Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfiguration (allow_origins='*' with credentials) and a SameSite=None refresh token cookie. An attacker controlling a malicious webpage can steal authentication tokens and gain full access, including built-in code execution, leading to complete system compromise. This vulnerability is confirmed actively exploited (CISA KEV), with publicly available exploit code and a high EPSS score (17.62%), indicating widespread attack likelihood.
Array Networks ArrayOS AG before 9.4.5.9 contains an OS command injection vulnerability (CVE-2025-66644, CVSS 7.2) that has been actively exploited in the wild from August through December 2025. KEV-listed, this vulnerability in the VPN/SSL-VPN appliance enables authenticated attackers to execute arbitrary commands on the network edge device.
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed into the request header multimap via read_headers() in httplib.h (headers.emplace), then the server later appends its own internal metadata using the same header names in Server::process_request without erasing duplicates. Because Request::get_header_value returns the first entry for a header key (id == 0) and the client-supplied headers are parsed before server-inserted headers, downstream code that uses these header names may inadvertently use attacker-controlled values. Affected files/locations: cpp-httplib/httplib.h (read_headers, Server::process_request, Request::get_header_value, get_header_value_u64) and cpp-httplib/docker/main.cc (get_client_ip, nginx_access_logger, nginx_error_logger). Attack surface: attacker-controlled HTTP headers in incoming requests flow into the Request.headers multimap and into logging code that reads forwarded headers, enabling IP spoofing, log poisoning, and authorization bypass via header shadowing. This vulnerability is fixed in 0.27.0.
A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint.
ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page, resulting in remote code execution on the server.
A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2_api.SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation of the argument safe_dir results in command injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safe_dir leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.
A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this issue is the function zfilev2_api.OpenSafe of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation of the argument safe_dir causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 allows unauthenticated attackers to disclose the webserver's Python debug log file containing system information, credentials, paths, processes and command arguments running on the device. Attackers can access sensitive information by visiting the message_log page.
A remote code execution vulnerability in and script is not properly verified (CVSS 8.7). Risk factors: public PoC available.
Flexsense DiskBoss 11.7.28 allows unauthenticated attackers to elevate their privileges using any of its services, enabling remote code execution during startup or reboot with escalated privileges. Attackers can exploit the unquoted service path vulnerability by specifying a malicious service name in the 'sc qc' command, allowing them to execute arbitrary system commands.
Directory traversal vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store files in arbitrary locations and potentially modify the system configuration or other unspecified impacts.
Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads.
Flexsense DiskBoss 7.7.14 contains a local buffer overflow vulnerability in the 'Input Directory' component that allows unauthenticated attackers to execute arbitrary code on the system. Attackers can exploit this by pasting a specially crafted directory path into the 'Add Input Directory' field.
Flexsense DiskBoss 7.7.14 contains a local buffer overflow vulnerability in the 'Reports and Data Directory' field that allows an attacker to execute arbitrary code on the system.
The warehouse management system version 1.2 contains an arbitrary file read vulnerability. The endpoint `/file/showImageByPath` does not sanitize user-controlled path parameters. An attacker could exploit directory traversal to read arbitrary files on the server's file system. This could lead to the leakage of sensitive system information.
Flexsense DiskBoss 7.7.14 allows unauthenticated attackers to upload arbitrary files via /Command/Search Files/Directory field, leading to a denial of service by crashing the application.
A Buffer overflow vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint.
A stack buffer overflow vulnerability exists in the buffer_get function of duc, a disk management tool, where a condition can evaluate to true due to underflow, allowing an out-of-bounds read.
BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services. Prior to 1.5.0.rc2, The npdu_is_expected_reply function in src/bacnet/npdu.c indexes request_pdu[offset+2/3/5] and reply_pdu[offset+1/2/4] without verifying that those APDU bytes exist. bacnet_npdu_decode() can return offset == 2 for a 2-byte NPDU, so tiny PDUs pass the version check and then get read out of bounds. On ASan/MPU/strict builds this is an immediate crash (DoS). On unprotected builds it is undefined behavior and can mis-route replies; RCE is unlikely because only reads occur, but DoS is reliable.
Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Remote authentication bypass in Advantech WISE-DeviceOn Server allows unauthenticated attackers to forge JSON Web Tokens using a static HMAC secret, gaining full administrative control and the ability to execute arbitrary code on managed agents. With a CVSS score of 10.0, the vulnerability enables impersonation of any account, including the root super admin, if the attacker can guess a valid email address. No active exploitation has been reported at time of analysis, but the nature of the flaw makes exploitation trivial.
