CVE-2025-2581

CVE-2025-2581 affects xmedcon 0.25.0 (DICOM File Handler malloc) with an integer underflow that can be triggered remotely. The issue is mitigated by upgrading to a newer release; Fedora advisories and the initial CVE entry indicate upgrades to 0.25.3 (and 0.25.1 as a fix path) as the remediation....

Fedora 40 : fluent-bit (2025-b2bdcfedac)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-b2bdcfedac advisory. Update to 3.2.8 - Closes rhbz2137000 rhbz2340164 rhbz2300673 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Exposure of Sensitive Information Through Metadata

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata due to an issue in proxyserver.py. An attacker can obtain sensitive information, including API keys, by triggering error...

CVE-2025-2557 Audi UTR Dashcam Command API access control

A vulnerability, which was classified as critical, has been found in Audi UTR Dashcam 2.0. Affected by this issue is some unknown functionality of the component Command API. The manipulation leads to improper access controls. The attack needs to be done within the local network. The exploit has...

CVE-2025-2555

A vulnerability classified as problematic has been found in Audi Universal Traffic Recorder App 2.0. Affected is an unknown function of the component FTP Credentials. The manipulation leads to use of hard-coded password. Attacking locally is a requirement. The complexity of an attack is rather...

CVE-2025-2556

A vulnerability classified as problematic was found in Audi UTR Dashcam 2.0. Affected by this vulnerability is an unknown functionality of the component Video Stream Handler. The manipulation leads to hard-coded credentials. The attack can only be initiated within the local network. The exploit h...

CVE-2025-2556 Audi UTR Dashcam Video Stream hard-coded credentials

A vulnerability classified as problematic was found in Audi UTR Dashcam 2.0. Affected by this vulnerability is an unknown functionality of the component Video Stream Handler. The manipulation leads to hard-coded credentials. The attack can only be initiated within the local network. The exploit h...

CVE-2025-2555

Audi Universal Traffic Recorder App 2.0 is affected by CVE-2025-2555 due to a hard-coded password in the FTP Credentials component. The issue enables local attack exploitation; attack complexity is high and exploitation is disclosed publicly. Upgrading to version 2.89 (new customers) or 2.90 (exi...

Apache Druid vulnerable to Server-Side Request Forgery, Cross-site Scripting, Open Redirect

Severity: medium 5.8 / important Server-Side Request Forgery SSRF, Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting', URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Druid. This issue affects all previous Druid versions. When using the...

CVE-2025-27888 Apache Druid: Server-Side Request Forgery and Cross-Site Scripting

Severity: medium 5.8 / important Server-Side Request Forgery SSRF, Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting', URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Druid. This issue affects all previous Druid versions. When using the...

CVE-2024-47552

Deserialization of Untrusted Data vulnerability in Apache Seata incubating. This issue affects Apache Seata incubating: from 2.0.0 before 2.2.0. Severity Justification: The Apache Seata security team assesses the severity of this vulnerability as "Low" due to stringent real-world mitigating...

CVE-2024-54016

CVE-2024-54016 describes an Improper Handling of Highly Compressed Data (Data Amplification) affecting Apache Seata (incubating) up to version 2.2.0. The issue is reported across multiple feeds as a vulnerability that could enable performance degradation due to oversized compressed input, with re...

CVE-2024-47552

CVE-2024-47552 is a Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). The initial record lists affected versions: 2.0.0 before 2.2.0, with a fix in 2.2.0. Connected advisories extend the affected range to 2.0.0 through 2.3.0 and recommend upgrading to 2.3.0. Exploitati...

CVE-2024-47552 Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server

Deserialization of Untrusted Data vulnerability in Apache Seata incubating. This issue affects Apache Seata incubating: from 2.0.0 before 2.2.0. Severity Justification: The Apache Seata security team assesses the severity of this vulnerability as "Low" due to stringent real-world mitigating...

PT-2025-12205

Name of the Vulnerable Software and Affected Versions pytorch-lightning version 2.3.2 Description A vulnerability in pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occu...

PT-2025-12814 · Rockwell Automation · Verve Asset Manager

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Verve Asset Manager versions 1.39 and prior Description: A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing in the administrative web interface for Verve's Legacy...

PT-2025-12222

Name of the Vulnerable Software and Affected Versions prefecthq/prefect version 2.20.2 Description A CORS Cross-Origin Resource Sharing misconfiguration allows unauthorized domains to access sensitive data, potentially leading to unauthorized access to the database. This can result in data leaks,...

PT-2025-12459

Name of the Vulnerable Software and Affected Versions: Corosync versions 3.1.9 and earlier Description: The issue is a stack-based buffer overflow in the orf token endian convert function in exec/totemsrp.c via a large UDP packet, which can be exploited if encryption is disabled or the attacker...

Azure Linux 3.0 Security Update: vim (CVE-2025-1215)

The version of vim installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-1215 advisory. - A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown co...

Debian dsa-5882 : chromium - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5882 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5882-1 [email protected] https://www.debian.org/security/ Andres...