CVE-2025-43215

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may result in disclosure of process memory...

CVE-2025-43215

CVE-2025-43215 affects macOS Sequoia; the issue involves processing of malicious images that could disclose process memory. It is fixed in macOS Sequoia 15.6 via improved checks. Practical impact is memory disclosure when handling crafted images. Remediation: update to macOS Sequoia 15.6 or later...

CVE-2025-43277

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.8. Processing a maliciously crafted audio file may lead to memory corruption...

CVE-2025-54381

CVE-2025-54381 affects BentoML and its file-upload processing in versions 1.4.0–1.4.19. The vulnerability arises in the multipart form data and JSON request handlers, which download user-provided URLs without validating whether they point to internal networks, cloud metadata endpoints, or other r...

CVE-2025-54381 BentoML is Vulnerable to an SSRF Attack Through File Upload Processing

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP...

RLSA-2025:8676 Moderate: libxslt security update

libxslt is a library for transforming XML files into other textual formats including HTML, plain text, and other XML representations of the underlying data using the standard XSLT stylesheet transformation mechanism. Security Fixes: libxslt: Processing web content may disclose sensitive informati...

Invisible Injections: Exploiting Vision-Language Models through Steganographic Prompt Embedding

Vision-language models VLMs have revolutionized multimodal AI applications but introduce novel security vulnerabilities that remain largely unexplored. We present the first comprehensive study of steganographic prompt injection attacks against VLMs, where malicious instructions are invisibly...

The vulnerability of D-Link DI-7300G+ microprogrammed software lies in the lack of measures taken to neutralize special elements during the processing of the ASP file httpd_debug.asp, allowing attackers to execute arbitrary commands.

The vulnerability of D-Link DI-7300G+ router microprogramming software is related to the lack of measures taken to neutralize special elements during the processing of the asp-file httpddebug.asp. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to errors in processing the relative path to the directory, allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of JetBrains TeamCity is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the getdeleteddocuments.vm template in the XWiki platform, a collaborative web application. This allows attackers to execute arbitrary code.

The vulnerability of the getdeleteddocuments.vm template in the XWiki platform, a collaborative web application, arises from the lack of protection for the SQL query structure during the processing of the sort parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code...

BentoML 代码问题漏洞

BentoML is an open source modeling service library from BentoML Open Source. It is used to build high-performance and scalable artificial intelligence applications using Python. A code issue vulnerability exists in BentoML versions 1.4.0 through 1.4.19 that stems from the file upload processing...

PT-2025-31300

Name of the Vulnerable Software and Affected Versions Safari affected versions not specified watchOS versions prior to 11.6 iOS versions prior to 18.6 iPadOS versions prior to 18.6 iPadOS version 17.7.9 tvOS versions prior to 18.6 macOS versions prior to Sequoia 15.6 visionOS versions prior to 2....

SUSE CVE-2025-38354

In the Linux kernel, the following vulnerability has been resolved: drm/msm/gpu: Fix crash when throttling GPU immediately during boot There is a small chance that the GPU is already hot during boot. In that case, the call to ofdevfreqcoolingregister will immediately try to apply devfreq cooling,...

GO-2025-3780 OpenBao Inserts Sensitive Information into Log File when processing malformed data in github.com/openbao/openbao/sdk

OpenBao Inserts Sensitive Information into Log File when processing malformed data in github.com/openbao/openbao/sdk...

GO-2025-3811 File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing in github.com/filebrowser/filebrowser

File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing in github.com/filebrowser/filebrowser...

GO-2025-3787 May leak sensitive information in logs when processing malformed data in github.com/go-viper/mapstructure

May leak sensitive information in logs when processing malformed data in github.com/go-viper/mapstructure...

GHSA-9952-GV64-X94C CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

Impact This vulnerability affects applications that: Use the ImageMagick handler for image processing imagick as the image library AND either: Allow file uploads with user-controlled filenames and process uploaded images using the resize method OR use the text method with user-controlled text...

CVE-2025-54418

CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image processing imagick as the image library and either allow file uploads with user-controlled filenames and process...

D-Link DIR-513 formLanguageChange function buffer overflow vulnerability

D-Link DIR-513 is a portable wireless router that focuses on thin and light design and easy-to-use features, and supports IEEE 802.11n, 802.11g/b standards with a maximum transmission rate of 300Mbps. The D-Link DIR-513 suffers from a buffer overflow vulnerability that stems from improper handlin...

TOTOLINK X15 安全漏洞

TOTOLINK X15 is a network wireless extender manufactured by China's Gion Electronics TOTOLINK, mainly used to extend Wi-Fi coverage. The device supports Wi-Fi 6 technology and offers AX1500 wireless transmission rate for home and small office scenarios. A buffer overflow vulnerability exists in t...