Turms-im

Records5All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Turms-im records in CISA KEV

No Turms-im vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

5 records

TI-2025-41080 CVE-2025-66909 · GHSA-2f87-396w-g74p

HIGH 72

Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00527 Published 2025-12-19 No fix listed CWE-409

TI-2025-41079 CVE-2025-66908 · GHSA-rxfw-3x38-vmhv

MEDIUM 63

Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00436 Published 2025-12-19 No fix listed CWE-434

TI-2025-41082 CVE-2025-66911 · GHSA-9r66-8r5r-2mqr

MEDIUM 62

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00332 Published 2025-12-19 No fix listed CWE-284

TI-2025-41081 CVE-2025-66910 · GHSA-jrq2-rj4w-rhc5

MEDIUM 60

Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system.

CVSS 3.1MEDIUM 6.0 Local High privileges No interaction EPSS 0.00223 Published 2025-12-19 No fix listed CWE-256

TI-2025-41078 CVE-2025-66906 · GHSA-6jch-g84g-hpwx

MEDIUM 60

Cross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT allows attackers to gain escalated privileges.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00134 Published 2025-12-19 No fix listed CWE-352