PatchTheCVEturms-im vulnerabilities
Recent CVEs affecting turms-im products. 5 tracked.
turms-im has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-12-19. Highest priority: CVE-2025-66909 (score 47/100).
- CVE-2025-66909 HIGH 7.5 DOWNGRADE Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vu
- CVE-2025-66908 MEDIUM 5.3 DOWNGRADE Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability i
- CVE-2025-66911 MEDIUM 6.5 DOWNGRADE Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online
- CVE-2025-66910 MEDIUM 6.0 DOWNGRADE Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administr
- CVE-2025-66906 MEDIUM 6.1 DOWNGRADE Cross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT allows attackers to g
FAQ
How do I fix turms-im vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is turms-im being exploited right now?
None of the tracked turms-im CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which turms-im CVE should I patch first?
CVE-2025-66909 currently ranks highest (47/100): Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vu.