CVE-2025-48943

An application level denial of service flaw was found in vLLM. This flaw allows a remote attacker with access to the system prompt to submit an invalid regular expression while requesting structured output and crash the vLLM instance. Mitigation Mitigation for this issue is either not available o...

CVE-2025-48938

A vulnerability was found in the Browser.Browse functionality of GitHub cli. This flaw allows an attacker who has control of a compromised GitHub Enterprise Server to execute arbitrary commands in the context of the cli user. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-48068

A flaw was found in Next.js. This vulnerability allows limited source code exposure via visiting a malicious webpage while the development server is running with the App Router enabled. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the...

CVE-2025-44905

A flaw was found in the HDF5 library, specifically in the H5Zfilterscaleoffset function. This vulnerability allows memory corruption and application crashes via decompression of a malformed HDF5 file using the Scale-Offset filter. The issue arises when the function reads 1 byte beyond a 1-byte he...

CVE-2025-44904

A flaw was found in the H5VMmemcpyvv function in the HDF5 library. This vulnerability can allow memory corruption and application crashes via reading from a specially crafted compact dataset, leading to a heap-based buffer overflow. Mitigation Mitigation for this issue is either not available or...

CVE-2025-46722

An image based hash collision flaw was found in vLLM due to insufficient distinct hashing. This flaw allows an attacker to poison the cache in a vLLM instance, which may lead to inconsistent or unexpected output. Mitigation Mitigation for this issue is either not available or the currently...

CVE-2023-41317

The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service DoS type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are...

CVE-2023-51451

Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via...

CVE-2025-2099

A vulnerability in the preprocessstring function of the transformers.testingutils module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service ReDoS attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leadin...

CVE-2025-23167

A flaw was found in the HTTP parser of Node.js. This vulnerability allows attackers to perform request smuggling and bypass proxy-based access controls via improperly terminated HTTP/1 headers using \r\n\rX instead of the standard \r\n\r\n. Mitigation Mitigation for this issue is either not...

CVE-2025-48174

A flaw was found in libavif. This vulnerability allows a buffer overflow via a maliciously crafted AVIF file. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment,...

CVE-2025-4516

A vulnerability has been identified in CPython's bytes.decode function when used with the "unicodeescape" encoding and the "ignore" or "replace" error handling modes. This flaw can result in the incorrect decoding of byte strings. While this may not directly lead to traditional security breaches...

CVE-2025-46718

A flaw was found in sudo-rs. This vulnerability allows users with limited sudo privileges to enumerate the sudoers file, revealing sensitive information about other users' permissions via the -U flag. Mitigation Mitigation for this issue is either not available or the currently available options ...

CVE-2025-1752

A flaw was found in llama-index KnowledgeBaseWebReader. This vulnerability allows an application-level denial of service via crafting malicious input that exhausts Python's recursion limit. Mitigation Mitigation for this issue is either not available or the currently available options do not meet...

OESA-2025-1474 redis security update

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets. Security Fixes: Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An...

CVE-2025-4287

A problematic vulnerability has been identified in PyTorch version 2.6.0 with CUDA 12.4. The affected component is the torch.cuda.nccl.reduce function within the torch/cuda/nccl.py file. Exploitation of this vulnerability can lead to a denial-of-service condition. The attack can be launched from...

CVE-2025-0716

Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/ContentSpoofing and also negatively affect...

CVE-2025-31650

A flaw was found in Apache Tomcat. This vulnerability allows an application-level denial of service DoS, causing it to become unresponsive or slow via maliciously crafted HTTP/2 prioritization headers. It performs an incomplete cleanup of failed requests, which triggers a memory leak. Mitigation...

CVE-2025-30194

A flaw was found in DNSdist's DoH implementation using the nghttp2 provider. This vulnerability allows denial of service via a specially crafted DoH exchange that triggers a double-free memory error. Mitigation Mitigation for this issue is either not available or the currently available options d...

CVE-2025-43857

A flaw was found in Net::IMAP, a Ruby library for IMAP client functionality. This vulnerability allows a malicious server to send a large "literal" byte count, causing the client to allocate excessive memory, potentially leading to denial of service memory exhaustion. This vulnerability could all...