CVEs.

Matching CVEs

1. 2.4Low

   CVE-2025-13743 ↗ (opens in a new tab)

   Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization. This poses a risk of leaking sensitive information in exported diagnostics, especially when access denied errors occurred.

   DODocker· Dec 9, 2025

2. 2.3Low

   CVE-2025-14345 ↗ (opens in a new tab)

   A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact. This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 ver

   MAMongoDB Atlas· Dec 9, 2025

3. 3.3Low

   CVE-2025-33200 ↗ (opens in a new tab)

   NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to information disclosure.

   NVNVIDIA· Nov 25, 2025

4. 3.8Low

   CVE-2025-33199 ↗ (opens in a new tab)

   NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior. A successful exploit of this vulnerability might lead to data tampering.

   NVNVIDIA· Nov 25, 2025

5. 3.3Low

   CVE-2025-33198 ↗ (opens in a new tab)

   NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to information disclosure.

   NVNVIDIA· Nov 25, 2025

6. 2.3Low

   CVE-2025-13643 ↗ (opens in a new tab)

   A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB Server v8.0 versions prior to 8.0.14

   MAMongoDB Atlas· Nov 25, 2025

7. 2.3Low

   CVE-2025-12893 ↗ (opens in a new tab)

   Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems. Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present s

   MAMongoDB Atlas· Nov 25, 2025

8. 3.5Low

   CVE-2025-55074 ↗ (opens in a new tab)

   Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects

   MCMattermost Cloud· Nov 18, 2025

9. 3.5Low

   CVE-2025-6945 ↗ (opens in a new tab)

   GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.

   GIGitLab· Nov 15, 2025

10. 3.5Low

    CVE-2025-11990 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.

    GIGitLab· Nov 15, 2025

11. 1.1Low

    CVE-2025-4617 ↗ (opens in a new tab)

    An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin user to bypass the screenshot control feature of the browser. Browser self-protection should be enabled to mitigate this issue.

    PAPalo Alto Networks· Nov 14, 2025

12. 1.1Low

    CVE-2025-4616 ↗ (opens in a new tab)

    An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert the browser’s security controls.

    PAPalo Alto Networks· Nov 14, 2025

13. 2.1Low

    CVE-2025-41116 ↗ (opens in a new tab)

    When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being returned. This issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0

    GCGrafana Cloud· Nov 11, 2025

14. 2.1Low

    CVE-2025-3717 ↗ (opens in a new tab)

    When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being returned. This issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1.

    GCGrafana Cloud· Nov 11, 2025

15. 3.7Low

    CVE-2025-54499 ↗ (opens in a new tab)

    Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets

    MCMattermost Cloud· Oct 16, 2025

16. 2.3Low

    CVE-2025-59829 ↗ (opens in a new tab)

    Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied Claude Code access to a file and Claude Code had access to a symlink pointing to that file, it was possible for Claude Code to access the file. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.120.

    ANAnthropic (Claude)· Oct 3, 2025

17. 2.4Low

    CVE-2025-23291 ↗ (opens in a new tab)

    NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to information disclosure.

    NVNVIDIA· Sep 30, 2025

18. 3.3Low

    CVE-2025-23346 ↗ (opens in a new tab)

    NVIDIA CUDA Toolkit contains a vulnerability in cuobjdump, where an unprivileged user can cause a NULL pointer dereference. A successful exploit of this vulnerability may lead to a limited denial of service.

    NVNVIDIA· Sep 24, 2025

19. 3.3Low

    CVE-2025-23340 ↗ (opens in a new tab)

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability may lead to a partial denial of service.

    NVNVIDIA· Sep 24, 2025

20. 3.3Low

    CVE-2025-23271 ↗ (opens in a new tab)

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability may lead to a partial denial of service.

    NVNVIDIA· Sep 24, 2025

21. 3.3Low

    CVE-2025-23255 ↗ (opens in a new tab)

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary where a user may cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability may lead to a partial denial of service.

    NVNVIDIA· Sep 24, 2025

22. 3.3Low

    CVE-2025-23248 ↗ (opens in a new tab)

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability may lead to a partial denial of service.

    NVNVIDIA· Sep 24, 2025

23. 2.4Low

    CVE-2025-4234 ↗ (opens in a new tab)

    A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.

    PAPalo Alto Networks· Sep 12, 2025

24. 1.3Low

    CVE-2025-9799 ↗ (opens in a new tab)

    A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited.

    LALangfuse· Sep 1, 2025

25. 3.8Low

    CVE-2025-53971 ↗ (opens in a new tab)

    Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint.

