PatchTheCVEturms vulnerabilities and fixes
Recent CVEs affecting turms, with upgrade or downgrade steps. 5 tracked.
turms has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-12-19. Highest priority: CVE-2025-66909 (score 47/100).
- CVE-2025-66909 HIGH 7.5 DOWNGRADE Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vu
- CVE-2025-66908 MEDIUM 5.3 DOWNGRADE Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability i
- CVE-2025-66911 MEDIUM 6.5 DOWNGRADE Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online
- CVE-2025-66910 MEDIUM 6.0 DOWNGRADE Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administr
- CVE-2025-66906 MEDIUM 6.1 DOWNGRADE Cross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT allows attackers to g
FAQ
How do I fix turms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is turms being exploited right now?
None of the tracked turms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which turms CVE should I patch first?
CVE-2025-66909 currently ranks highest (47/100): Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vu.