OSV.dev · 实时热榜

Affected packages: Debian:11/nltk、Debian:12/nltk、Debian:13/nltk、Debian:14/nltk Attributes: No fix available

Affected packages: Debian:11/rsync、Debian:12/rsync、Debian:13/rsync、Debian:14/rsync Attributes: No fix available

Affected packages: Echo:PyPi/h2 Attributes: Fix available

Affected packages: Echo/rsync Attributes: No fix available

Affected packages: Echo/qemu Attributes: No fix available

Filter expression injection via forged keyset pagination cursor in Ash Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 7.5 (High)

MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install` Affected packages: PyPI/stata-mcp Attributes: Fix available、Severity - 8.4 (High)

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv) Affected packages: PyPI/ansible-jailexec Attributes: Fix available、Severity - 7.3 (High)

ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header Affected packages: npm/ep_etherpad-lite Attributes: Fix available、Severity - 6.1 (Medium)

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS) Affected packages: NuGet/SIPSorcery Attributes: Fix available、Severity - 7.5 (High)

atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read Affected packages: PyPI/atomic-agents-stack Attributes: Fix available、Severity - 8.2 (High)

ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token Affected packages: npm/ep_etherpad-lite Attributes: Fix available、Severity - 6.8 (Medium)

In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are... Affected packages: Julia/wxWidgets_jll Attributes: No fix available、Severity - 3.7 (Low)

Affected packages: Julia/opusfile_jll Attributes: No fix available、Severity - 7.8 (High)

A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function... Affected packages: Julia/OpenJpeg_jll Attributes: No fix available、Severity - 1.9 (Low)

Cap'n Proto and its Rust implementation vulnerable to out-of-bounds read due to logic error handling list-of-list Affected packages: Julia/capnproto_jll Attributes: No fix available、Severity - 5.4 (Medium)

Affected packages: Julia/cryptopp_jll Attributes: No fix available、Severity - 5.9 (Medium)

Affected packages: Julia/Graphviz_jll Attributes: Fix available、Severity - 7.8 (High)

Affected packages: Julia/ruby_jll Attributes: No fix available、Severity - 7.5 (High)

Affected packages: Julia/libconfuse_jll Attributes: No fix available、Severity - 8.8 (High)

Affected packages: Julia/Libcroco_jll Attributes: No fix available、Severity - 7.1 (High)

Malicious code in tailwind-form-templates (npm) Affected packages: npm/tailwind-form-templates Attributes: No fix available

Malicious code in svelte-kit-vim (npm) Affected packages: npm/svelte-kit-vim Attributes: No fix available

Malicious code in internallib_v756 (npm) Affected packages: npm/internallib_v756 Attributes: No fix available

Malicious code in ai-analyzer (npm) Affected packages: npm/ai-analyzer Attributes: No fix available

Affected packages: MinimOS/apisix-ingress-controller-fips Attributes: Fix available

Affected packages: MinimOS/elasticsearch-fips-9.3 Attributes: No fix available

Affected packages: MinimOS/podman Attributes: Fix available

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Affected packages: Red Hat:hummingbird:1/grafana13.1 Attributes: Fix available、Severity - 7.5 (High)

Moderate: resource-agents security update Affected packages: Rocky Linux:8/resource-agents Attributes: Fix available、Severity - 5.9 (Medium)

Moderate: dhcpcd security update Affected packages: Rocky Linux:10/dhcpcd Attributes: Fix available、Severity - 6.5 (Medium)

CVE-2013-7445 in linux - Patched by Root Affected packages: Root:Ubuntu:22.04/linux、Root:Ubuntu:22.04/rootio-linux Attributes: Fix available

Affected packages: Debian:11/nltk、Debian:12/nltk、Debian:13/nltk、Debian:14/nltk Attributes: No fix available

Affected packages: Debian:11/rsync、Debian:12/rsync、Debian:13/rsync、Debian:14/rsync Attributes: No fix available

Affected packages: Echo/rsync Attributes: No fix available

Affected packages: Echo:PyPi/redshift-connector Attributes: Fix available

ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite Affected packages: npm/ep_etherpad-lite Attributes: Fix available、Severity - 4.2 (Medium)

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name Affected packages: Packagist/pimcore/pimcore Attributes: Fix available、Severity - 8.5 (High)

compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0 Affected packages: PyPI/compliance-trestle Attributes: Fix available、Severity - 8.6 (High)

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials Affected packages: PyPI/pydantic-ai、PyPI/pydantic-ai-slim Attributes: Fix available、Severity - 6.8 (Medium)

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing Affected packages: NuGet/SIPSorcery Attributes: Fix available、Severity - 7.5 (High)

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access Affected packages: Go/github.com/seaweedfs/seaweedfs Attributes: Fix available、Severity - 7.8 (High)

GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file... Affected packages: Julia/Gzip_jll Attributes: No fix available、Severity - 2.0 (Low)

Affected packages: Julia/capnproto_jll Attributes: No fix available、Severity - 6.3 (Medium)

Affected packages: Julia/cryptopp_jll Attributes: No fix available、Severity - 7.5 (High)

Affected packages: Julia/Soup3_jll Attributes: No fix available、Severity - 7.5 (High)

Affected packages: Julia/ruby_jll Attributes: No fix available、Severity - 7.5 (High)

Affected packages: Julia/flex_jll Attributes: No fix available、Severity - 5.5 (Medium)

Malicious code in passkeys-react (npm) Affected packages: npm/passkeys-react Attributes: No fix available

Malicious code in sui-gql (npm) Affected packages: npm/sui-gql Attributes: No fix available