Archive
July 2025
Vulnerabilities first published in this month (UTC), newest first.
1,456 results · Clear filters · Feed
-
Medium 5.3
Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in ver…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.configuration_utils` module. The affected version is 4.49.0,…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within t…
-
Medium 5.3
MD5 Hash Collision in run-llama/llama_index
A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but dif…
-
Medium 6.8
OS Command Injection via USB Config Load
A physical attacker with no privileges can gain full control of the affected device due to improper neutralization of special elements used in an OS Command ('OS Command Injection') when loading a config file from a USB drive.
-
Medium 6.3
Campcodes Complaint Management System complaint-details.php sql injection
A vulnerability was found in Campcodes Complaint Management System 1.0. It has been classified as critical. This affects an unknown part of the file /users/complaint-details.php. The manipulation of the argument cid leads to sql injection. It is possible to i…
-
Medium 6.4
Offline Extraction of Account Connectivity Credentials (ACCs) in IT Management Suite
Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage
-
Medium 5.9
Vulnerability that allows third-party call apps to send broadcasts without verification in the audio framework module I…
-
Medium 6.6
Virtual address reuse issue in the memory management module, which can be exploited by non-privileged users to access r…
-
Medium 6.5
Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability …
-
Medium 5.4
risesoft-y9 Digital-Infrastructure Y9FileController.java deleteFile path traversal
A vulnerability classified as critical was found in risesoft-y9 Digital-Infrastructure up to 9.6.7. Affected by this vulnerability is the function deleteFile of the file /Digital-Infrastructure-9.6.7/y9-digitalbase-webapp/y9-module-filemanager/risenet-y9boot-…
-
Medium 6.5
Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability …
-
Medium 6.5
Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability …
-
Medium 6.5
Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability …
-
Medium 6.5
Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability …
-
Medium 6.5
Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability …
-
Medium 4.8
Permission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability ma…
-
Medium 4.0
Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerabi…
-
Medium 4.0
Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerabi…
-
Medium 5.3
Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerabi…
-
Medium 4.0
Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerabi…
-
Medium 4.0
Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerabi…
-
Medium 5.3
SimStudioAI sim route.ts handleLocalFile path traversal
A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLocalFile of the file apps/sim/app/api/files/parse/route.ts. The manipulation of the argument filePath leads to path traversal. It is possibl…
-
Medium 4.0
Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerabi…
-
Medium 4.0
Null pointer dereference vulnerability in the application exit cause module Impact: Successful exploitation of this vul…
-
Medium 5.7
Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful …
-
Medium 6.9
Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this …
-
Medium 6.3
BoyunCMS curl Index.php server-side request forgery
A vulnerability was found in BoyunCMS up to 1.4.20. It has been rated as critical. This issue affects some unknown processing of the file /application/pay/controller/Index.php of the component curl. The manipulation leads to server-side request forgery. The a…
-
Medium 6.3
BoyunCMS Server.php sql injection
A vulnerability was found in BoyunCMS up to 1.4.20. It has been declared as critical. This vulnerability affects unknown code of the file application/update/controller/Server.php. The manipulation of the argument phone leads to sql injection. The attack can b…
-
Medium 6.3
BoyunCMS Configuration File install_ok.php code injection
A vulnerability was found in BoyunCMS up to 1.4.20. It has been classified as critical. This affects an unknown part of the file /install/install_ok.php of the component Configuration File Handler. The manipulation of the argument db_pass leads to code inject…
-
Medium 6.3
BoyunCMS Index.php unrestricted upload
A vulnerability was found in BoyunCMS up to 1.4.20 and classified as critical. Affected by this issue is some unknown functionality of the file /application/user/controller/Index.php. The manipulation of the argument image leads to unrestricted upload. The at…
-
Medium 6.1
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebb…
-
Medium 6.1
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the b…
-
Medium 6.1CVE-2024-37656 Scanner template
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the i…
-
Medium 5.6
BoyunCMS Installation install2.php deserialization
A vulnerability has been found in BoyunCMS up to 1.21 on PHP7 and classified as critical. Affected by this vulnerability is an unknown functionality of the file install/install2.php of the component Installation Handler. The manipulation of the argument db_ho…
-
Medium 5.6
Comodo Internet Security Premium File Name path traversal
A vulnerability, which was classified as critical, was found in Comodo Internet Security Premium 12.3.4.8162. Affected is an unknown function of the component File Name Handler. The manipulation of the argument name/folder leads to path traversal. It is possi…
-
Medium 5.0
Unsafe Deserialization in JsonPickleSerializer Enables Remote Code Execution in run-llama/llama_index
A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle…
-
Medium 6.3CVE-2025-7083 EPSS 47%
Belkin F9K1122 webs mp os command injection
A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. This affects the function mp of the file /goform/mp of the component webs. The manipulation of the argument command leads to os command injection. It is possible to initi…
-
Medium 6.3CVE-2025-7082 EPSS 18%
Belkin F9K1122 webs formBSSetSitesurvey os command injection
A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this issue is the function formBSSetSitesurvey of the file /goform/formBSSetSitesurvey of the component webs. The manipulation of the argument wan_ipaddr/wan_netmask/w…
-
Medium 6.3CVE-2025-7081 EPSS 20%
Belkin F9K1122 webs formSetWanStatic os command injection
A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this vulnerability is the function formSetWanStatic of the file /goform/formSetWanStatic of the component webs. The manipulation of the argument m_wan_ipaddr/m_wa…