Authentication bypass in the User Verification plugin for WordPress (versions ≤2.0.39) allows unauthenticated attackers to log in as any user with a verified email address, including administrators, by submitting an empty OTP value. The flawed OTP comparison function fails to check if an OTP was actually generated, enabling complete account takeover. No active exploitation or public exploit is known, but the low-complexity network attack makes it a critical priority for affected sites.
We need to produce a JSON object with the specified fields, synthesizing all provided intelligence. Let's carefully process each piece. - CVE ID: CVE-2025-13313 - Description: CRM Memberships plugin for WordPress, privilege escalation via password reset, missing auth checks on ntzcrm_changepassword AJAX action, unauthenticated attackers can reset any user's password if they can obtain/enumerate target email. Also ntzcrm_get_users endpoint allows unauthenticated enumeration of subscriber emails. Versions up to 2.5 affected. CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-862 Missing Authorization. - EPSS: 0.29%, percentile 52%. - KEV: Not mentioned, so assume false. - Patch: In References, there is a changeset link: https://plugins.trac.wordpress.org/changeset/3464130/ — likely the fix. But no version number provided. The EUVD says affected versions "CRM Memberships * ≤2.5". So inferred that patched version would be above 2.5, maybe 2.5.1? Not stated explicitly. We'll note upstream fix available, patched version not independently confirmed. - Tags: Privilege Escalation, Authentication Bypass, WordPress - Reported by: security@wordfence.com (Wordfence) - CPE? Not explicitly provided, but EUVD gives affected product: CRM Memberships plugin for WordPress. We'll state product name as "CRM Memberships" (the plugin name). Product name field: "CRM Memberships" (since it's a WordPress plugin, we can say "CRM Memberships" — but it might be better to say "CRM Memberships plugin for WordPress"? The rule: 1-3 words ONLY. So "CRM Memberships" is fine. Or "CRM Memberships WordPress plugin"? That's 4 words. The rule: "product_name: '1-3 words ONLY. The specific product or service name affected.' So I'll go with "CRM Memberships". I'll add context in summary. Now, synthesize data: - summary: 2-3 sentences. Start with impact verb and product: "Privilege escalation in CRM Memberships WordPress plugin allows unauthenticated attackers to gain administrative access by resetting any user's password." Summarize: missing authorization on ntzcrm_changepassword AJAX action, requires knowing email, which can be enumerated via ntzcrm_get_users endpoint. EPSS 0.29% (low probability, but percentile 52% is average), no KEV, so not actively exploited widely. No POC mentioned? Not explicitly, but Wordfence might have a proof of concept? It says "Reported by Wordfence" and "Tags: Privilege Escalation, Authentication Bypass", but no explicit "POC available". So I'll assume no public exploit identified, but the vulnerability is described in detail, so someone could craft exploit. Since no KEV, I'll say "no public exploit identified" but given the simplicity, it's likely easy to exploit. However, I'll stick to available data. There's no POC flag, so "no public exploit identified at time of analysis". But Wordfence advisory might contain details. I'll just note that EPSS is low (0.29%) indicating low likelihood of exploitation despite high CVSS. Summary: "Privilege escalation in the CRM Memberships plugin for WordPress allows unauthenticated attackers to reset any user's password and seize account access. Exploitation requires a target's email address, obtainable via a separate unauthenticated user enumeration endpoint. The vulnerability affects all plugin versions up to 2.5 and carries a CVSS score of 9.8." - technical_context: Explain the underlying technology. CWE-862 Missing Authorization. The plugin exposes AJAX actions ntzcrm_changepassword and ntzcrm_get_users without proper capability checks. WordPress plugins often register AJAX hooks for both authenticated and unauthenticated users; here they likely used wp_ajax_nopriv_* without authorization. The plugin handles password reset via that endpoint, and missing checks allow any request to change a user's password. CPE not provided, but we can mention it's a WordPress plugin, identified by slug "crm-memberships". Include references to source code files. - risk_assessment: Compare CVSS (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with EPSS 0.29% (low probability). Not in KEV, so no known active exploitation. SSVC: exploitation status "none", automatable yes (since network vector, low complexity, no user interaction), technical impact total. So it's a high-priority risk for organizations using that plugin, because easy to exploit if plugin installed and email can be guessed. But EPSS suggests low real-world exploitation attempts. However, given the enumeration endpoint, it's likely to be exploited in targeted attacks. So risk assessment: "The CVSS 9.8 indicates critical severity with network attack vector, low complexity, no privileges or user interaction required. However, EPSS predicts only a 0.29% probability of exploitation in the next 30 days, placing it in the 52nd percentile, suggesting relatively low active exploitation likelihood. No active exploitation has been confirmed via CISA KEV. Given the ease of exploitation and the presence of a companion user enumeration endpoint, this vulnerability poses a serious risk to any unpatched WordPress site using the plugin, especially if email addresses of privileged users can be guessed or collected." No missing/conflicting data. - affected_products: "CRM Memberships plugin for WordPress versions up to and including 2.5. The plugin is available from the WordPress plugin repository (slug: crm-memberships). Wordfence advisory confirms affected versions ≤2.5." Provide reference link to Wordfence threat intel page. - remediation: "Update the CRM Memberships plugin to a patched version. The vendor has released a fix in SVN changeset 3464130, but the exact version number is not specified in available references. Administrators should upgrade to a version beyond 2.5 as soon as it becomes available. As a temporary workaround, disable the plugin entirely or use a Web Application Firewall rule to block unauthorized access to the wp-admin/admin-ajax.php endpoint with action parameters ntzcrm_changepassword and ntzcrm_get_users. Note that blocking these endpoints entirely may break plugin functionality." But we need to be careful: the changeset link points to the commit, so there is a fix committed. Wordfence advisory likely has a version patch? I'll check that link. The reference https://www.wordfence.com/threat-intel/vulnerabilities/id/e2837399-c44f-494e-bdc6-f9c6e4e2dc11?source=cve might indicate the fixed version. I can't access it, but from the data, it says affected up to 2.5. So possibly fixed in 2.5.1. I'll say: "The vendor has released a patched version, likely 2.5.1 or higher, via WordPress plugin repository. Immediate update is required." Then suggest workaround. I'll mention exact changeset. - exploit_scenario: "An attacker sends an unauthenticated AJAX request to wp-admin/admin-ajax.php with action=ntzcrm_get_users to enumerate subscriber emails, then uses a known or guessed Admin email to send another request with action=ntzcrm_changepassword, user_email=target, and new_password, resetting the password and gaining full access to the account." No POC mentioned, but scenario is clear. - exploitation_conditions: "The attacker must know or be able to guess a valid email address of a target user (which can be obtained via the ntzcrm_get_users endpoint if that endpoint is accessible). No authentication is required. The plugin must be active and vulnerable version ≤2.5 installed. The wp-admin/admin-ajax.php must be reachable (default for WordPress)." So condition: "Requires the targeted user's email address. The companion unauthenticated user enumeration endpoint facilitates this, but if that endpoint is blocked or disabled, attacker must obtain email through other means." So conditions: email address knowledge, plugin enabled, network access to AJAX endpoint. I'll phrase: "Exploitation requires the attacker to have or obtain the target user's email address, which is facilitated by the plugin's own unauthenticated user enumeration endpoint. No special configuration beyond default WordPress deployment is needed." - attack_chain: "Send request to ntzcrm_get_users endpoint → Enumerate subscriber email addresses → Identify admin user email → Send password reset request to ntzcrm_changepassword with target email and new password → Password changed → Log in as target user → Escalate privileges to administrator." But check phases: Recon (enumerate) → Delivery (send AJAX request) → Exploit (missing auth) → Impact (access). 7 steps: Recon → Delivery → Exploit → Install (maybe not) → C2 → Execute → Impact. Simpler: 5-step: Access → Delivery → Exploit → Execution → Impact. I'll do: "Access WordPress admin-ajax endpoint → Send enumeration request to ntzcrm_get_users → Extract admin email from response → Send password reset request to ntzcrm_changepassword with admin email and new password → Gain administrative access via login." That's 5 steps. - confidence_notes: "Vulnerability details confirmed by Wordfence advisory and NVD CVE record. Patch existence confirmed by SVN changeset 3464130, but fixed version number not independently verified. No known active exploitation (not in KEV). EPSS score is low but assessment may underestimate threat due to simplicity of exploit." Good. - prevalence: The CRM Memberships plugin: how popular? It's a WordPress plugin. I can check its install base: I'm not sure, but "CRM Memberships" is not a top plugin. It might have a few thousand active installs. I'd estimate low to medium. Since it's a niche membership plugin, I'll say "low". But I'll see: WordPress plugin directory can have installs; but without that data, I'll go with "low" because it's not a commonly used plugin like WooCommerce, Yoast, etc. So prevalence: low. Basis: "niche WordPress membership plugin with limited install base". If unknown, but I'll infer low from typical membership plugins. I'll output "low", basis: "specialized WordPress plugin with limited deployment footprint". - prevalence_basis: "niche WordPress membership plugin, not widely distributed" - assessed_cvss_vector: