OSV.dev · 实时热榜

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab Affected packages: Bitnami/gitlab Attributes: Fix available、Severity - 8.5 (High)

Affected packages: Chainguard/apache-pulsar-fips-4.0、Chainguard/druid、Wolfi/druid Attributes: Fix available

Affected packages: Debian:11/glibc、Debian:12/glibc、Debian:13/glibc、Debian:14/glibc Attributes: No fix available

Affected packages: Debian:13/linux、Debian:14/linux Attributes: Fix available

Affected packages: Debian:14/incus Attributes: Fix available

Affected packages: Echo/glibc Attributes: No fix available

Affected packages: Echo/glibc Attributes: No fix available

Affected packages: Echo/gdk-pixbuf Attributes: No fix available

Doggo vulnerable to cross-site scripting via unescaped date field values Affected packages: Hex/doggo、github.com/woylie/doggo Attributes: Fix available、Severity - 5.3 (Medium)

Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir Affected packages: github.com/elixir-lang/elixir Attributes: Fix available、Severity - 5.9 (Medium)

WebOb: Open redirect in Location header normalization via leading C0 control / space characters Affected packages: PyPI/webob Attributes: Fix available、Severity - 6.1 (Medium)

OpenSTAManager has HTML Injection in modules/utenti/edit.php Affected packages: Packagist/devcode-it/openstamanager Attributes: Fix available、Severity - 3.5 (Low)

silverstripe/userforms vulnerable to remote code execution via userforms email subject Affected packages: Packagist/silverstripe/userforms Attributes: Fix available、Severity - 8.8 (High)

Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check Affected packages: Go/github.com/crossplane/crossplane-runtime/v2 Attributes: Fix available、Severity - 8.2 (High)

n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter) Affected packages: npm/n8n-nodes-sqlite3 Attributes: Fix available、Severity - 6.1 (Medium)

aiosmtplib: STARTTLS response injection Affected packages: PyPI/aiosmtplib Attributes: Fix available、Severity - 5.9 (Medium)

Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/kyverno/kyverno Affected packages: Go/github.com/kyverno/kyverno Attributes: Fix available

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh Affected packages: Go/golang.org/x/crypto Attributes: Fix available

Malicious code in tailwindcss-3d-animate (npm) Affected packages: npm/tailwindcss-3d-animate Attributes: No fix available

Malicious code in pushgitquickx (npm) Affected packages: npm/pushgitquickx Attributes: No fix available

Malicious code in @fleetbo/svro (npm) Affected packages: npm/@fleetbo/svro Attributes: No fix available

Updated avahi packages fix security vulnerabilities Affected packages: Mageia:10/avahi、Mageia:9/avahi Attributes: Fix available

Affected packages: MinimOS/linstor-server-fips Attributes: Fix available

Affected packages: MinimOS/splunk-otel-collector-fips Attributes: Fix available

Affected packages: MinimOS/corretto-fips-config-8 Attributes: Fix available

Affected packages: MinimOS/apache-activemq-6.1-fips Attributes: No fix available

Red Hat Security Advisory: kernel security update Affected packages: Red Hat:rhel_aus:8.6::baseos/bpftool、Red Hat:rhel_aus:8.6::baseos/bpftool-debuginfo、Red Hat:rhel_aus:8.6::baseos/kernel、Red Hat:rhel_aus:8.6::baseos/kernel-abi-stablelists、Red Hat:rhel_aus:8.6::baseos/kernel-core、... 43 more Attributes: Fix available、Severity - 7.8 (High)

Moderate: libxml2 security update Affected packages: Rocky Linux:10/libxml2 Attributes: Fix available、Severity - 4.8 (Medium)

CVE-2023-44270 in postcss - Patched by Root Affected packages: Root:npm/@rootio/postcss、Root:npm/postcss Attributes: Fix available

CVE-2023-45133 in babel-traverse - Patched by Root Affected packages: Root:npm/@babel/traverse、Root:npm/@rootio/babel-traverse、Root:npm/@rootio/babel__traverse、Root:npm/babel-traverse Attributes: Fix available

Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete Affected packages: Bitnami/tomcat Attributes: Fix available、Severity - 9.8 (Critical)

Affected packages: Debian:11/linux、Debian:12/linux、Debian:13/linux、Debian:14/linux Attributes: No fix available

Affected packages: Debian:14/incus Attributes: Fix available

libreoffice-convert vulnerable to path traversal / arbitrary file write Affected packages: npm/libreoffice-convert Attributes: Fix available、Severity - 6.5 (Medium)

Silverstripe Framework: Possible XSS attack through media embed Affected packages: Packagist/silverstripe/framework Attributes: Fix available、Severity - 5.4 (Medium)

cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions Affected packages: Packagist/cakephp/queue Attributes: Fix available、Severity - 3.7 (Low)

linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST request in github.com/andreimarcu/linx-server Affected packages: Go/github.com/andreimarcu/linx-server Attributes: No fix available

Malicious code in tailwindcss-form-styles (npm) Affected packages: npm/tailwindcss-form-styles Attributes: No fix available

Malicious code in @znan/wabot (npm) Affected packages: npm/@znan/wabot Attributes: No fix available

Updated python-django packages fix security vulnerabilities Affected packages: Mageia:10/python-django Attributes: Fix available

Affected packages: MinimOS/linstor-server-fips Attributes: Fix available

Affected packages: MinimOS/apache-activemq-6.1 Attributes: No fix available

Affected packages: MinimOS/splunk-otel-collector-fips Attributes: Fix available

Affected packages: MinimOS/corretto-fips-config-26 Attributes: Fix available

Red Hat Security Advisory: kernel security update Affected packages: Red Hat:rhel_eus:9.6::appstream/kernel-64k-debug-debuginfo、Red Hat:rhel_eus:9.6::appstream/kernel-64k-debug-devel、Red Hat:rhel_eus:9.6::appstream/kernel-64k-debug-devel-matched、Red Hat:rhel_eus:9.6::appstream/kernel-64k-debuginfo、Red Hat:rhel_eus:9.6::appstream/kernel-64k-devel、... 155 more Attributes: Fix available、Severity - 7.8 (High)

Important: gstreamer1-plugins-good security update Affected packages: Rocky Linux:10/gstreamer1-plugins-good Attributes: Fix available、Severity - 8.8 (High)

CVE-2026-41305 in postcss - Patched by Root Affected packages: Root:npm/@rootio/postcss、Root:npm/postcss Attributes: Fix available、Severity - 6.1 (Medium)

CVE-2026-59869 in js-yaml - Patched by Root Affected packages: Root:npm/@rootio/js-yaml、Root:npm/js-yaml Attributes: Fix available

Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths Affected packages: Bitnami/vault Attributes: Fix available、Severity - 6.8 (Medium)

TuxCare security update for org.springframework (1 CVE) Affected packages: TuxCare:Maven/org.springframework:spring、TuxCare:Maven/org.springframework:spring-aop、TuxCare:Maven/org.springframework:spring-aspects、TuxCare:Maven/org.springframework:spring-beans、TuxCare:Maven/org.springframework:spring-context、... 19 more Attributes: Fix available