Ollama security vulnerabilities

Ollama is an open-source tool developed by Ollama that can be run locally, used for managing and customizing large language models. Version 0.12.10 of Ollama contains a security vulnerability. This vulnerability stems from the readGGUFV1String function in fs/ggml/gguf.go, which never reads the...

CVE-2025-66960

CVE-2025-66960 affects Ollama v0.12.10 and earlier where the function readGGUFV1String in fs/ggml/gguf.go reads a string length from untrusted GGUF metadata, enabling a remote attacker to cause a denial-of-service. Multiple connected sources (SUSE, Red Hat, OSV, NVD, PT Security) describe the DoS...

Improper Handling of Length Parameter Inconsistency

Overview Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency in readGGUFString. An attacker can cause the service to become unavailable by supplying malicious GGUF metadata. Details Denial of Service DoS describes a family of attacks, all aimed ...

CVE-2025-14369

A flaw was found in drflac, an audio decoder within the drlibs toolset. This integer overflow vulnerability occurs due to the tool trusting the totalPCMFrameCount field from FLAC Free Lossless Audio Codec metadata without proper buffer size calculation. An attacker can exploit this by providing a...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the totalPCMFrameCount field from FLAC metadata before buffer size calculation. An attacker can cause a program crash or resource exhaustion by providing a specially crafted file. Remediation A fix was...

DEBIAN-CVE-2025-14369

drflac, an audio decoder within the drlibs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calculating buffer size, allowing an attacker with a specially crafted file to perform DoS against programs using the tool...

CVE-2025-14369

drflac, an audio decoder within the drlibs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calculating buffer size, allowing an attacker with a specially crafted file to perform DoS against programs using the tool...

UBUNTU-CVE-2025-14369

drflac, an audio decoder within the drlibs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calculating buffer size, allowing an attacker with a specially crafted file to perform DoS against programs using the tool...

CVE-2025-14369

CVE-2025-14369 affects dr_flac, the FLAC audio decoder in the dr_libs toolset. A vulnerability arises from an integer overflow caused by trusting the totalPCMFrameCount field from FLAC metadata when calculating the buffer size, which can allow a specially crafted FLAC file to cause a Denial of Se...

CVE-2025-14369 CVE-2025-14369

drflac, an audio decoder within the drlibs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calculating buffer size, allowing an attacker with a specially crafted file to perform DoS against programs using the tool...

CVE-2025-14369

drflac, an audio decoder within the drlibs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calculating buffer size, allowing an attacker with a specially crafted file to perform DoS against programs using the tool...

CVE-2025-14369 CVE-2025-14369

drflac, an audio decoder within the drlibs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calculating buffer size, allowing an attacker with a specially crafted file to perform DoS against programs using the tool...

CVE-2025-14369

drflac, an audio decoder within the drlibs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calculating buffer size, allowing an attacker with a specially crafted file to perform DoS against programs using the tool...

CVE-2026-22219

Chainlit versions prior to 2.9.4 contain a server-side request forgery SSRF vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy...

MiracleLinux 8 : gstreamer1-plugins-base-1.16.1-4.el8_10 (AXSA:2024-9007:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-9007:03 advisory. gstreamer: EXIF Metadata Parsing Integer Overflow CVE-2024-4453 Tenable has extracted the preceding description block directly from the MiracleLinux security...

Node.js security vulnerabilities

Node.js is an open-source, cross-platform JavaScript runtime environment developed by the Node.js community. Versions 20, 22, 24, and 25 of Node.js contain security vulnerabilities. These vulnerabilities stem from the futimes function in the permission model not performing the expected write...

dr_libs security vulnerabilities

drlibs is an audio decoding library developed by David Reid. drlibs has a security vulnerability that stems from trusting the totalPCMFrameCount field in FLAC metadata. This vulnerability may lead to integer overflows, allowing attackers to launch denial-of-service attacks on programs that use th...

PT-2026-3551

Name of the Vulnerable Software and Affected Versions dr flac affected versions not specified Description The dr flac audio decoder, part of the dr libs toolset, has a flaw where it improperly handles the totalPCMFrameCount field within FLAC metadata. This can lead to an integer overflow when...

MiracleLinux 8 : librepo-1.11.0-3.el8 (AXSA:2020-543:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-543:01 advisory. librepo: missing path validation in repomd.xml may lead to directory traversal CVE-2020-14352 CVE-2020-14352: A flaw was found in librepo in versions before...

MiracleLinux 9 : libguestfs-winsupport-9.2-2.el9 (AXSA:2023-6554:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-6554:02 advisory. NTFS-3G: buffer overflow issue in NTFS-3G can cause code execution via crafted metadata in an NTFS image CVE-2022-40284 Tenable has extracted the preceding...