12577 matches found
PT-2025-12765
Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.28.9 and earlier, 3.x versions prior to 3.6.3 Description The issue arises when Mbed TLS, in certain cases of failed memory allocation or hardware errors, utilizes uninitialized stack memory to compose the TLS Finished...
PT-2025-12670
Name of the Vulnerable Software and Affected Versions Kentico Xperience versions prior to 13.0.178 Description The Kentico Xperience application does not fully validate or filter files uploaded through the multiple-file upload functionality. This insufficient validation allows for stored Cross-Si...
Hotfix XS82ECU1083 - For Citrix Hypervisor 8.2 Cumulative Update 1
Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.2 Cumulative Update 1 and is only available to customers on theCustomer Success Servicesprogram. Note: Citrix Hypervisor 8.2 Cumulative Update 1 reaches end of life on Jun 25, 2025. Upgrade toXenServer...
PT-2025-12717
Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to v1.11.5 ingress-nginx versions from v1.12.0-beta.0 through v1.12.1 Description A security issue exists in ingress-nginx where the auth-url Ingress annotation can be exploited to inject configuration into nginx...
MGASA-2025-0110 Updated libxslt packages fix security vulnerabilities
xsltGetInheritedNsList in libxslt has a use-after-free issue related to exclusion of result prefixes CVE-2024-55549. numbers.c in libxslt has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValu...
CVE-2025-30157 Envoy crashes when HTTP ext_proc processes local replies
Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's extproc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket...
RHSA-2025:3076 Red Hat Security Advisory: php:7.4 security update
Bulletin has no description...
CVE-2025-2555 Audi Universal Traffic Recorder App FTP Credentials hard-coded password
A vulnerability classified as problematic has been found in Audi Universal Traffic Recorder App 2.0. Affected is an unknown function of the component FTP Credentials. The manipulation leads to use of hard-coded password. Attacking locally is a requirement. The complexity of an attack is rather...
RHSA-2025:3063 Red Hat Security Advisory: postgresql:12 security update
Bulletin has no description...
RHSA-2025:2712 Red Hat Security Advisory: OpenShift Container Platform 4.14.49 packages and security update
Bulletin has no description...
CVE-2024-12029 Remote Code Execution via Model Deserialization in invoke-ai/invokeai
A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...
PT-2025-12158
Name of the Vulnerable Software and Affected Versions llama index versions prior to 0.5.1 llama index versions prior to 0.12.3 Description A vulnerability exists in the default jsonalyzer function of the JSONalyzeQueryEngine. This allows for SQL injection via prompt injection, potentially leading...
PT-2025-12114
Name of the Vulnerable Software and Affected Versions run-llama/llama index versions prior to v0.4.0 Description A SQL injection vulnerability exists in the duckdb retriever component. The issue stems from constructing SQL queries without utilizing prepared statements, which allows for the...
PT-2025-12226 · Mintplex · Anything-Llm
Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm version git 6dc3642 through version prior to 1.2.2 Description: The issue is related to an unauthenticated Denial of Service DoS vulnerability in the API for the embeddable chat functionality. An attacker can exploi...
PT-2025-12280 · Unknown · Transformeroptimus/Superagi
Name of the Vulnerable Software and Affected Versions: transformeroptimus/superagi version 0.0.14 Description: A Path Traversal vulnerability exists in the file upload functionality. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote cod...
PT-2025-12118 · Ollama · Ollama
Name of the Vulnerable Software and Affected Versions: Ollama versions =0.3.14 Description: A malicious user can create a customized gguf model file that can be uploaded to the public Ollama server, causing it to crash and leading to a Denial of Service DoS attack. The root cause of the issue is ...
DLA-4087-1 python3.9 - security update
Bulletin has no description...
CVE-2025-29925 XWiki allows unregistered users to access private pages information through REST endpoint
XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/wikiName/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent...