PT-2025-6424

Name of the Vulnerable Software and Affected Versions NVIDIA Container Toolkit versions up to and including 1.17.3 NVIDIA GPU Operator versions up to and including 24.9.1 Description NVIDIA Container Toolkit and NVIDIA GPU Operator are affected by a Time-of-Check Time-of-Use TOCTOU vulnerability...

CVE-2025-24970 vulnerabilities

Vulnerabilities for packages: seata, management-api-for-apache-cassandra-4.1, zookeeper-fips, cloudwatch-exporter, kafka, logstash, opensearch, knative-kafka-broker, apache-pulsar, cassandra-reaper, apache-activemq-artemis, tez, akhq, docker-selenium, selenium, elasticsearch, celeborn,...

CVE-2025-24970 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, tez, docker-selenium, kserve-modelmesh, wavefront-proxy, apache-nifi, trino, apache-activemq-artemis, keycloak, celeborn, zookeeper, akhq, thingsboard, cloudwatch-exporter, logstash, selenium, druid, wildfly, apicurio-registry...

CVE-2025-25193 vulnerabilities

Vulnerabilities for packages: keycloak, celeborn, wildfly...

CVE-2025-25193 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, keycloak, seata, zookeeper-fips, celeborn, wildfly...

GHSA-389X-839F-4RHX vulnerabilities

Vulnerabilities for packages: keycloak, celeborn, wildfly...

GHSA-389X-839F-4RHX vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, keycloak, seata, zookeeper-fips, celeborn, wildfly...

GHSA-4G8C-WM8X-JFHW vulnerabilities

Vulnerabilities for packages: seata, management-api-for-apache-cassandra-4.1, zookeeper-fips, cloudwatch-exporter, kafka, logstash, opensearch, knative-kafka-broker, apache-pulsar, cassandra-reaper, apache-activemq-artemis, tez, akhq, docker-selenium, selenium, elasticsearch, celeborn,...

GHSA-4G8C-WM8X-JFHW vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, tez, docker-selenium, kserve-modelmesh, wavefront-proxy, apache-nifi, trino, apache-activemq-artemis, keycloak, celeborn, zookeeper, akhq, thingsboard, cloudwatch-exporter, logstash, selenium, druid, wildfly, apicurio-registry...

CVE-2022-41668

A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal ExpertV3.3 Hotfix 1...

CVE-2022-41666

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal ExpertV3.3 Hotfix 1 or prior, Pro-face...

CVE-2022-41671

A CWE-89: Improper Neutralization of Special Elements used in SQL Command ‘SQL Injection’ vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected...

CVE-2022-41894

TensorFlow is an open source platform for machine learning. The reference kernel of the CONV3DTRANSPOSE TensorFlow Lite operator wrongly increments the dataptr when adding the bias to the result. Instead of dataptr += numchannels; it should be dataptr += outputnumchannels; as if the number of inp...

CVE-2022-41669

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load a malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal ExpertV3.3...

CVE-2022-32540

Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras wi...

CVE-2019-1020011

SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority...

CVE-2025-20180

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is...

CVE-2020-16096

In Gallagher Command Centre versions 8.10 prior to 8.10.1134MR4, 8.00 prior to 8.00.1161MR5, 7.90 prior to 7.90.991MR5, 7.80 prior to 7.80.960MR2, 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be or is attached to a multi-server...

CVE-2024-45041

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...

CVE-2024-42457

A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading ...