CVE-2025-65942

VictoriaMetrics versions 1.0.0–1.110.22, 1.111.0–1.122.7, and 1.123.0–1.129.0 are affected by a DoS/OOM vulnerability in the Snappy decoder that ignores request size limits and can trigger excessive memory usage via malformed blocks. The underlying cause is the decoder not enforcing block-size ch...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the snappy:Decoder function. An attacker can cause excessive memory consumption and potential out-of-memory errors by sending malformed blocks that bypass request size limits. This...

GHSA-66JQ-2C23-2XH5 VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM

Impact Affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest...

ROS-20251125-06

A vulnerability in the Moodle virtual learning environment is related to the disclosure of hidden group names to users, who have permission to create events in the calendar. Exploitation of the vulnerability could allow an attacker, acting remotely, to gain unauthorized access to protected...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unknown fields that aren't checked. An attacker can disrupt consensus and cause all block proposals to be rejected by submitting specially crafted vote extensions with...

The vulnerability of the software for controlling EPSON WebConfig and EPSON Web Control devices is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to device settings.

The vulnerability of the software for controlling EPSON WebConfig and EPSON Web Control devices is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to device settings...

CVE-2025-51663

A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attempt restrictions by faking X-Real-IP and X-Forwarded-For HTTP headers. This can enable attackers to perform DoS attacks or brute force share...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ExceededSizeError exception. An attacker can cause excessive memory consumption and potentially disrupt service availability by sending arbitrarily large JWT tokens in HTTP...

GHSA-FRFH-8V73-GJG4 joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

Summary The ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. Details In situations where a misconfigured — or entirely absent — production-grade web server sits in front of a Python...

The vulnerability of the OneDrive for Android file sharing service lies in the incorrect path limitation for restricted access directories, which allows attackers to escalate their privileges.

The vulnerability of the OneDrive for Android file sharing service is related to an incorrect limitation on the path name of the restricted access directory. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

CVE-2025-64529

A vulnerability has been identified in the WriteRelationships API of SpiceDB, where large relationship-update requests can be silently dropped when the payload exceeds what the underlying datastore permits. This occurs because the server does not always return an error when processing oversized...

Siemens SIMATIC S7-1500 Integer Overflow or Wraparound (CVE-2024-42131)

In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed with assumptions that dirty limits in PAGESIZE units fit into 32-bit so that various multiplications fit into 64-bits. If limits end up bein...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from improper handling of user message limits, which could lead to reuse after release...

CVE-2025-10161

Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass. This...

CVE-2025-10161

Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass. This...

PT-2025-48836

Уязвимость набора инструментов для обеспечения безопасного доступа к контенту Adobe Pass Authentication Android SDK связана с недостатками механизма авторизации. Эксплуатация уязвимости может позволить нарушителю обойти существующие ограничения безопасности...

PT-2025-46330

Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass.This iss...

Amazon Linux 2 : rclone, --advisory ALAS2-2025-3071 (ALAS-2025-3071)

The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3071 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses...

Amazon Linux 2023 : docker (ALAS2023-2025-1274)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1274 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WriteRelationships function when the exclusion operator is used in the authorization schema and the server is configured with --write-relationships-max-updates-per-call greater...