Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
motely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312639 - https://vuldb.com/?ctiid.312639 - https://vuldb.com/?submit.593602 - https://github.com/awindog/cve/blob/main/688/10.md - https://github.com/awindog/cve/blob/main/688/10.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-6165 State: PUBLISHED Published: 2025-06-17T06:00:17.223Z Last Updated: 2025-06-17T13:34:15.579Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: X15 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formTmultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312640 - https://vuldb.com/?ctiid.312640 - https://vuldb.com/?submit.593603 - https://github.com/awindog/cve/blob/main/688/11.md - https://github.com/awindog/cve/blob/main/688/11.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-6166 State: PUBLISHED Published: 2025-06-17T06:00:19.953Z Last Updated: 2025-06-17T13:32:35.728Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C) Vendors: frdel Products: Agent-Zero Problem Types: CWE-22 Description: A vulnerability was found in frdel Agent-Zero up to 0.8.4. It has been rated as problematic. This issue affects the function image_get of the file /python/api/image_get.py. The manipulation of the argument path leads to path traversal. Upgrading to version 0.8.4.1 is able to address this issue. The identifier of the patch is 5db74202d632306a883ccce7339c5bdba0d16c5a. It is recommended to upgrade the affected component. Additiona
of the patch is 5db74202d632306a883ccce7339c5bdba0d16c5a. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312641 - https://vuldb.com/?ctiid.312641 - https://vuldb.com/?submit.593611 - https://github.com/frdel/agent-zero/issues/383 - https://github.com/frdel/agent-zero/issues/383#issuecomment-2893239897 - https://github.com/frdel/agent-zero/commit/5db74202d632306a883ccce7339c5bdba0d16c5a - https://github.com/frdel/agent-zero/releases/tag/v0.8.4.1
CVE ID: CVE-2025-6167 State: PUBLISHED Published: 2025-06-17T06:31:05.717Z Last Updated: 2025-06-17T14:16:51.239Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C) Vendors: themanojdesai Products: python-a2a Problem Types: CWE-22 Description: A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/agent_flow/server/api.py. The manipulation leads to path traversal. Upgrading to version 0.5.6 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
ed to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312642 - https://vuldb.com/?ctiid.312642 - https://vuldb.com/?submit.593613 - https://github.com/themanojdesai/python-a2a/issues/40 - https://github.com/themanojdesai/python-a2a/issues/40#issuecomment-2904804388 - https://github.com/themanojdesai/python-a2a/releases/tag/v0.5.6
CVE ID: CVE-2025-6168 State: PUBLISHED Published: 2025-07-10T08:30:54.721Z Last Updated: 2025-07-10T20:08:14.880Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/549725 - https://hackerone.com/reports/3196745
CVE ID: CVE-2025-6169 State: PUBLISHED Published: 2025-06-16T06:12:11.767Z Last Updated: 2025-06-16T18:39:09.209Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HAMASTAR Technology Products: WIMP Problem Types: CWE-89 Description: The WIMP website co-construction management platform from HAMASTAR Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10183-99ce1-1.html - https://www.twcert.org.tw/en/cp-139-10184-f29ca-2.html
CVE ID: CVE-2025-6170 State: PUBLISHED Published: 2025-06-16T15:24:05.410Z Last Updated: 2025-11-07T00:42:09.049Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Core Services, Red Hat OpenShift Container Platform 4 Problem Types: CWE-121 Description: A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might
n overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2025-6170 - https://bugzilla.redhat.com/show_bug.cgi?id=2372952
CVE ID: CVE-2025-6171 State: PUBLISHED Published: 2025-11-15T08:04:24.736Z Last Updated: 2025-11-17T20:15:16.095Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker with reporter access to view branch names and pipeline details by accessing the packages API endpoint even when repository access was disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/11/12/pa
sabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/549730 - https://hackerone.com/reports/3183740
CVE ID: CVE-2025-6172 State: PUBLISHED Published: 2025-06-16T08:41:53.640Z Last Updated: 2025-06-16T16:14:46.604Z Vendors: TECNO Products: com.afmobi.boomplayer Problem Types: CWE-287 Description: Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.tecno.com/SRC/blogdetail/424?lang=en_US - https://security.tecno.com/SRC/securityUpdates
CVE ID: CVE-2025-6173 State: PUBLISHED Published: 2025-06-17T06:31:07.243Z Last Updated: 2025-06-17T15:00:14.160Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Webkul Products: QloApps Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_products_list.php. The manipulation of the argument packItself leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this flaw but considers it a low-level issue due to admin p
