CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

4127 matches found

Tenable Nessus•added 2025/10/07 12:00 a.m.•5 views

Unity Linux 20.1070e Security Update: libtiff (UTSA-2025-680607)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-680607 advisory. LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file. For...

5.5CVSS6.6AI score0.00573EPSS

SaveExploits1References4

Github Security Blog•added 2025/10/06 6:31 p.m.•27 views

LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing

The HTMLSectionSplitter class in langchain-text-splitters is vulnerable to XML External Entity XXE attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed using lxml.etree.parse and lxml.etree.XSLT without any...

7.5CVSS6.9AI score0.00508EPSS

SaveExploits0References5Affected Software1

NVD•added 2025/10/06 6:15 p.m.•27 views

CVE-2025-6985

The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity XXE attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed using lxml.etree.parse and lxml.etree.XSL...

7.5CVSS0.00508EPSS

SaveExploits0References1

Cvelist•added 2025/10/06 5:58 p.m.•31 views

CVE-2025-6985 XXE Vulnerability in langchain-ai/langchain

7.5CVSS0.00508EPSS

SaveExploits0References1

CVE•added 2025/10/06 5:58 p.m.•154 views

CVE-2025-6985

The CVE-2025-6985 entry concerns LangChain Text Splitters (langchain-text-splitters) v0.3.8, with an XML External Entity (XXE) risk due to unsafe XSLT parsing. The connected docs explain that arbitrary XSLT stylesheets are parsed using lxml.etree.parse() and lxml.etree.XSLT() without hardening, a...

7.5CVSS7.5AI score0.00508EPSS

SaveExploits0References1

RedhatCVE•added 2025/10/06 7:16 a.m.•16 views

CVE-2025-8669

The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11. This is due to missing or incorrect nonce validation on the resetcustomizesection function. This makes it possible for unauthenticated attackers to reset theme customization settings via a forged...

4.3CVSS5.8AI score0.00167EPSS

SaveExploits0References1