CVE-2025-23045 CVAT allows remote code execution via tracker Nuclio functions

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerability affects CVAT deployments that run...

CVE-2025-23045

CVE-2025-23045 affects Computer Vision Annotation Tool (CVAT). An attacker with an account on an affected CVAT instance can execute arbitrary code in the Nuclio function container via serverless tracker functions (TransT and SiamMask); deployments with custom tracker functions may also be affecte...

CVE-2025-23045 CVAT allows remote code execution via tracker Nuclio functions

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerability affects CVAT deployments that run...

PT-2025-4790 · Nuclio +1 · Nuclio +1

Name of the Vulnerable Software and Affected Versions: Computer Vision Annotation Tool CVAT versions prior to 2.26.0 Description: The issue allows an attacker with an account on an affected CVAT instance to run arbitrary code in the context of the Nuclio function container. This affects CVAT...

BIT-RUBY-MIN-2021-28965

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing...

BIT-PYTHON-MIN-2024-6923 Email header injection due to unquoted newlines

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized...

ROS-20250114-06

A vulnerability in the Serialization component of Oracle GraalVM Enterprise Edition virtual machines, Oracle GraalVM for JDK and Oracle Java SE software platform is related to incorrect clearing or freeing of resources. resources. Exploitation of the vulnerability could allow an attacker acting...

UBUNTU-CVE-2024-47141

In the Linux kernel, the following vulnerability has been resolved: pinmux: Use sequential access to access desc-pinmux data When two client of the same gpio call pinctrlselectstate for the same functionality, we are seeing NULL pointer issue while accessing desc-muxowner. Let's say two processes...

Oracle Linux 9 : kernel (ELSA-2025-0059)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-0059 advisory. - mlxsw: spectrumipip: Fix memory leak when changing remote IPv6 address CKI Backport Bot RHEL-66899 CVE-2024-50252 - CVE-2024-53122 mptcp: cope racing...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

ALSA-2025:0059 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: perf/aux: Fix AUX buffer serialization CVE-2024-46713 kernel: RDMA/bnxtre: Fix a bug while setting up Level-2 PBL pages CVE-2024-50208 kernel: mlxsw: spectrumipip: Fix memory leak when...

OSV-2025-7 Heap-buffer-overflow in oatpp::json::Utils::escapeUtf8Char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=387626404 Crash type: Heap-buffer-overflow WRITE 1 Crash state: oatpp::json::Utils::escapeUtf8Char oatpp::json::Utils::escapeString oatpp::json::Serializer::serializeString...

PT-2025-40079

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the networking subsystem related to phylink. The issue involves a potential race condition when serializing concurrent writes to pl-phydev with the...

PT-2026-4771

Name of the Vulnerable Software and Affected Versions eslint versions prior to 9.26.0 Description A stack overflow issue exists in eslint when serializing objects containing circular references within the eslint/lib/shared/serialization.js file. The issue is triggered through the RuleTester.run...

Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization

The Apache Software Foundation ASF has released patches to address a maximum severity vulnerability in the MINA Java network application framework that could result in remote code execution under specific conditions. Tracked as CVE-2024-52046 , the vulnerability carries a CVSS score of 10.0. It...

Apache MINA 安全漏洞

Apache MINA is a web application framework from the Apache USA Foundation. It is primarily used for developing high-performance and highly scalable web applications. A security vulnerability exists in Apache MINA versions 2.0.X, 2.1.X, and 2.2.X. The vulnerability stems from a lack of necessary...

PT-2024-9987

Name of the Vulnerable Software and Affected Versions Apache MINA versions 2.0.X through 2.2.X Description The ObjectSerializationDecoder in Apache MINA lacks necessary security checks when processing incoming serialized data using Java’s native deserialization protocol. This allows attackers to...

CLSA-2024-1734643101 Fix CVE(s): CVE-2024-6923

SECURITY UPDATE: Improper newline quoting in email module header serialization - debian/patches/CVE-2024-6923.patch: Encode newlines in headers and verify headers to be sound - CVE-2024-6923...

SUSE CVE-2024-47834

GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GSTMATROSKAIDCODECPRIVATE case within the gstmatroskademuxparsestream function, a dat...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-47739)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-47739 advisory. - In the Linux kernel, the following vulnerability has been resolved: padata: use integer wrap around to preve...