CVE-2024-25176

A stack-based buffer overflow was found in LuaJit. This flaw was uncovered through fuzzing, and no real-world attack exploiting it has been demonstrated. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criter...

CVE-2024-25178

An out-of-bounds read was found in LuaJIT. This issue was uncovered through fuzzing, and no real-world exploit has been demonstrated. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease o...

CVE-2025-6210

A vulnerability in the ObsidianReader class of the run-llama/llamaindex repository, specifically in version 0.12.27, allows for hardlink-based path traversal. This flaw permits attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting hardlinks. T...

CVE-2025-6209

A path traversal vulnerability was found in run-llama/llamaindex. This vulnerability allows an attacker to manipulate the imagepath input to read files on the server. File access is limited to those files that the running process has permission to read. Mitigation Mitigation for this issue is...

CVE-2025-3263

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library. This vulnerability may allow an attacker to induce a denial of service in the application using the Transformers library. Mitigation Mitigation for this issue is either not availabl...

CVE-2025-3264

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library. This vulnerability may allow an attacker to induce a denial of service in the application using the Transformers library. Mitigation Mitigation for this issue is either not availabl...

CVE-2025-3262

A Regular Expression Denial of Service ReDoS vulnerability has been discovered in the Hugging Face Transformers library. This issue can be exploited by an attacker who is able to supply specially crafted malicious input. Such input can cause excessive processing time and resource consumption,...

CVE-2025-53366

A flaw was found in MCP. The MCP Python SDK contains a validation error that leads to an unhandled exception when processing malformed requests. This flaw allows a remote attacker to trigger this condition by sending a crafted request, resulting in an application-level service interruption...

Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller

Citrix Bleed 2 PoC Scanner CVE-2025-5777 This script is a P...

CVE-2025-34090

A security bypass flaw was found in Google Chrome. A local low-privileged attacker can hijack the COM class identifier registration used by Chrome's elevation service and point it to a non-existent or malicious binary. When this hijack occurs, Chrome silently falls back to the legacy cookie...

CVE-2025-34075

A virtual machine escape vector has been discovered in HashiCorp Vagrant. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant. This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagra...

CVE-2025-24329 OAM service path traversal issue caused by a crafted SOAP message archive field within the RAN management network

Sending a crafted SOAP "provision" operation message archive field within the Mobile Network Operator MNO internal Radio Access Network RAN management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has bee...

CVE-2025-24329

CVE-2025-24329 affects Nokia Single RAN baseband software prior to 24R1-SR 1.0 MP, where a crafted SOAP provision operation message archive field in the MNO internal RAN management network can cause a path traversal vulnerability. A fix is available in release 24R1-SR 1.0 MP and later; the OAM se...

CVE-2025-53103

An information disclosure flaw was found in JUnit. When writing Open Test Reporting XML files, git credentials may be leaked. The full impact of this flaw depends on how these XML files are handled on a per-environment basis. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-6297

A temporary file cleanup flaw was found in dpkg. When extracting a control member into a temporary directory, the code responsible for cleaning up the temporary directory does not sanitize the directory permissions, leaving temporary files behind. Repeated and automated execution of dpkg-deb...

Elastic WAF: Reshaping Application Security for DevOps and Hybrid Environments

We recently discussed Imperva’s vision for the future of application security, where we also covered the Imperva Security Engine. This innovative application security framework is powering up the next generation of Imperva solutions, the first of which is Imperva Elastic WAF. This blog is the fir...

CVE-2025-6858

A flaw was found in hdf5. The H5Cflushsingleentry function contains a NULL pointer dereference triggered by the manipulation of data within a file. A local attacker can induce this condition. This issue can lead to a potential denial of service. Mitigation Mitigation for this issue is either not...

CVE-2025-6857

A flaw was found in hdf5. The H5Gnodecmp3 function in src/H5Gnode.c contains a stack-based buffer overflow vulnerability that is triggered by manipulating data within a file. This flaw allows a local attacker to provide a specially crafted file. This issue can lead to a denial of service...

CVE-2025-6856

A flaw was found in hdf5. The H5FLreggclist function in src/H5FL.c contains a use-after-free condition, requiring local attacker interaction. Manipulation of the file triggers this condition, potentially leading to a denial of service. This vulnerability stems from improper memory management duri...

OESA-2025-1689 cri-o security update

Open Container Initiative-based implementation of Kubernetes Container Runtime Interface. Security Fixes: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a...