CVE-2025-54381 BentoML is Vulnerable to an SSRF Attack Through File Upload Processing

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP...

RLSA-2025:8676 Moderate: libxslt security update

libxslt is a library for transforming XML files into other textual formats including HTML, plain text, and other XML representations of the underlying data using the standard XSLT stylesheet transformation mechanism. Security Fixes: libxslt: Processing web content may disclose sensitive informati...

Invisible Injections: Exploiting Vision-Language Models through Steganographic Prompt Embedding

Vision-language models VLMs have revolutionized multimodal AI applications but introduce novel security vulnerabilities that remain largely unexplored. We present the first comprehensive study of steganographic prompt injection attacks against VLMs, where malicious instructions are invisibly...

The vulnerability of D-Link DI-7300G+ microprogrammed software lies in the lack of measures taken to neutralize special elements during the processing of the ASP file httpd_debug.asp, allowing attackers to execute arbitrary commands.

The vulnerability of D-Link DI-7300G+ router microprogramming software is related to the lack of measures taken to neutralize special elements during the processing of the asp-file httpddebug.asp. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to errors in processing the relative path to the directory, allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of JetBrains TeamCity is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the getdeleteddocuments.vm template in the XWiki platform, a collaborative web application. This allows attackers to execute arbitrary code.

The vulnerability of the getdeleteddocuments.vm template in the XWiki platform, a collaborative web application, arises from the lack of protection for the SQL query structure during the processing of the sort parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code...

PT-2025-31300

Name of the Vulnerable Software and Affected Versions Safari affected versions not specified watchOS versions prior to 11.6 iOS versions prior to 18.6 iPadOS versions prior to 18.6 iPadOS version 17.7.9 tvOS versions prior to 18.6 macOS versions prior to Sequoia 15.6 visionOS versions prior to 2....

BentoML 代码问题漏洞

BentoML is an open source modeling service library from BentoML Open Source. It is used to build high-performance and scalable artificial intelligence applications using Python. A code issue vulnerability exists in BentoML versions 1.4.0 through 1.4.19 that stems from the file upload processing...

SUSE CVE-2025-38354

In the Linux kernel, the following vulnerability has been resolved: drm/msm/gpu: Fix crash when throttling GPU immediately during boot There is a small chance that the GPU is already hot during boot. In that case, the call to ofdevfreqcoolingregister will immediately try to apply devfreq cooling,...

GO-2025-3780 OpenBao Inserts Sensitive Information into Log File when processing malformed data in github.com/openbao/openbao/sdk

OpenBao Inserts Sensitive Information into Log File when processing malformed data in github.com/openbao/openbao/sdk...

GO-2025-3811 File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing in github.com/filebrowser/filebrowser

File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing in github.com/filebrowser/filebrowser...

GO-2025-3787 May leak sensitive information in logs when processing malformed data in github.com/go-viper/mapstructure

May leak sensitive information in logs when processing malformed data in github.com/go-viper/mapstructure...

GHSA-9952-GV64-X94C CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

Impact This vulnerability affects applications that: Use the ImageMagick handler for image processing imagick as the image library AND either: Allow file uploads with user-controlled filenames and process uploaded images using the resize method OR use the text method with user-controlled text...

CVE-2025-54418

CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image processing imagick as the image library and either allow file uploads with user-controlled filenames and process...

D-Link DIR-513 formLanguageChange function buffer overflow vulnerability

D-Link DIR-513 is a portable wireless router that focuses on thin and light design and easy-to-use features, and supports IEEE 802.11n, 802.11g/b standards with a maximum transmission rate of 300Mbps. The D-Link DIR-513 suffers from a buffer overflow vulnerability that stems from improper handlin...

TOTOLINK X15 安全漏洞

TOTOLINK X15 is a network wireless extender manufactured by China's Gion Electronics TOTOLINK, mainly used to extend Wi-Fi coverage. The device supports Wi-Fi 6 technology and offers AX1500 wireless transmission rate for home and small office scenarios. A buffer overflow vulnerability exists in t...

PT-2025-31111 · Unknown · Imagemagick +1

Name of the Vulnerable Software and Affected Versions: CodeIgniter versions prior to 4.6.2 Description: CodeIgniter is a PHP full-stack web framework susceptible to a command injection issue. The vulnerability impacts applications utilizing the ImageMagick handler imagick for image processing and...

CVE-2025-8171

The connected records provide concrete details for CVE-2025-8171 in code-projects Document Management System 1.0. The issue resides in the /insert.php endpoint where manipulation of the uploaded_file argument leads to unrestricted file uploads, enabling remote initiation of an attack. Multiple so...

UBUNTU-CVE-2025-38455

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Reject SEV-ES intra host migration if vCPU creation is in-flight Reject migration of SEV-ES state if either the source or destination VM is actively creating a vCPU, i.e. if kvmvmioctlcreatevcpu is in the section betwee...

CVE-2025-38413 virtio-net: xsk: rx: fix the frame's length check

In the Linux kernel, the following vulnerability has been resolved: virtio-net: xsk: rx: fix the frame's length check When calling buftoxdp, the len argument is the frame data's length without virtio header's length vi-hdrlen. We check that len with xskpoolgetrxframesize + vi-hdrlen to ensure the...