I'll produce my own CVSS 3.1 vector. The description says unauthenticated, via network, no user interaction, scope unchanged, impacts confidentiality, integrity, availability all high. So AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exactly same as provided. That's appropriate. So vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H". Rationale: "Unauthenticated network attack with no user interaction, complete compromise of user accounts." I'll check if any nuance: attacker can reset any password, leading to full account takeover, so C/H, I/H, A/H sensible. - assessed_cvss40_vector: CVSS 4.0 base. We need to map. Attack Vector: Network (AV:N), Attack Complexity: Low (AC:L), Attack Requirements: None (AT:N), Privileges Required: None (PR:N), User Interaction: None (UI:N). Scope? In CVSS 4.0, we have VC/VI/VA (vulnerable system impact) and SC/SI/SA (subsequent system impact). This is a web application, so vulnerable system is the WordPress instance. Attacker gains account access, leading to high impact on confidentiality, integrity, availability of that system. So VC:H/VI:H/VA:H. No subsequent system impact, so SC:N/SI:N/SA:N. So CVSS 4.0 vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N". That seems correct. Now, the final output. Ensure all fields are strings. I'll craft each paragraph. Note: The description says "privilege escalation via password reset" and "unauthenticated attackers to reset arbitrary user passwords and gain unauthorized access to user accounts". So that's clear. No KEV. EPSS 0.29%. I'll incorporate. Technical context: CWE-862 Missing Authorization. The plugin likely registers AJAX hooks using WordPress's wp_ajax_ and wp_ajax_nopriv_ actions. The ntzcrm_changepassword action is registered for both authenticated and unauthenticated users but lacks a capability check or nonce verification, allowing anyone to trigger password change. The companion ntzcrm_get_users endpoint similarly lacks authentication,
A security vulnerability in Nextcloud Calendar (CVSS 5.7). Risk factors: public PoC available. Vendor patch is available.
TUUI is a desktop MCP client designed as a tool unitary utility integration.
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
A security vulnerability in cpp-httplib (CVSS 5.3) that allows attacker-controlled http headers. Risk factors: public PoC available. Vendor patch is available.
A security vulnerability in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system commands.
zdh_web is a data collection, processing, monitoring, scheduling, and management platform. In zdh_web thru 5.6.17, insufficient validation of file upload paths in the application allows an authenticated user to write arbitrary files to the server file system, potentially overwriting existing files and leading to privilege escalation or remote code execution.
Arbitrary file upload vulnerability in the ContentStudio WordPress plugin enables remote code execution for authenticated attackers with Author-level or higher privileges. Missing file type validation in the cstu_update_post() function allows uploading of malicious files, affecting all versions up to 1.3.7. No active exploitation or public exploit code has been reported, and EPSS score is low at 0.35%.
The Auto Thumbnailer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadThumb() function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
The Featured Image via URL plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation function in all versions up to, and including, 0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce validation in the "Import Using CSV File" function. This makes it possible for unauthenticated attackers to elevate user privileges by creating arbitrary accounts with administrator privileges via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.
A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, leading to unauthorized access to data, lateral movement within the network, and access to backend systems. The Apigee hybrid versions below have all been updated to protect from this vulnerability: * Hybrid_1.11.2+ * Hybrid_1.12.4+ * Hybrid_1.13.3+ * Hybrid_1.14.1+ * OPDK_5202+ * OPDK_5300+
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1.
File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the filesystem.
The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.1321.
CVE-2025-58098 is a security vulnerability (CVSS 8.3). High severity vulnerability requiring prompt remediation.
yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1.
The My auctions allegro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.32 via the 'controller' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
The Cool Tag Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cool_tag_cloud' shortcode in all versions up to, and including, 2.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A security vulnerability in GitLab CE/EE affecting all (CVSS 7.7). High severity vulnerability requiring prompt remediation.
The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 3.6.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
A security vulnerability in version 1.0 and (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor patch is available.