CVE-2025-2172

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames...

Vulnerability fixed in Citrix NetScaler ADC and NetScaler Gateway

Citrix has fixed a vulnerability in NetScaler ADC and NetScaler Gateway. To be vulnerable, NetScaler must be configured as a Gateway VPN virtual server, ICA Proxy, CVPN, RDP Proxy or AAA virtual server. Note that this is often default config. The vulnerability is in the way memory is managed in...

kernel: irqchip/gic-v3-its: Prevent double free on error

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent double free on error The Linux kernel CVE team has assigned CVE-2024-35847 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051738-CVE-2024-35847-7e4b@gregkh/T...

VulnCheck KEV: CVE-2024-54085

AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability...

Cisco Nexus Dashboard SSH Impersonation

The vulnerability of the SSH protocol implementation in the Cisco Nexus Dashboard Fabric Controller NDFC and the Cisco Nexus Dashboard cloud network analytics and automation platform is related to insufficient security checks for the protected connection. Exploiting this vulnerability allows a...

j1939_netdev_start() CAN Bus DoS

The vulnerability of the j1939netdevstart function in the net/can/j1939/main.c module, which supports J1939 CAN interfaces in Linux kernels, is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

Hope-Boot input validation vulnerability

Hope-Boot is a modern scaffolding project by the individual developer java-aodeng. An input validation error vulnerability exists in Hope-Boot version 1.0.0, which stems from mishandling of the parameter redirecturl in the doLogin function in WebController.java, which could lead to an open redire...

Hope-Boot security vulnerabilities

Hope-Boot is a modern scaffolding project by the individual developer java-aodeng. A security vulnerability exists in Hope-Boot version 1.0.0, which stems from the mishandling of the parameter errorMsg by the Login function in WebController.java, which could lead to a cross-site scripting attack...

PT-2025-34415

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains an issue where the order of device tree parsing and pinctrl registration was incorrect. Moving the device tree parsing before pinctrl registration prevents th...

kubernetes allows nodes to bypass dynamic resource allocation authorization checks

A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to...

CVE-2025-6517

A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\src\main\java\org\dromara\maxkey\web\apps\contorller\SAML20DetailsController.java of the component Meta URL Handler. The manipulation of t...

AZL-64304 CVE-2025-4563 affecting package kubernetes for versions less than 1.30.10-9

A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to...

DEBIAN-CVE-2025-4563

A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to...

CVE-2025-4563

A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to...

CVE-2025-4563 Nodes can bypass dynamic resource allocation authorization checks

A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to...

CVE-2025-4563 Nodes can bypass dynamic resource allocation authorization checks

A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to...

mlflow-cratedb (2.13.0), mlflowcli (0.0.2) +1 more potentially affected by CVE-2025-52967 via mlflow (2.13.0)

mlflow PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-cratedb 2.13.0 - mlflowcli 0.0.2 - model-controller 1.0.0 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

CVE-2025-2171

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN...

CVE-2025-2172

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames...

CVE-2025-2172

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames...