CVE News Feed

• CVE-2025-53619 - Grassroot DICOM JPEGBITSCodec Out-of-Bounds Read Information Leak

  CVE ID :CVE-2025-53619
  Published : Dec. 16, 2025, 9:32 p.m. | 54 minutes ago
  Description :An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `null_convert` is called based of the value of the malicious DICOM file specifying the intended interpretation of the image pixel data
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-53618 - Grassroot DICOM JPEGBITSCodec Out-of-Bounds Read Information Leak

  CVE ID :CVE-2025-53618
  Published : Dec. 16, 2025, 9:32 p.m. | 54 minutes ago
  Description :An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `grayscale_convert` is called based of the value of the malicious DICOM file specifying the intended interpretation of the image pixel data
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-52582 - Grassroot DICOM Out-of-Bounds Read Vulnerability

  CVE ID :CVE-2025-52582
  Published : Dec. 16, 2025, 9:32 p.m. | 54 minutes ago
  Description :An out-of-bounds read vulnerability exists in the Overlay::GrabOverlayFromPixelData functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-48429 - Grassroot DICOM Out-of-Bounds Read

  CVE ID :CVE-2025-48429
  Published : Dec. 16, 2025, 9:32 p.m. | 54 minutes ago
  Description :An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to leaking heap data. An attacker can provide a malicious file to trigger this vulnerability.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-14466 - Güralp Systems Fortimus Series, Minimus Series, and Certimus Series have an Allocation of Resources Without Limits or Throttling vulnerability

  CVE ID :CVE-2025-14466
  Published : Dec. 16, 2025, 9:31 p.m. | 55 minutes ago
  Description :A vulnerability in the web interface of the Güralp Fortimus Series, Minimus Series and Certimus Series allows an unauthenticated attacker with network access to send specially-crafted HTTP requests that can cause the web service process to deliberately restart. Although this mechanism limits the impact of the attack, it results in a brief denial-of-service condition during the restart.
  Severity: 6.9 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-8872 - A specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted

  CVE ID :CVE-2025-8872
  Published : Dec. 16, 2025, 8:15 p.m. | 2 hours, 11 minutes ago
  Description :On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted. This may cause disruption in the OSFPv3 routes on the switch. This issue was discovered internally by Arista and is not aware of any malicious uses of this issue in customer networks.
  Severity: 6.5 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-65834 - Shotcut Buffer Overflow

  CVE ID :CVE-2025-65834
  Published : Dec. 16, 2025, 8:15 p.m. | 2 hours, 11 minutes ago
  Description :Meltytech Shotcut 25.10.31 is vulnerable to Buffer Overflow. A memory access violation occurs when processing MLT project files with manipulated width and height parameters. By setting these values to extremely large numbers, the application attempts to allocate excessive memory during image processing, triggering a buffer overflow in the mlt_image_fill_white function.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-13532 - Weak Password Hash in Core Privileged Access Manager (BoKS)

  CVE ID :CVE-2025-13532
  Published : Dec. 16, 2025, 8:15 p.m. | 2 hours, 11 minutes ago
  Description :Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms.  This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.
  Severity: 6.2 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-68270 - CourseLimitedStaff Role Allows Studio Access

  CVE ID :CVE-2025-68270
  Published : Dec. 16, 2025, 7:16 p.m. | 3 hours, 11 minutes ago
  Description :The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to access and edit courses in studio if they are granted the role on an org rather than on a course, and CourseLimitedStaffRole users are able to list courses they have the role on in studio even though they are not meant to have any access on the studio side for the course. Commit 05d0d0936daf82c476617257aa6c35f0cd4ca060 fixes the issue.
  Severity: 9.9 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-68156 - Expr has Denial of Service via Unbounded Recursion in Builtin Functions

  CVE ID :CVE-2025-68156
  Published : Dec. 16, 2025, 7:16 p.m. | 3 hours, 11 minutes ago
  Description :Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation environment contains deeply nested or cyclic data structures, these functions may recurse indefinitely until exceed the Go runtime stack limit. This results in a stack overflow panic, causing the host application to crash. While exploitability depends on whether an attacker can influence or inject cyclic or pathologically deep data into the evaluation environment, this behavior represents a denial-of-service (DoS) risk and affects overall library robustness. Instead of returning a recoverable evaluation error, the process may terminate unexpectedly. In affected versions, evaluation of expressions that invoke certain builtin functions on untrusted or insufficiently validated data structures can lead to a process-level crash due to stack exhaustion. This issue is most relevant in scenarios where Expr is used to evaluate expressions against externally supplied or dynamically constructed environments; cyclic references (directly or indirectly) can be introduced into arrays, maps, or structs; and there are no application-level safeguards preventing deeply nested input data. In typical use cases with controlled, acyclic data, the issue may not manifest. However, when present, the resulting panic can be used to reliably crash the application, constituting a denial of service. The issue has been fixed in the v1.17.7 versions of Expr. The patch introduces a maximum recursion depth limit for affected builtin functions. When this limit is exceeded, evaluation aborts gracefully and returns a descriptive error instead of panicking. Additionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing applications with legitimate deep structures to raise the limit in a controlled manner. Users are strongly encouraged to upgrade to the patched release, which includes both the recursion guard and comprehensive test coverage to prevent regressions. For users who cannot immediately upgrade, some mitigations are recommended. Ensure that evaluation environments cannot contain cyclic references, validate or sanitize externally supplied data structures before passing them to Expr, and/or wrap expression evaluation with panic recovery to prevent a full process crash (as a last-resort defensive measure). These workarounds reduce risk but do not fully eliminate the issue without the patch.
  Severity: 7.5 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-68155 - @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development