public and may be used. The vendor confirms the existence of this flaw but considers it a low-level issue due to admin privilege pre-requisites. Still, a fix is planned for a future release. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312661 - https://vuldb.com/?ctiid.312661 - https://vuldb.com/?submit.593679 - https://github.com/caigo8/CVE-md/blob/main/QloApps/SQL_Injection.md - https://github.com/caigo8/CVE-md/blob/main/QloApps/SQL_Injection.md#vulnerability-recurrence
CVE ID: CVE-2025-6174 State: PUBLISHED Published: 2025-07-23T06:00:09.900Z Last Updated: 2025-07-23T15:14:02.528Z Vendors: Unknown Products: Qwizcards | online quizzes and flashcards Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "_stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ff827f67-712e-4ab6-b6aa-7f5e6ff1283a/
CVE ID: CVE-2025-6175 State: PUBLISHED Published: 2025-07-29T12:22:21.551Z Last Updated: 2025-07-29T13:26:13.211Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: DECE Software Products: Geodi Problem Types: CWE-93 Description: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in DECE Software Geodi allows HTTP Request Splitting.This issue affects Geodi: before GEODI Setup 9.0.146. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0182
CVE ID: CVE-2025-6176 State: PUBLISHED Published: 2025-10-31T00:00:21.219Z Last Updated: 2025-10-31T16:21:32.237Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: scrapy Products: scrapy/scrapy Problem Types: CWE-400 Description: Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consu
urs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0
CVE ID: CVE-2025-6177 State: PUBLISHED Published: 2025-06-16T16:43:44.191Z Last Updated: 2025-06-17T03:55:13.297Z Vendors: Google Products: ChromeOS Problem Types: Privilege Escalation Description: Privilege Escalation in MiniOS in Google ChromeOS (16063.45.2 and potentially others) on enrolled devices allows a local attacker to gain root code execution via exploiting a debug shell (VT3 console) accessible through specific key combinations during developer mode entry and MiniOS access, even when developer mode is blocked by device policy or Firmware Write Protect (FWMP). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/issues/382540412 - https:
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/issues/382540412 - https://issues.chromium.org/issues/b/382540412
CVE ID: CVE-2025-6179 State: PUBLISHED Published: 2025-06-16T16:56:37.722Z Last Updated: 2025-06-17T14:01:39.842Z Vendors: Google Products: ChromeOS Problem Types: Permissions Bypass / Privilege Escalation Description: Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and access Developer Mode, including loading additional extensions via exploiting vulnerabilities using the ExtHang3r and ExtPrint3r tools. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/issues/399652193 - https://issues.chromium.org/issues/b/399652193
CVE ID: CVE-2025-6180 State: PUBLISHED Published: 2025-08-20T16:41:25.007Z Last Updated: 2025-08-20T18:48:02.726Z Vendors: StrongDM Products: sdm-cli Problem Types: CWE-319 Description: The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, potentially redeeming valid authentication credentials through a race condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed
CVE ID: CVE-2025-6181 State: PUBLISHED Published: 2025-08-20T16:43:39.672Z Last Updated: 2025-08-20T17:40:33.167Z Vendors: StrongDM Products: sdm-cli Problem Types: CWE-78 Description: The StrongDM Windows service incorrectly handled input validation. Authenticated attackers could potentially exploit this leading to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed
CVE ID: CVE-2025-6182 State: PUBLISHED Published: 2025-08-20T16:44:26.884Z Last Updated: 2025-08-20T17:39:08.716Z Vendors: StrongDM Products: sdm Problem Types: CWE-269 Description: The StrongDM Windows service incorrectly handled communication related to system certificate management. Attackers could exploit this behavior to install untrusted root certificates or remove trusted ones. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed
CVE ID: CVE-2025-6183 State: PUBLISHED Published: 2025-08-20T16:45:06.921Z Last Updated: 2025-08-20T17:37:15.296Z Vendors: StrongDM Products: sdm-cli Problem Types: CWE-78 Description: The StrongDM macOS client incorrectly processed JSON-formatted messages. Attackers could potentially modify macOS system configuration by crafting a malicious JSON message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed
CVE ID: CVE-2025-6184 State: PUBLISHED Published: 2025-08-13T06:39:49.597Z Last Updated: 2025-08-13T13:28:50.513Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themeum Products: Tutor LMS Pro Problem Types: CWE-89 Description: The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Tutor-level access an
nt preparation on the existing SQL query. This makes it possible for authenticated attackers, with Tutor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only the Pro version is affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4b41d134-be9e-469f-b26b-ac30d95db0a3?source=cve - https://tutorlms.com/ - https://wordpress.org/plugins/tutor/#developers
CVE ID: CVE-2025-6185 State: PUBLISHED Published: 2025-07-17T23:14:44.200Z Last Updated: 2025-07-18T13:55:42.662Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: Leviton Products: AcquiSuite, Energy Monitoring Hub Problem Types: CWE-79 Description: Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URL parameters, which would execute in a client browser when accessed by a user, steal session tokens, and control the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-198-01 - ht
nalyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-198-01 - https://leviton.com/support/resources/product-support
CVE ID: CVE-2025-6186 State: PUBLISHED Published: 2025-08-13T17:26:35.507Z Last Updated: 2025-08-13T20:36:52.358Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/549844 - https://hackerone.com/reports/3189522
CVE ID: CVE-2025-6187 State: PUBLISHED Published: 2025-07-22T09:22:44.548Z Last Updated: 2025-07-22T20:04:06.430Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: bsecuretech Products: bSecure – Your Universal Checkout Problem Types: CWE-862 Description: The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its order_info REST endpoint in versions 1.3.7 through 1.7.9. The plugin registers the /webhook/v2/order_info/ route with a permission_callback that always returns true, effectively bypassing all authentication. This makes it possible for unauthenticated attackers who know any user’s email to obtain a
ypassing all authentication. This makes it possible for unauthenticated attackers who know any user’s email to obtain a valid login cookie and fully impersonate that account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f51029-0748-4943-b0ef-fc822b14614a?source=cve - https://wordpress.org/plugins/bsecure/#developers - https://plugins.trac.wordpress.org/browser/bsecure/tags/1.7.9/includes/class-bsecure-checkout.php - https://plugins.trac.wordpress.org/browser/bsecure/tags/1.7.9/includes/class-wc-bsecure.php
CVE ID: CVE-2025-6188 State: PUBLISHED Published: 2025-08-25T20:14:23.427Z Last Updated: 2025-08-27T14:53:30.181Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Arista Networks Products: EOS Problem Types: 288 Description: On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpected behaviors, especially for UDP based services that do not perform some form of authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/22021-securi
CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/22021-security-advisory-0121
CVE ID: CVE-2025-6189 State: PUBLISHED Published: 2025-09-10T06:38:46.056Z Last Updated: 2025-09-10T16:11:03.470Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: arjunthakur Products: Duplicate Page and Post Problem Types: CWE-89 Description: The Duplicate Page and Post plugin for WordPress is vulnerable to time-based SQL Injection via the ‘meta_key’ parameter in all versions up to, and including, 2.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into alread
sible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4120c8e6-e162-4adf-890c-8070e5009748?source=cve - https://plugins.trac.wordpress.org/browser/duplicate-wp-page-post/trunk/duplicate-wp-page-post.php - https://wordpress.org/plugins/duplicate-wp-page-post/#developers
CVE ID: CVE-2025-6190 State: PUBLISHED Published: 2025-07-23T02:24:38.989Z Last Updated: 2025-07-23T18:28:55.839Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: nootheme Products: Realty Portal – Agent Problem Types: CWE-862 Description: The Realty Portal – Agent plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the rp_user_profile() AJAX handler in versions 0.1.0 through 0.3.9. The handler reads the client-supplied meta key and value pairs from $_POST and passes them directly to update_user_meta() without restricting to a safe whitelist. This makes it possible for authenticated attackers, with Subscriber-level acc
) without restricting to a safe whitelist. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the wp_capabilities meta and grant themselves the administrator role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3adfe9e-ebdf-4a50-b60f-03a606a84ec0?source=cve - https://plugins.trac.wordpress.org/browser/realty-portal-agent/trunk/includes/class-agent-process.php#L494 - https://wordpress.org/plugins/realty-portal-agent/
CVE ID: CVE-2025-6191 State: PUBLISHED Published: 2025-06-18T18:16:36.095Z Last Updated: 2025-06-19T03:55:08.857Z Vendors: Google Products: Chrome Problem Types: CWE-472 Description: Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_17.html - https://issues.chromium.org/issues/420697404
CVE ID: CVE-2025-6192 State: PUBLISHED Published: 2025-06-18T18:16:36.481Z Last Updated: 2025-06-19T03:55:09.983Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_17.html - https://issues.chromium.org/issues/421471016
CVE ID: CVE-2025-6193 State: PUBLISHED Published: 2025-06-20T15:54:13.855Z Last Updated: 2025-11-18T21:22:54.721Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat OpenShift AI (RHOAI) Problem Types: CWE-78 Description: A command injection vulnerability was discovered in the TrustyAI Explainability toolkit. Arbitrary commands placed in certain fields of a LMEValJob custom resource (CR) may be executed in the LMEvalJob pod's terminal. This issue can be exploited via a maliciously crafted LMEvalJob by a user with permissions to deploy a CR. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/securi
ssions to deploy a CR. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-6193 - https://bugzilla.redhat.com/show_bug.cgi?id=2374032 - https://github.com/trustyai-explainability/trustyai-service-operator/pull/504