OSV.dev · 实时热榜

Affected packages: Chainguard/gitlab-rails-ce-assets-fips-19.0、Chainguard/gitlab-rails-ce-doc-fips-19.0、Chainguard/gitlab-rails-ce-fips-19.0 Attributes: Fix available

Affected packages: Debian:11/tar、Debian:12/tar、Debian:13/tar、Debian:14/tar Attributes: No fix available

Affected packages: Debian:11/linux、Debian:12/linux、Debian:13/linux、Debian:14/linux Attributes: No fix available

Affected packages: Echo/tar Attributes: No fix available

ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks Affected packages: npm/ip-address Attributes: Fix available、Severity - 6.9 (Medium)

Socket.IO: Zero-attachment Memory Exhaustion Affected packages: npm/socket.io-parser Attributes: Fix available、Severity - 7.5 (High)

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read Affected packages: PyPI/gitpython Attributes: Fix available、Severity - 8.1 (High)

Hono: ReDoS in CORS middleware via Access-Control-Request-Headers Affected packages: npm/hono Attributes: Fix available、Severity - 5.3 (Medium)

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) Affected packages: PyPI/aiohttp Attributes: Fix available、Severity - 7.1 (High)

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when ` from ` is unset Affected packages: npm/postcss Attributes: Fix available、Severity - 6.3 (Medium)

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning Affected packages: npm/@angular/common Attributes: Fix available、Severity - 8.8 (High)

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes Affected packages: npm/@angular/compiler、npm/@angular/core Attributes: Fix available、Severity - 7.6 (High)

python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees Affected packages: PyPI/cryptography Attributes: Fix available、Severity - 6.9 (Medium)

Russh: Channel-scoped server callbacks can be reached without an open channel Affected packages: crates.io/russh Attributes: Fix available、Severity - 6.5 (Medium)

undici vulnerable to CRLF Injection via blob-like body 'type' property Affected packages: npm/undici Attributes: Fix available、Severity - 4.2 (Medium)

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate Affected packages: PyPI/aiohttp Attributes: Fix available、Severity - 6.9 (Medium)

Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration Affected packages: npm/flowise Attributes: Fix available、Severity - 8.5 (High)

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation Affected packages: npm/brace-expansion Attributes: Fix available、Severity - 7.5 (High)

Guzzle: Noncanonical host can bypass host-based checks Affected packages: Packagist/guzzlehttp/guzzle Attributes: Fix available、Severity - 7.2 (High)

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified Affected packages: npm/flowise、npm/flowise-components Attributes: Fix available、Severity - 9.2 (Critical)

Flowise: Missing authorization on ` /api/v1/files ` allows low-privileged API keys to list and delete files across workspaces within the same organization Affected packages: npm/flowise Attributes: Fix available、Severity - 7.2 (High)

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a... Affected packages: Julia/nghttp2_jll Attributes: Fix available、Severity - 6.3 (Medium)

Affected packages: Julia/HDF5_jll Attributes: Fix available、Severity - 5.9 (Medium)

Malicious code in @zzzgenesis00/bip39-generator (npm) Affected packages: npm/@zzzgenesis00/bip39-generator Attributes: No fix available

Malicious code in exnesss (npm) Affected packages: npm/exnesss Attributes: No fix available

Updated corosync and libqb packages fix security vulnerabilities Affected packages: Mageia:10/corosync、Mageia:10/libqb、Mageia:9/corosync、Mageia:9/libqb Attributes: Fix available

Affected packages: MinimOS/ko-fips Attributes: Fix available

Affected packages: MinimOS/apache-iceberg-sink-connector Attributes: No fix available

Affected packages: MinimOS/uptime-kuma-2.5 Attributes: No fix available

Affected packages: MinimOS/gitlab-rails-19.1 Attributes: No fix available

Affected packages: MinimOS/tw Attributes: No fix available

Affected packages: MinimOS/calico-whisker-3.32 Attributes: Fix available

Affected packages: MinimOS/k3s-fips-1.34 Attributes: No fix available

Affected packages: MinimOS/gitlab-rails-19.1 Attributes: Fix available

Affected packages: MinimOS/tailscale-fips Attributes: Fix available

Affected packages: MinimOS/k3s-1.34 Attributes: Fix available

Affected packages: MinimOS/linkerd2-cli-fips Attributes: No fix available

Affected packages: MinimOS/docker-scout-1.23 Attributes: No fix available

Affected packages: MinimOS/rancher-agent-fips-2.12 Attributes: No fix available

Affected packages: MinimOS/k3s-1.35 Attributes: Fix available

Affected packages: MinimOS/gitlab-elasticsearch-indexer、MinimOS/gitlab-elasticsearch-indexer-compat Attributes: Fix available

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Affected packages: Red Hat:enterprise_linux:8::nfv/kernel-rt、Red Hat:enterprise_linux:8::nfv/kernel-rt-core、Red Hat:enterprise_linux:8::nfv/kernel-rt-debug、Red Hat:enterprise_linux:8::nfv/kernel-rt-debug-core、Red Hat:enterprise_linux:8::nfv/kernel-rt-debug-debuginfo、... 23 more Attributes: Fix available、Severity - 5.8 (Medium)

Red Hat Security Advisory: systemd security, bug fix, and enhancement update Affected packages: Red Hat:rhel_eus:9.6::appstream/systemd-boot-unsigned、Red Hat:rhel_eus:9.6::appstream/systemd-boot-unsigned-debuginfo、Red Hat:rhel_eus:9.6::appstream/systemd-container-debuginfo、Red Hat:rhel_eus:9.6::appstream/systemd-debuginfo、Red Hat:rhel_eus:9.6::appstream/systemd-debugsource、... 32 more Attributes: Fix available、Severity - 7.8 (High)

Moderate: unbound security and bug fix update Affected packages: Rocky Linux:8/unbound Attributes: Fix available、Severity - 7.5 (High)

Important: gstreamer1-plugins-good security update Affected packages: Rocky Linux:10/gstreamer1-plugins-good Attributes: Fix available、Severity - 7.8 (High)

Affected packages: Chainguard/gitlab-rails-ce-assets-fips-19.0、Chainguard/gitlab-rails-ce-doc-fips-19.0、Chainguard/gitlab-rails-ce-fips-19.0 Attributes: Fix available

Affected packages: Debian:11/tar、Debian:12/tar、Debian:13/tar、Debian:14/tar Attributes: No fix available

Affected packages: Debian:11/linux、Debian:12/linux、Debian:13/linux、Debian:14/linux Attributes: No fix available

Affected packages: Echo/tar Attributes: No fix available

Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint Affected packages: npm/flowise Attributes: Fix available、Severity - 6.0 (Medium)