Relative Path Traversal

Overview lollms is a python library for AI personality definition Affected versions of this package are vulnerable to Relative Path Traversal in the sanitizepath function, which does not account for ./ sequences in pathnames. An attacker can bypass the sanitization to access the contents of...

CVE-2025-0184

A Server-Side Request Forgery SSRF vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests...

CVE-2024-8249

mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service DoS vulnerability in the API for the embeddable chat functionality. An attacker can exploit this vulnerability by sending a malformed JSON payload to the API endpoint, causing a server crash due to an...

CVE-2025-0184 Server-Side Request Forgery (SSRF) in langgenius/dify

A Server-Side Request Forgery SSRF vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests...

CVE-2024-11169 Unhandled Exception Leading to Server Crash in danny-avila/librechat

An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handling file uploads. An unauthenticated user can trigger this exception by sending a specially crafted request, causing the server to crash...

CVE-2024-10724 Stored XSS in IPV6 Section in phpipam/phpipam

A stored cross-site scripting XSS vulnerability exists in phpipam/phpipam version 1.5.2, specifically in the Subnet NAT translations section when editing the Destination address. This vulnerability allows an attacker to execute malicious code. The issue is fixed in version 1.7.0...

CVE-2024-10725 Stored Cross-site Scripting (XSS) in phpipam/phpipam

A stored cross-site scripting XSS vulnerability exists in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the application, which are then executed in the context of other users who view the affected pages. The issue occurs when editing the NAT...

Apache Seata Vulnerable to Data Amplification

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Seata incubating. This issue affects Apache Seata incubating: through =2.2.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue...

Important: Red Hat Security Advisory: kpatch-patch-5_14_0-503_15_1 and kpatch-patch-5_14_0-503_26_1 security update

An update for kpatch-patch-5140-503151 and kpatch-patch-5140-503261 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

RHEL 6 / 7 : rh-mariadb101-mariadb (RHSA-2016:1637)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1637 advisory. MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. The...

SUSE SLES12 Security Update : kernel (Live Patch 62 for SLE 12 SP5) (SUSE-SU-2025:0896-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:0896-1 advisory. This update for the Linux Kernel 4.12.14-122234 fixes one issue. The following security issue was fixed: - CVE-2024-50302: HID: core: zero-initialize t...

RHEL 7 : CFME 5.6.3 (RHSA-2016:2839)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2839 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments...

SUSE SLES15 Security Update : kernel (Live Patch 35 for SLE 15 SP4) (SUSE-SU-2025:0910-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:0910-1 advisory. This update for the Linux Kernel 5.14.21-15040024147 fixes one issue. The following security issue was fixed: - CVE-2024-56648: net: hsr: avoid potenti...

SUSE SLES15 Security Update : kernel (Live Patch 34 for SLE 15 SP4) (SUSE-SU-2025:0949-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:0949-1 advisory. This update for the Linux Kernel 5.14.21-15040024144 fixes one issue. The following security issue was fixed: - CVE-2024-56648: net: hsr: avoid potenti...

SUSE SLES15 Security Update : kernel RT (Live Patch 6 for SLE 15 SP6) (SUSE-SU-2025:0889-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:0889-1 advisory. This update for the Linux Kernel 6.4.0-1506001020 fixes one issue. The following security issue was fixed: - CVE-2024-56648: net: hsr: avoid potential...

tomcat-9.0.102-1.1 on GA media (moderate)

tomcat-9.0.102-1.1 on GA media Announcement ID: openSUSE-SU-2025:14911-1 Rating: moderate Cross-References: CVE-2024-52317 CVSS scores: CVE-2024-52317 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2024-52317 SUSE : 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N...

PT-2025-13697 · Tenda · Tenda Fh1202

Name of the Vulnerable Software and Affected Versions: Tenda FH1202 version 1.2.0.14408 Description: A critical issue has been discovered, affecting the Web Management Interface component, specifically the /goform/SysToolChangePwd file. This leads to improper access controls, allowing for remote...

SUSE SLES12 Security Update : freetype2 (SUSE-SU-2025:0960-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:0960-1 advisory. - CVE-2025-27363: Fixed out-of-bounds write when attempting to parse font subglyph structures related to TrueType GX and variable font files bsc1239465...

openSUSE Security Advisory (SUSE-SU-2025:0901-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-29783

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code...