  CVE ID :CVE-2025-68155
  Published : Dec. 16, 2025, 7:16 p.m. | 3 hours, 11 minutes ago
  Description :@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plugin-rsc` allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a `file://` URL in the `filename` query parameter. Version 0.5.8 fixes the issue.
  Severity: 7.5 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-68154 - Command Injection in fsSize() on Windows

  CVE ID :CVE-2025-68154
  Published : Dec. 16, 2025, 7:16 p.m. | 3 hours, 11 minutes ago
  Description :systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.
  Severity: 8.1 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-68150 - Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter

  CVE ID :CVE-2025-68150
  Published : Dec. 16, 2025, 7:16 p.m. | 3 hours, 11 minutes ago
  Description :Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.2 and 9.1.1-alpha.1, the Instagram authentication adapter allows clients to specify a custom API URL via the `apiURL` parameter in `authData`. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users. This is fixed in versions 8.6.2 and 9.1.1-alpha.1 by hardcoding the Instagram Graph API URL `https://graph.instagram.com` and ignoring client-provided `apiURL` values. No known workarounds are available.
  Severity: 8.3 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-68146 - filelock has TOCTOU race condition that allows symlink attacks during lock file creation

  CVE ID :CVE-2025-68146
  Published : Dec. 16, 2025, 7:15 p.m. | 3 hours, 11 minutes ago
  Description :filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation where filelock checks if a file exists before opening it with O_TRUNC. An attacker can create a symlink pointing to a victim file in the time gap between the check and open, causing os.open() to follow the symlink and truncate the target file. All users of filelock on Unix, Linux, macOS, and Windows systems are impacted. The vulnerability cascades to dependent libraries. The attack requires local filesystem access and ability to create symlinks (standard user permissions on Unix; Developer Mode on Windows 10+). Exploitation succeeds within 1-3 attempts when lock file paths are predictable. The issue is fixed in version 3.20.1. If immediate upgrade is not possible, use SoftFileLock instead of UnixFileLock/WindowsFileLock (note: different locking semantics, may not be suitable for all use cases); ensure lock file directories have restrictive permissions (chmod 0700) to prevent untrusted users from creating symlinks; and/or monitor lock file directories for suspicious symlinks before running trusted applications. These workarounds provide only partial mitigation. The race condition remains exploitable. Upgrading to version 3.20.1 is strongly recommended.
  Severity: 6.3 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-65593 - nopCommerce CSRF Vulnerability in Schedule Tasks

  CVE ID :CVE-2025-65593
  Published : Dec. 16, 2025, 7:15 p.m. | 3 hours, 11 minutes ago
  Description :nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-65592 - nopCommerce XSS Stored

  CVE ID :CVE-2025-65592
  Published : Dec. 16, 2025, 7:15 p.m. | 3 hours, 11 minutes ago
  Description :nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-65591 - nopCommerce Cross Site Scripting (XSS)

  CVE ID :CVE-2025-65591
  Published : Dec. 16, 2025, 7:15 p.m. | 3 hours, 11 minutes ago
  Description :nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.
  Severity: 5.4 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-65590 - nopCommerce XSS Vulnerability

  CVE ID :CVE-2025-65590
  Published : Dec. 16, 2025, 7:15 p.m. | 3 hours, 11 minutes ago
  Description :nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area.
  Severity: 5.4 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-14553 - Password Hash Leak Could Lead to Unauthorized Access on Tapo 210 via Local Network

  CVE ID :CVE-2025-14553
  Published : Dec. 16, 2025, 7:15 p.m. | 3 hours, 11 minutes ago
  Description :Exposure of password hashes through an unauthenticated API response in TP-Link Tapo C210 V.1.8 app on iOS and Android, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged.
  Severity: 7.0 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-68142 - PyMdown Extensions has ReDOS bug in Figure Capture extension

  CVE ID :CVE-2025-68142
  Published : Dec. 16, 2025, 6:16 p.m. | 4 hours, 11 minutes ago
  Description :PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to 10.16.1 have a ReDOS bug found within the figure caption extension (`pymdownx.blocks.caption`). In systems that take unchecked user content, this could cause long hanges when processing the data if a malicious payload was crafted. This issue is patched in Release 10.16.1. As a workaround, those who process unknown user content without timeouts or other safeguards in place to prevent really large, malicious content being aimed at systems may avoid the use of `pymdownx.blocks.caption` until they're able to upgrade.
  Severity: 2.7 | LOW
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...