OSV.dev · 实时热榜

Affected packages: Debian:11/qemu、Debian:12/qemu、Debian:13/qemu、Debian:14/qemu Attributes: Fix available

Affected packages: Echo/sudo Attributes: No fix available

Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc Affected packages: Hex/oidcc、github.com/erlef/oidcc Attributes: Fix available、Severity - 7.6 (High)

exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql Affected packages: Hex/ash_sql、github.com/ash-project/ash_sql Attributes: Fix available、Severity - 5.9 (Medium)

Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking Affected packages: Hex/ash_paper_trail、github.com/ash-project/ash_paper_trail Attributes: Fix available、Severity - 2.1 (Low)

JSON path injection via unescaped get_path segments in AshSqlite Affected packages: Hex/ash_sqlite、github.com/ash-project/ash_sqlite Attributes: Fix available、Severity - 2.1 (Low)

rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres Affected packages: Hex/ash_postgres、github.com/ash-project/ash_postgres Attributes: Fix available、Severity - 7.2 (High)

Same-named aggregates with differing filters are conflated in AshSql Affected packages: Hex/ash_sql、github.com/ash-project/ash_sql Attributes: Fix available、Severity - 2.1 (Low)

Malicious code in htps-provider (npm) Affected packages: npm/htps-provider Attributes: No fix available

Malicious code in grafeno-webhook (npm) Affected packages: npm/grafeno-webhook Attributes: No fix available

Malicious code in gclassroom (npm) Affected packages: npm/gclassroom Attributes: No fix available

Malicious code in auth-app-streamlit (PyPI) Affected packages: PyPI/auth-app-streamlit Attributes: No fix available

Updated python-nltk packages fix security vulnerabilities Affected packages: Mageia:10/python-nltk、Mageia:9/python-nltk Attributes: Fix available

Affected packages: MinimOS/kube-apiserver-fips-1.32、MinimOS/kube-controller-manager-fips-1.32、MinimOS/kube-proxy-fips-1.32、MinimOS/kube-scheduler-fips-1.32 Attributes: No fix available

Affected packages: MinimOS/minio Attributes: No fix available

Affected packages: MinimOS/coredns-fips-1.13、MinimOS/kuma-coredns-fips-1.13 Attributes: No fix available

Affected packages: MinimOS/weaviate-fips-1.36 Attributes: No fix available

Affected packages: MinimOS/redpanda-25.1-fips Attributes: No fix available

Affected packages: MinimOS/traefik-2 Attributes: No fix available

Affected packages: MinimOS/weaviate-fips-1.38 Attributes: Fix available

Affected packages: MinimOS/prometheus-node-exporter-fips-1.9 Attributes: No fix available

Affected packages: MinimOS/gitlab-docker-machine-fips-19.0、MinimOS/gitlab-runner-fips-19.0、MinimOS/gitlab-runner-helper-fips-19.0 Attributes: Fix available

Affected packages: MinimOS/paketo-buildpacks-liberty Attributes: No fix available

wireshark security update Affected packages: openEuler:24.03-LTS-SP1/wireshark Attributes: Fix available、Severity - 8.1 (High)

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Affected packages: Red Hat:hummingbird:1/grafana12.4 Attributes: Fix available、Severity - 9.1 (Critical)

Affected packages: Debian:11/qemu、Debian:12/qemu、Debian:13/qemu、Debian:14/qemu Attributes: Fix available

Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions Affected packages: Hex/ash_paper_trail、github.com/ash-project/ash_paper_trail Attributes: Fix available、Severity - 5.9 (Medium)

Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql Affected packages: Hex/ash_sql、github.com/ash-project/ash_sql Attributes: Fix available、Severity - 2.1 (Low)

Malicious code in manager-thedate (npm) Affected packages: npm/manager-thedate Attributes: No fix available

Malicious code in grafeno-billing (npm) Affected packages: npm/grafeno-billing Attributes: No fix available

Malicious code in opiumbest (npm) Affected packages: npm/opiumbest Attributes: No fix available

Malicious code in trongridor (PyPI) Affected packages: PyPI/trongridor Attributes: No fix available

Affected packages: MinimOS/loki-fips-3.5、MinimOS/loki-fips-3.5-canary、MinimOS/loki-fips-3.5-logcli、MinimOS/loki-fips-3.5-promtail Attributes: No fix available

Affected packages: MinimOS/eks-kube-apiserver-1.31、MinimOS/eks-kube-controller-manager-1.31、MinimOS/eks-kube-proxy-1.31、MinimOS/eks-kube-scheduler-1.31、MinimOS/eks-kubelet-1.31 Attributes: No fix available

Affected packages: MinimOS/sealed-secrets-kubeseal-fips Attributes: Fix available

Affected packages: MinimOS/gitlab-docker-machine-fips-18.8、MinimOS/gitlab-runner-fips-18.8、MinimOS/gitlab-runner-helper-fips-18.8 Attributes: No fix available

Affected packages: MinimOS/paketo-buildpacks-encrypt-at-rest Attributes: No fix available

Affected packages: MinimOS/weaviate-fips-1.35 Attributes: No fix available

Affected packages: MinimOS/verticadb-operator Attributes: Fix available

Affected packages: MinimOS/cluster-autoscaler-fips-1.32 Attributes: No fix available

Affected packages: MinimOS/terraform-fips-1.13 Attributes: No fix available

Affected packages: MinimOS/kubernetes-csi-external-snapshot-controller-fips-8.6、MinimOS/kubernetes-csi-external-snapshotter-fips-8.6 Attributes: No fix available

Affected packages: MinimOS/prometheus-node-exporter-1.9 Attributes: No fix available

python-aiohttp security update Affected packages: openEuler:24.03-LTS-SP1/python-aiohttp Attributes: Fix available、Severity - 6.3 (Medium)

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Affected packages: Red Hat:hummingbird:1/grafana13.2 Attributes: Fix available、Severity - 7.5 (High)

Affected packages: Debian:11/qemu、Debian:12/qemu、Debian:13/qemu、Debian:14/qemu Attributes: Fix available

Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail Affected packages: Hex/ash_paper_trail、github.com/ash-project/ash_paper_trail Attributes: Fix available、Severity - 5.9 (Medium)

Unescaped backslash allows LIKE wildcard injection in AshSql string search Affected packages: Hex/ash_sql、github.com/ash-project/ash_sql Attributes: Fix available、Severity - 2.1 (Low)

Malicious code in nuvyra-marketplace-sdk (npm) Affected packages: npm/nuvyra-marketplace-sdk Attributes: No fix available

Malicious code in grafeno-payments (npm) Affected packages: npm/grafeno-payments Attributes: No fix available