CVE-2025-54470

This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server. In affected versions, NeuVector does not enforce TLS certificate verification when transmitting anonymous cluster data to the telemetry server. As a result, the communication channel is susceptible to man-in-the-middle (MITM) attacks, where an attacker could intercept or modify the transmitted data. Additionally, NeuVector loads the response of the telemetry server is loaded into memory without size limitation, which makes it vulnerable to a Denial of Service(DoS) attack

• CWE-295

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54470
• https://github.com/neuvector/neuvector/security/advisories/GHSA-qqj3-g7mx-5p4w

Published

Oct 30, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54465This vulnerability exists in ZKTeco WL20 due to hard-coded M…6.8
• CVE-2025-54466Improper Control of Generation of Code ('Code Injection') vu…9.8
• CVE-2025-54467When a Java command with password parameters is executed and…5.3
• CVE-2025-54468A vulnerability has been identified within Rancher Manager w…4.7
• CVE-2025-54469A vulnerability was identified in NeuVector, where the enfor…9.9
• CVE-2025-5447A vulnerability was found in Linksys RE6500, RE6250, RE6300,…9.8
• CVE-2025-54471NeuVector used a hard-coded cryptographic key embedded in th…6.5
• CVE-2025-54472Unlimited memory allocation in redis protocol parser in Apac…7.5
• CVE-2025-54473An authenticated RCE vulnerability in Phoca Commander compon…9.2
• CVE-2025-54474A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.…8.5
• CVE-2025-54475A SQL injection vulnerability in the JS Jobs plugin versions…8.7
• CVE-2025-54476Improper handling of input could lead to an XSS vector in th…4.8