The vulnerability of the md5 function in the package manager pnpm allows a hacker to compromise data integrity.

The vulnerability of the md5 function in the package manager pnpm relates to the use of a reversible one-way hash function. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

PT-2025-28870 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains a race condition within the userfaultfd move function when handling swap cache operations. This issue arises from a lockless swap cache lookup, potentially...

The vulnerability of software products for conducting Zoom Workplace video conferences, related to the manipulation of cross-site requests, allows a perpetrator to influence the integrity of protected information.

The vulnerability of Zoom Workplace, a software product for conducting video conferences, is related to the manipulation of cross-site requests. Exploiting this vulnerability could allow an attacker operating remotely to influence the integrity of the protected information...

The vulnerability of software products for conducting Zoom Workplace video conferences on the Windows operating system, related to insecure resource initialization, allows a perpetrator to influence the integrity of protected information.

The vulnerability of software products for conducting Zoom Workplace video conferences on the Windows operating system is related to an insecure initialization of resources. Exploiting this vulnerability could allow an attacker to influence the integrity of protected information...

Hash Collision Attack

vllm is vulnerable to hash collision and data integrity issues. The vulnerability is due to improper image serialization using only raw pixel bytes without metadata, allowing attackers to create images with identical hashes and exploit cache poisoning or access sensitive data...

Amazon Linux 2023 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2023-2025-988)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-988 advisory. In iconvdata/iso-2022-jp-3.c in the GNU C Library aka glibc 2.34, remote attackers can force iconv to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an...

📄 Unifiedtransform 2.x Course Editor Missing Authorization

Unifiedtransform version 2.x allows any user to access and modify course records via the /course/edit/id endpoints. Description Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Any user students and teachers can access and modify course details via the /course/edit/id endpoints...

PYSEC-2025-43

vLLM is an inference and serving engine for large language models LLMs. In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image...

CVE-2025-46722

vLLM is an inference and serving engine for large language models LLMs. In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image...

CVE-2025-46722

The CVE-2025-46722 entry concerns vLLM (versions 0.7.0–0.8.x) where MultiModalHasher in vllm/multimodal/hasher.py hashes PIL.Image.Image objects using only obj.tobytes(). This excludes image metadata (width, height, mode), enabling two images with identical pixel data but different shapes to yiel...

CVE-2025-46722 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

vLLM is an inference and serving engine for large language models LLMs. In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image...

CVE-2025-46722 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

vLLM is an inference and serving engine for large language models LLMs. In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image...

CVE-2025-46722 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

vLLM is an inference and serving engine for large language models LLMs. In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image...

vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

Summary In the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image objects using only obj.tobytes, which returns only the raw pixel data, without including metadata such as the...

PT-2025-23136 · Vllm · Vllm

Name of the Vulnerable Software and Affected Versions: vLLM versions 0.7.0 through 0.8.x Description: The issue concerns a security and data integrity problem in the image hashing method of the MultiModalHasher class. Specifically, the method serializes PIL.Image.Image objects using only...

The vulnerability of the formDhcpv6s interface in the BOA microprogramming software of TOTOLINK A3002R routers allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the formDhcpv6s interface in the boa microprogramming software of TOTOLINK A3002R routers is related to buffer overflow during the processing of the addrPoolEnd parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality and integrity of the...

ROS-20250526-07

Google Chrome browser vulnerability involves post-release memory usage. Exploitation of the vulnerability could allow an attacker acting remotely to impact privacy, integrity and availability of data through the use of a specially crafted HTML page...

The vulnerability of the web_acl_ipv4BasedAceAdd() function in PLANET Technology’s microprogrammed switching software allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the webaclipv4BasedAceAdd function in PLANET Technology’s microprogrammed switching software is related to buffer overflows in the stack when processing the ipv4Aclkey parameter. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integri...

The vulnerability of the web_acl_mgmt_Rules_Edit_postcontains() function in PLANET Technology’s microcontroller software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the webaclmgmtRulesEditpostcontains function of the PLANET Technology microprogramming device is related to the issue of the operation exceeding the buffer boundaries in memory when processing the byruleEditName parameter. Exploitation of this vulnerability could allow an...

The vulnerability of the web_snmp_v3host_add_post() function in PLANET Technology’s microcontroller software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the websnmpv3hostaddpost function in PLANET Technology’s microcontroller software stems from the issue of the operation exceeding the buffer boundaries in memory when processing the hostip parameter. Exploiting this vulnerability allows an attacker to compromise the...