig2dec、Mageia:9/jbig2dec Attributes: Fix available

Updated nspr, nss, & firefox packages fix security vulnerabilities Affected packages: Mageia:10/firefox、Mageia:10/firefox-l10n、Mageia:10/nspr、Mageia:10/nss、Mageia:9/firefox、... 3 more Attributes: Fix available

Updated thunderbird packages fix security vulnerabilities Affected packages: Mageia:10/thunderbird、Mageia:10/thunderbird-l10n、Mageia:9/thunderbird、Mageia:9/thunderbird-l10n Attributes: Fix available

Updated postgresql18 & postgresql15 packages fix security vulnerabilities Affected packages: Mageia:10/postgresql15、Mageia:10/postgresql18、Mageia:9/postgresql15 Attributes: Fix available

Affected packages: MinimOS/corretto-fips-config-11 Attributes: Fix available