OSV.dev · 实时热榜

shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs Affected packages: Bitnami/python-min Attributes: Fix available、Severity - 6.0 (Medium)

TuxCare security update for log4j:log4j (1 CVE) Affected packages: TuxCare:Maven/log4j:log4j Attributes: Fix available

Affected packages: Debian:11/libnet-oauth-perl、Debian:12/libnet-oauth-perl、Debian:13/libnet-oauth-perl、Debian:14/libnet-oauth-perl Attributes: No fix available

Affected packages: Debian:12/swtpm、Debian:13/swtpm、Debian:14/swtpm Attributes: No fix available

MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads Affected packages: PyPI/mobsf Attributes: Fix available、Severity - 5.5 (Medium)

devpi-server may leak database contents Affected packages: PyPI/devpi-server Attributes: Fix available、Severity - 6.5 (Medium)

resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read Affected packages: PyPI/resdata Attributes: Fix available、Severity - 9.8 (Critical)

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it Affected packages: PyPI/lemur Attributes: Fix available、Severity - 7.3 (High)

linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE) Affected packages: PyPI/linuxfabrik-lib Attributes: Fix available、Severity - 5.5 (Medium)

MagicMirror: ssrf calendar .js Affected packages: npm/magicmirror Attributes: Fix available、Severity - 6.3 (Medium)

MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files Affected packages: PyPI/monai Attributes: Fix available、Severity - 7.8 (High)

Copyparty vulnerable to file/dirkey confusion Affected packages: PyPI/copyparty Attributes: Fix available、Severity - 4.3 (Medium)

Multiple denial of service vulnerabilities in rsc.io/pdf and forks Affected packages: Go/github.com/dslipak/pdf、Go/github.com/ledongthuc/pdf、Go/rsc.io/pdf Attributes: No fix available

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to... Affected packages: Julia/Bison_jll Attributes: No fix available、Severity - 6.8 (Medium)

Malicious code in @mohamed_nowisar/token3-check (npm) Affected packages: npm/@mohamed_nowisar/token3-check Attributes: No fix available

Malicious code in ts-rand-sdk (npm) Affected packages: npm/ts-rand-sdk Attributes: No fix available

Malicious code in chai-as-gateway (npm) Affected packages: npm/chai-as-gateway Attributes: No fix available

Malicious code in sui-gql-rpc (npm) Affected packages: npm/sui-gql-rpc Attributes: No fix available

Malicious code in ai-texts (npm) Affected packages: npm/ai-texts Attributes: No fix available

Malicious code in gaarf-node-bq (npm) Affected packages: npm/gaarf-node-bq Attributes: No fix available

Malicious code in nice-utils-helper (npm) Affected packages: npm/nice-utils-helper Attributes: No fix available

Malicious code in modsync (npm) Affected packages: npm/modsync Attributes: No fix available

Malicious code in postcss-initialize-provider (npm) Affected packages: npm/postcss-initialize-provider Attributes: No fix available

Malicious code in karma-proxy (npm) Affected packages: npm/karma-proxy Attributes: No fix available

Malicious code in nodealpha (npm) Affected packages: npm/nodealpha Attributes: No fix available

Malicious code in layer2-sdk (npm) Affected packages: npm/layer2-sdk Attributes: No fix available

Malicious code in anhn-cli (npm) Affected packages: npm/anhn-cli Attributes: No fix available

Malicious code in emoji-prints-fancy (npm) Affected packages: npm/emoji-prints-fancy Attributes: No fix available

Affected packages: MinimOS/vertical-pod-autoscaler、MinimOS/vertical-pod-autoscaler-recommender、MinimOS/vertical-pod-autoscaler-updater Attributes: Fix available

Affected packages: MinimOS/n8n Attributes: Fix available

Affected packages: MinimOS/kube-apiserver-1.34、MinimOS/kube-controller-manager-1.34、MinimOS/kube-proxy-1.34、MinimOS/kube-scheduler-1.34、MinimOS/kubectl-1.34、... 1 more Attributes: Fix available

Affected packages: MinimOS/argocd-image-updater-fips-1 Attributes: No fix available

Affected packages: MinimOS/cert-manager-1.17、MinimOS/cert-manager-controller-1.17 Attributes: No fix available

Affected packages: MinimOS/gitlab-container-registry-fips-18.9、MinimOS/gitlab-logger-fips-18.9、MinimOS/gitlab-shell-fips-18.9 Attributes: No fix available

Affected packages: MinimOS/argo-workflow-controller-4.0 Attributes: Fix available

Affected packages: MinimOS/temporal-cassandra-tool-1.29、MinimOS/temporal-server-1.29 Attributes: Fix available

Affected packages: MinimOS/temporal-cassandra-tool-1.30、MinimOS/temporal-server-1.30、MinimOS/temporal-sql-tool-1.30 Attributes: Fix available

Affected packages: MinimOS/istio-cni-1.30、MinimOS/istio-install-cni-1.30、MinimOS/istio-pilot-agent-1.30、MinimOS/istio-pilot-discovery-1.30、MinimOS/istioctl-1.30 Attributes: Fix available

Affected packages: MinimOS/podman Attributes: Fix available

Affected packages: MinimOS/cluster-autoscaler-1.36 Attributes: Fix available

Affected packages: MinimOS/ollama Attributes: Fix available

Affected packages: MinimOS/delve Attributes: No fix available

Affected packages: MinimOS/gitlab-shell-19.1 Attributes: Fix available

Affected packages: MinimOS/prometheus-redis-exporter Attributes: Fix available

Affected packages: MinimOS/kube-apiserver-1.35、MinimOS/kube-controller-manager-1.35、MinimOS/kube-proxy-1.35、MinimOS/kube-scheduler-1.35、MinimOS/kubectl-1.35 Attributes: Fix available

Affected packages: MinimOS/keda-2.19、MinimOS/keda-2.19-admission-webhooks、MinimOS/keda-2.19-metrics-apiserver Attributes: Fix available

Affected packages: MinimOS/tdbg-1.31、MinimOS/temporal-cassandra-tool-1.31、MinimOS/temporal-server-1.31、MinimOS/temporal-sql-tool-1.31 Attributes: Fix available

Affected packages: MinimOS/etcd-fips-3.4 Attributes: No fix available

Affected packages: MinimOS/cert-manager-1.18、MinimOS/cert-manager-controller-1.18 Attributes: Fix available

Affected packages: MinimOS/kyverno-1.17、MinimOS/kyverno-background-controller-1.17、MinimOS/kyverno-cleanup-controller-1.17、MinimOS/kyverno-cli-1.17、MinimOS/kyverno-init-container-1.17、... 1 more Attributes: Fix available