OSV.dev · 实时热榜

Allocation of Resources Without Limits or Throttling in GitLab Affected packages: Bitnami/gitlab Attributes: Fix available、Severity - 6.5 (Medium)

Keycloak-services: keycloak-services: client access-type policy condition bypass during client update Affected packages: Bitnami/keycloak Attributes: Fix available、Severity - 6.5 (Medium)

TuxCare security update for io.netty (28 CVEs) Affected packages: TuxCare:Maven/io.netty:netty-all、TuxCare:Maven/io.netty:netty-bom、TuxCare:Maven/io.netty:netty-buffer、TuxCare:Maven/io.netty:netty-codec、TuxCare:Maven/io.netty:netty-codec-dns、... 41 more Attributes: Fix available

Affected packages: Debian:11/flvmeta、Debian:12/flvmeta、Debian:13/flvmeta、Debian:14/flvmeta Attributes: No fix available

Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection Affected packages: Hex/ash_typescript、github.com/ash-project/ash_typescript Attributes: Fix available、Severity - 2.3 (Low)

Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 2.1 (Low)

ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 5.9 (Medium)

Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 5.9 (Medium)

Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 5.9 (Medium)

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking Affected packages: npm/@hono/oauth-providers Attributes: Fix available、Severity - 5.4 (Medium)

Socket.IO: Engine.IO WebTransport SID DoS Affected packages: npm/engine.io Attributes: Fix available、Severity - 7.5 (High)

TYPO3 CMS - Unrestricted File Upload in Form Framework Affected packages: Packagist/typo3/cms-form Attributes: Fix available、Severity - 6.3 (Medium)

MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS Affected packages: npm/mysql2 Attributes: Fix available

decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input Affected packages: npm/decode-uri-component Attributes: Fix available、Severity - 6.6 (Medium)

Malicious code in selfsigned-certificate (npm) Affected packages: npm/selfsigned-certificate Attributes: No fix available

Updated flatpak package fixes security vulnerabilities Affected packages: Mageia:10/flatpak Attributes: Fix available

Updated clamav packages fix security vulnerabilities Affected packages: Mageia:10/clamav Attributes: Fix available

Updated vim packages fix security vulnerabilities Affected packages: Mageia:10/vim、Mageia:9/vim Attributes: Fix available

Updated perl-HTML-FormHandler packages fix a security vulnerability Affected packages: Mageia:10/perl-HTML-FormHandler、Mageia:9/perl-HTML-FormHandler Attributes: Fix available

Affected packages: MinimOS/paketo-buildpacks-jam Attributes: Fix available

Affected packages: MinimOS/fluxcd-source-watcher-fips Attributes: Fix available

Affected packages: MinimOS/argo-workflow-controller-4.0 Attributes: Fix available

Affected packages: MinimOS/corretto-fips-config-8 Attributes: Fix available

Moderate: dbus-broker security update Affected packages: Rocky Linux:9/dbus-broker Attributes: Fix available、Severity - 5.5 (Medium)

Important: nodejs:22 security update Affected packages: Rocky Linux:9/nodejs-nodemon、Rocky Linux:9/nodejs-packaging Attributes: Fix available、Severity - 7.5 (High)

Access Control Check Implemented After Asset is Accessed in GitLab Affected packages: Bitnami/gitlab Attributes: Fix available、Severity - 3.5 (Low)

Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes Affected packages: Bitnami/keycloak Attributes: Fix available、Severity - 6.5 (Medium)

Affected packages: Debian:11/flvmeta、Debian:12/flvmeta、Debian:13/flvmeta、Debian:14/flvmeta Attributes: No fix available

Affected packages: Echo/ffmpeg Attributes: No fix available

Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter Affected packages: Hex/ash_typescript、github.com/ash-project/ash_typescript Attributes: Fix available、Severity - 8.7 (High)

Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 2.1 (Low)

Ash.Reactor change step fails open, skipping a change when its where guard raises Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 2.1 (Low)

Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 2.1 (Low)

Kirby: File upload permissions are not checked during processing of chunk data Affected packages: Packagist/getkirby/cms Attributes: Fix available、Severity - 7.1 (High)

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback Affected packages: Packagist/studio-42/elfinder Attributes: Fix available、Severity - 8.6 (High)

Malicious code in spc_login (npm) Affected packages: npm/spc_login Attributes: No fix available

Updated c-ares packages fix security vulnerabilities Affected packages: Mageia:10/c-ares Attributes: Fix available

Updated python-hpack packages fix a security vulnerability Affected packages: Mageia:10/python-hpack Attributes: Fix available

Updated perl-Mojolicious packages fix a security vulnerability Affected packages: Mageia:10/perl-Mojolicious、Mageia:9/perl-Mojolicious Attributes: Fix available

Updated perl-Date-Manip packages fix security vulnerabilities Affected packages: Mageia:10/perl-Date-Manip、Mageia:9/perl-Date-Manip Attributes: Fix available

Affected packages: MinimOS/fluxcd-kustomize-controller-fips Attributes: Fix available

Affected packages: MinimOS/paketo-buildpacks-jam Attributes: Fix available

Affected packages: MinimOS/argo-rollouts-gateway-api-router Attributes: Fix available

Important: nodejs:24 security update Affected packages: Rocky Linux:9/nodejs-nodemon、Rocky Linux:9/nodejs-packaging Attributes: Fix available、Severity - 7.5 (High)

Moderate: tar security, bug fix, and enhancement update Affected packages: Rocky Linux:9/tar Attributes: Fix available、Severity - 5.0 (Medium)

Authentication Bypass Using an Alternate Path or Channel in GitLab Affected packages: Bitnami/gitlab Attributes: Fix available、Severity - 5.5 (Medium)

Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation Affected packages: Bitnami/keycloak Attributes: Fix available、Severity - 7.2 (High)

TuxCare security update for org.apache.logging.log4j (6 CVEs) Affected packages: TuxCare:Maven/org.apache.logging.log4j:log4j、TuxCare:Maven/org.apache.logging.log4j:log4j-1.2-api、TuxCare:Maven/org.apache.logging.log4j:log4j-api、TuxCare:Maven/org.apache.logging.log4j:log4j-appserver、TuxCare:Maven/org.apache.logging.log4j:log4j-bom、... 18 more Attributes: Fix available

Route handler return value echoed into AshTypescript error response Affected packages: Hex/ash_typescript、github.com/ash-project/ash_typescript Attributes: Fix available、Severity - 6.3 (Medium)

Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service Affected packages: Hex/ash、github.com/ash-project/ash Attributes: Fix available、Severity - 5.9 (Medium)