CVE-2025-2099

A vulnerability in the preprocessstring function of the transformers.testingutils module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service ReDoS attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leadin...

CVE-2025-2099

creationtimestamp| type| source ---|---|--- 2025-05-19 11:44:21+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpjin4nwpvv2 2025-05-19 13:12:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpjnlrnrqb24...

CVE-2025-2099

CVE-2025-2099 describes a ReDoS in huggingface/transformers v4.48.3 due to a nested-quantifier regex in preprocess_string() within transformers.testing_utils. The issue causes exponential backtracking on input with many newlines, leading to high CPU usage and potential DoS. Connected documents co...

CVE-2025-4928

creationtimestamp| type| source ---|---|--- 2025-05-19 10:38:11+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16837 2025-05-19 13:13:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpjnnk5clr2t...

CVE-2025-4925

creationtimestamp| type| source ---|---|--- 2025-05-19 09:38:24+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16835 2025-05-19 13:13:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpjnnkb4pp2s...

CVE-2025-4915

creationtimestamp| type| source ---|---|--- 2025-05-19 09:13:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpja7zikpm2h...

CVE-2025-37891

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: Fix buffer overflow at UMP SysEx message conversion The conversion function from MIDI 1.0 to UMP packet contains an internal buffer to keep the incoming MIDI bytes, and its size is 4, as it was supposed to be the max...

CVE-2025-47752

creationtimestamp| type| source ---|---|--- 2025-05-19 08:38:28+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16828 2025-05-19 09:13:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpja7z6ayf2s...

CVE-2025-47757

V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6MemInIF.dll!setplctypedefault function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution...

CVE-2025-47757

V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6MemInIF.dll!setplctypedefault function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution...

CVE-2025-47752

V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6ComFile!MakeItemGlidZahyou function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution...

CVE-2025-47749

V-SFT v6.2.5.0 and earlier contains an issue with free of pointer not at start of buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution...

CVE-2025-4916 PHPGurukul Auto Taxi Stand Management System admin-profile.php sql injection

A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/admin-profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack may be initiated remotely...

CVE-2025-1627

Affected software: Qi Blocks WordPress plugin (versions prior to 1.4). Issue: The plugin does not validate and escape certain block options before output in a page/post where the ToC block is embedded, enabling Stored XSS for users with the contributor role and above. Impact (as stated): Stored C...

CVE-2025-4911

The CVE-2025-4911 entry concerns PHPGurukul Zoo Management System 2.1, where the vulnerable component is the file /admin/view-foreigner-ticket.php. Multiple connected sources confirm that manipulation of the viewid parameter enables SQL injection, with remote exploitation possible and public disc...

CVE-2025-31221

creationtimestamp| type| source ---|---|--- 2025-05-19 03:23:01+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3lpimn42o5k2k 2026-04-02 22:17:09+00:00| seen| Telegram/B6vWUmFTVCX1yfhELfHqaTN2Gx6ui5cUH0-W9-255yNy0M...

CVE-2025-23122

Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23165...

CVE-2025-23166

The C++ method SignTraits::DeriveBits may incorrectly call ThrowException based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary...

CVE-2025-4906 PHPGurukul Notice Board System login.php sql injection

A vulnerability was found in PHPGurukul Notice Board System 1.0. It has been classified as critical. Affected is an unknown function of the file /login.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclos...

CVE-2025-23166

The C++ method SignTraits::DeriveBits may incorrectly call ThrowException based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary...