7558 matches found
CVE-2025-12044
Vault and Vault Enterprise “Vault” are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for +HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393...
CVE-2025-12044 Vault Vulnerable to Denial of Service Due to Rate Limit Regression
Vault and Vault Enterprise “Vault” are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for +HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393...
CVE-2025-12044
CVE-2025-12044: Vault and Vault Enterprise are vulnerable to unauthenticated DoS when processing JSON due to a rate-limit regression from HCSEC-2025-24. Affected: Vault Community 1.20.3–1.20.4; Vault Enterprise 1.16.25–1.16.26, 1.19.9–1.19.10, 1.18.14–1.18.15. Fixed in Vault Community 1.21.0 and ...
CVE-2025-12044 Vault Vulnerable to Denial of Service Due to Rate Limit Regression
Vault and Vault Enterprise “Vault” are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for +HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393...
Vault Vulnerable to Denial of Service Due to Rate Limit Regression
Summary Vault and Vault Enterprise “Vault” are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for HCSEC-2025-24 which allowed for processing JSON payloads before applying rate limits. This vulnerability,...
Risk Psychology and Cyber-Attack Tactics
We examine whether measured cognitive processes predict cyber-attack behavior. We analyzed data that included psychometric scale responses and labeled attack behaviors from cybersecurity professionals who conducted red-team operations against a simulated enterprise network. We employed multilevel...
EUVD-2025-35628
Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting XSS...
CVE-2025-62248
A reflected cross-site scripting XSS vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through...
openssl:x509: Heap-buffer-overflow in ossl_x509_check_cert_time
Project: https://github.com/openssl/openssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5880369384849408 Project: openssl Fuzzing Engine: libFuzzer Fuzz Target: x509 Job Type: libfuzzerasanopenssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 14 Crash Address: 0x7b72ac1e049d...
openSUSE 15 Security Update : libxslt (SUSE-SU-2025:03595-1)
The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:03595-1 advisory. - last fix caused a regression, patch was temporary disabled bsc1250553 Tenable has extracted the preceding description block directly from the SUSE securit...
arrow:arrow-csv-fuzz: Heap-use-after-free in arrow::Status arrow::csv::BlockParserImpl::ParseSpecialized<arrow::csv::internal
Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=6261070185693184 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: arrow-csv-fuzz Job Type: libfuzzerasanarrow Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x79e5a3fef29...
Security update for libxslt
This update for libxslt fixes the following issues: last fix caused a regression, patch was temporary disabled bsc1250553 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command...
SUSE-SU-2025:03595-1 Security update for libxslt
This update for libxslt fixes the following issues: - last fix caused a regression, patch was temporary disabled bsc1250553...
libsass:data_context_fuzzer: Bad-cast to Sass::PreValue from Sass::SelectorList in Sass::Eval::operator
Detailed Report: https://oss-fuzz.com/testcase?key=6440571217707008 Project: libsass Fuzzing Engine: libFuzzer Fuzz Target: datacontextfuzzer Job Type: libfuzzerubsanlibsass Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5d0d2d7969f0 Crash State: Bad-cast to Sass::PreValue from...
Denial Of Service (DoS)
xgrammar is vulnerable to Denial Of Service DoS. The vulnerability is due to a regression in the Earley parser, which causes excessive processing time for valid grammar inputs, allowing an attacker to exploit this inefficiency to trigger denial of service through resource exhaustion...
imagemagick:encoder_dng_fuzzer: Index-out-of-bounds in LibRaw::ahd_interpolate_r_and_b_in_rgb_and_convert_to_cielab
Detailed Report: https://oss-fuzz.com/testcase?key=6103595348197376 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderdngfuzzer Job Type: libfuzzerubsanimagemagick Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...
Synapse's invalid device keys degrade federation functionality
Impact Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. Patches Patched in Synapse 1.138.3, 1.138.4,...
PYSEC-2025-268
Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the anyref or externref WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If...
Google's New AI Doesn't Just Find Vulnerabilities — It Rewrites Code to Patch Them
Google's DeepMind division on Monday announced an artificial intelligence AI-powered agent called CodeMender that automatically detects, patches, and rewrites vulnerable code to prevent future exploits. The efforts add to the company's ongoing efforts to improve AI-powered vulnerability discovery...