    MCMattermost Cloud· Aug 21, 2025

26. 3.5Low

    CVE-2025-47700 ↗ (opens in a new tab)

    Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions

    MCMattermost Cloud· Aug 21, 2025

27. 3.7Low

    CVE-2025-53857 ↗ (opens in a new tab)

    Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint.

    MCMattermost Cloud· Aug 11, 2025

28. 3.7Low

    CVE-2025-49221 ↗ (opens in a new tab)

    Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to access subscription details without via API call to GET subscription endpoint.

    MCMattermost Cloud· Aug 11, 2025

29. 2.5Low

    CVE-2025-23290 ↗ (opens in a new tab)

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a guest could get global GPU metrics which may be influenced by work in other VMs. A successful exploit of this vulnerability might lead to information disclosure.

    NVNVIDIA· Aug 2, 2025

30. 3.3Low

    CVE-2025-23288 ↗ (opens in a new tab)

    NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may cause an exposure of sensitive system information with local unprivileged system access. A successful exploit of this vulnerability may lead to Information disclosure.

    NVNVIDIA· Aug 2, 2025

31. 3.3Low

    CVE-2025-23287 ↗ (opens in a new tab)

    NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may access sensitive system-level information. A successful exploit of this vulnerability may lead to Information disclosure.

    NVNVIDIA· Aug 2, 2025

32. 3.7Low

    CVE-2025-6011 ↗ (opens in a new tab)

    A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 1, 2025

33. 2.7Low

    CVE-2025-7001 ↗ (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed priviledged users to access certain resource_group information through the API which should have been unavailable.

    GIGitLab· Jul 24, 2025

34. 3.1Low

    CVE-2025-6227 ↗ (opens in a new tab)

    Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.

    MCMattermost Cloud· Jul 18, 2025

35. 3.5Low

    CVE-2025-49462 ↗ (opens in a new tab)

    Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information via network access.

    ZOZoom· Jul 10, 2025

36. 2.7Low

    CVE-2025-6168 ↗ (opens in a new tab)

    An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests.

    GIGitLab· Jul 10, 2025

37. 2.7Low

    CVE-2025-4972 ↗ (opens in a new tab)

    An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated users with invitation privileges to bypass group-level user invitation restrictions by manipulating group invitation functionality.

    GIGitLab· Jul 10, 2025

38. 3.3Low

    CVE-2025-49756 ↗ (opens in a new tab)

    Use of a broken or risky cryptographic algorithm in Office Developer Platform allows an authorized attacker to bypass a security feature locally.

    M3Microsoft 365· Jul 8, 2025

39. 3.1Low

    CVE-2025-49731 ↗ (opens in a new tab)

    Improper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a network.

    M3Microsoft 365· Jul 8, 2025

40. 3.5Low

    CVE-2025-3777 ↗ (opens in a new tab)

    Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.

    HFHugging Face· Jul 7, 2025

41. 2.1Low

    CVE-2025-7074 ↗ (opens in a new tab)

    A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1. This affects the function expand/braceExpand/ignoreMap of the file hyper/bin/rimraf-standalone.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

    VEVercel· Jul 5, 2025

42. 3.7Low

    CVE-2025-49005 ↗ (opens in a new tab)

    Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache ke

    VEVercel· Jul 3, 2025

43. 1.2Low

    CVE-2025-6624 ↗ (opens in a new tab)

    Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode. The issue affects the following Snyk commands: 1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials

    SNSnyk· Jun 26, 2025

44. 3.1Low

    CVE-2025-4656 ↗ (opens in a new tab)

    Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

    HAHashiCorp (HCP / Terraform Cloud)· Jun 25, 2025

45. 2.7Low

    CVE-2025-1088 ↗ (opens in a new tab)

    In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

    GCGrafana Cloud· Jun 18, 2025

46. 2.1Low

    CVE-2025-21085 ↗ (opens in a new tab)

    PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization.

    PIPing Identity· Jun 15, 2025

47. 1.0Low

    CVE-2025-4227 ↗ (opens in a new tab)

    An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto Networks GlobalProtect™ app allows certain packets to remain unencrypted instead of being properly secured within the tunnel. An attacker with physical access to the network can inject rogue devices to intercept these packets. Under normal operating conditions, the GlobalProtect app automatically recovers from this interception within one

    PAPalo Alto Networks· Jun 13, 2025

48. 2.1Low

    CVE-2025-5895 ↗ (opens in a new tab)

    A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue.

    MCMetabase Cloud· Jun 9, 2025

49. 3.1Low

    CVE-2025-1792 ↗ (opens in a new tab)

    Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.

    MCMattermost Cloud· May 30, 2025

50. 2.3Low

    CVE-2025-48068 ↗ (opens in a new tab)

    Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.

    VEVercel· May 30, 2025