OSV.dev · 实时热榜

Cross-Site Request Forgery (CSRF) in GitLab Affected packages: Bitnami/gitlab Attributes: Fix available、Severity - 7.1 (High)

TuxCare security update for io.projectreactor.netty (2 CVEs) Affected packages: TuxCare:Maven/io.projectreactor.netty:reactor-netty、TuxCare:Maven/io.projectreactor.netty:reactor-netty-core、TuxCare:Maven/io.projectreactor.netty:reactor-netty-http、TuxCare:Maven/io.projectreactor.netty:reactor-netty-http-brave Attributes: Fix available

Affected packages: Echo/libsoup3 Attributes: No fix available

Affected packages: Echo/graphicsmagick Attributes: No fix available

HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit Affected packages: Hex/bandit、github.com/mtrudel/bandit Attributes: Fix available、Severity - 6.9 (Medium)

Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation Affected packages: Packagist/backpack/crud Attributes: Fix available、Severity - 6.5 (Medium)

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure Affected packages: PyPI/langgraph-checkpoint-mongodb、PyPI/langgraph-store-mongodb Attributes: Fix available、Severity - 7.7 (High)

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) Affected packages: Go/github.com/axllent/mailpit Attributes: Fix available、Severity - 6.5 (Medium)

asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter Affected packages: PyPI/asteval Attributes: Fix available、Severity - 5.5 (Medium)

gettext-converter: Prototype pollution in js2i18next() via crafted translation keys Affected packages: npm/gettext-converter Attributes: Fix available、Severity - 6.9 (Medium)

Wagtail: Improper restriction handling on Page translation API endpoint Affected packages: PyPI/wagtail Attributes: Fix available、Severity - 6.5 (Medium)

Malicious code in create-react-app-text (npm) Affected packages: npm/create-react-app-text Attributes: No fix available

Malicious code in exam-kit (npm) Affected packages: npm/exam-kit Attributes: No fix available

Malicious code in reqcrypts (PyPI) Affected packages: PyPI/reqcrypts Attributes: No fix available

Malicious code in coin-fees (npm) Affected packages: npm/coin-fees Attributes: No fix available

Malicious code in chai-as-soul (npm) Affected packages: npm/chai-as-soul Attributes: No fix available

Malicious code in express-session-handler (npm) Affected packages: npm/express-session-handler Attributes: No fix available

Malicious code in @next-fonts/font (npm) Affected packages: npm/@next-fonts/font Attributes: No fix available

Affected packages: MinimOS/elasticsearch-fips-9.5 Attributes: Fix available

Affected packages: MinimOS/jenkins-2.555、MinimOS/jenkins-2.555-advanced-compat、MinimOS/jenkins-2.555-compat、MinimOS/jenkins-2.555-entrypoint、MinimOS/jenkins-2.555-remoting Attributes: No fix available

Affected packages: MinimOS/prometheus-fips-2.53 Attributes: No fix available

Affected packages: MinimOS/copa-fips Attributes: Fix available

Affected packages: MinimOS/apache-activemq-6.1-fips、MinimOS/apache-activemq-6.1-fips-oci-entrypoint Attributes: No fix available

Important: php:8.2 security, bug fix, and enhancement update Affected packages: Rocky Linux:8/libzip、Rocky Linux:8/php-pear、Rocky Linux:8/php-pecl-apcu、Rocky Linux:8/php-pecl-rrd、Rocky Linux:8/php-pecl-xdebug3、... 1 more Attributes: Fix available、Severity - 7.4 (High)

Moderate: kbd security update Affected packages: Rocky Linux:9/kbd Attributes: Fix available、Severity - 7.8 (High)

CVE-2026-67214 in nanoid - Patched by Root Affected packages: Root:npm/@rootio/nanoid、Root:npm/nanoid Attributes: Fix available

CVE-2023-34152 in imagemagick - Patched by Root Affected packages: Root:Debian:11/imagemagick、Root:Debian:11/rootio-imagemagick Attributes: Fix available、Severity - 9.8 (Critical)

Affected packages: Ubuntu:22.04:LTS/openssl、Ubuntu:24.04:LTS/edk2、Ubuntu:24.04:LTS/openssl、Ubuntu:26.04:LTS/edk2、Ubuntu:26.04:LTS/openssl、... 7 more Attributes: No fix available

Discourse: Shared-draft titles and excerpts leak through group post serialization Affected packages: Bitnami/discourse Attributes: Fix available、Severity - 4.3 (Medium)

Improper Control of Generation of Code ('Code Injection') in GitLab Affected packages: Bitnami/gitlab Attributes: Fix available、Severity - 9.4 (Critical)

Round-trip Corruption via Improper Entity Escaping in xml_builder Affected packages: Hex/xml_builder、github.com/joshnuss/xml_builder Attributes: Fix available、Severity - 2.1 (Low)

HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit Affected packages: Hex/bandit、github.com/mtrudel/bandit Attributes: Fix available、Severity - 8.7 (High)

Wagtail: Improper restriction handling on Pages admin API Affected packages: PyPI/wagtail Attributes: Fix available、Severity - 4.3 (Medium)

vouch-proxy has an Unbounded Multipart Cookie Allocation DoS Affected packages: Go/github.com/vouch/vouch-proxy Attributes: Fix available、Severity - 7.5 (High)

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement Affected packages: Go/github.com/axllent/mailpit Attributes: Fix available、Severity - 5.3 (Medium)

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import Affected packages: Go/github.com/dgraph-io/dgraph/v25 Attributes: Fix available、Severity - 9.1 (Critical)

Wagtail: Improper permission handling when copying snippets Affected packages: PyPI/wagtail Attributes: Fix available、Severity - 6.5 (Medium)

Malicious code in create-react-app-ui (npm) Affected packages: npm/create-react-app-ui Attributes: No fix available

Malicious code in @pablo_clueless/printr (npm) Affected packages: npm/@pablo_clueless/printr Attributes: No fix available

Malicious code in @js-lib-team/env-parser (npm) Affected packages: npm/@js-lib-team/env-parser Attributes: No fix available

Malicious code in mcq-session (npm) Affected packages: npm/mcq-session Attributes: No fix available

Malicious code in boto4 (PyPI) Affected packages: PyPI/boto4 Attributes: No fix available

Malicious code in requests-crypt (PyPI) Affected packages: PyPI/requests-crypt Attributes: No fix available

Malicious code in tailwind-animate-css-plugin (npm) Affected packages: npm/tailwind-animate-css-plugin Attributes: No fix available

Affected packages: MinimOS/crossplane、MinimOS/crossplane-crank Attributes: No fix available

Affected packages: MinimOS/elastic-otel-collector-9.5 Attributes: Fix available

Affected packages: MinimOS/cluster-api-aws-controller Attributes: No fix available

Affected packages: MinimOS/prometheus-fips-2.53 Attributes: No fix available

Affected packages: MinimOS/cloudbeat-9.4 Attributes: Fix available

Affected packages: MinimOS/eks-kube-apiserver-1.31、MinimOS/eks-kube-controller-manager-1.31、MinimOS/eks-kube-proxy-1.31、MinimOS/eks-kube-scheduler-1.31、MinimOS/eks-kubelet-1.31 Attributes: No fix available