Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1767 State: PUBLISHED Published: 2025-03-13T16:40:42.663Z Last Updated: 2025-03-17T16:59:37.276Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Kubernetes Products: Kubelet Problem Types: CWE-20 Description: This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kubernetes/kubernet
al Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/pull/130786 - https://groups.google.com/g/kubernetes-security-announce/c/19irihsKg7s
CVE ID: CVE-2025-1768 State: PUBLISHED Published: 2025-03-07T11:12:54.091Z Last Updated: 2025-03-07T13:28:33.721Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: cifi Products: SEO Plugin by Squirrly SEO Problem Types: CWE-89 Description: The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, and including, 12.4.05 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already exist
for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a23ee5c-275f-4d51-8199-1cc2b0086f73?source=cve - https://plugins.trac.wordpress.org/browser/squirrly-seo/trunk/models/Snippet.php?rev=3207037#L96 - https://plugins.trac.wordpress.org/browser/squirrly-seo/trunk/models/Snippet.php?rev=3207037#L118 - https://plugins.trac.wordpress.org/browser/squirrly-seo/trunk/controllers/Onboarding.php?rev=3207037#L62 - https://plugins.trac
/plugins.trac.wordpress.org/browser/squirrly-seo/trunk/controllers/Onboarding.php?rev=3207037#L62 - https://plugins.trac.wordpress.org/browser/squirrly-seo/trunk/controllers/Assistant.php?rev=3207037#L55 - https://plugins.trac.wordpress.org/browser/squirrly-seo/trunk/controllers/Audits.php?rev=3207037#L86 - https://plugins.trac.wordpress.org/browser/squirrly-seo/trunk/controllers/BulkSeo.php?rev=3207037#L148 - https://plugins.trac.wordpress.org/browser/squirrly-seo/trunk/controllers/FocusPages.php?rev=3207037#L107 - https://plugins.trac.wordpress.org/browser/squirrly-seo/trunk/controllers/Post.php?rev=3207037#L480 - https://wordpress.org/plugins/squirrly-seo/#developers - https://plugins.tra
unk/controllers/Post.php?rev=3207037#L480 - https://wordpress.org/plugins/squirrly-seo/#developers - https://plugins.trac.wordpress.org/changeset/3248412/ - https://plugins.trac.wordpress.org/changeset/3250395/
CVE ID: CVE-2025-1769 State: PUBLISHED Published: 2025-03-26T11:22:09.346Z Last Updated: 2025-03-26T13:34:26.390Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: webtoffee Products: Product Import Export for WooCommerce – Import Export Product CSV Suite Problem Types: CWE-22 Description: The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.0 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can c
ckers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4df60fbe-4475-4cbf-b497-a9c5251bc91f?source=cve - https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/history/history.php#L753 - https://wordpress.org/plugins/product-import-export-for-woo/#developers - https://plugins.trac.wordpress.org/changeset/3261194/
CVE ID: CVE-2025-1770 State: PUBLISHED Published: 2025-03-20T05:22:34.878Z Last Updated: 2025-03-20T15:11:17.756Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themewinter Products: Eventin – Event Manager, Events Calendar, Event Tickets and Registrations Problem Types: CWE-22 Description: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of an
h Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f24baee-7003-449b-9072-d95fa1e26c8f?source=cve - https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.0.24/widgets/upcoming-event-tab/style/tab-1.php#L53 - https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.0.24/widgets/even
ng-event-tab/style/tab-1.php#L53 - https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.0.24/widgets/events-calendar/events-calendar.php#L715 - https://plugins.trac.wordpress.org/changeset/3257023/
CVE ID: CVE-2025-1771 State: PUBLISHED Published: 2025-03-15T04:22:07.953Z Last Updated: 2025-03-17T16:54:36.225Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ShineTheme Products: Travel Booking WordPress Theme Problem Types: CWE-98 Description: The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or ach
the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/da3e3d6c-7643-4f22-aa88-2c4ce80aed1f?source=cve - https://travelerwp.com/traveler-changelog/
CVE ID: CVE-2025-1772 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:38.364Z Description: No description available.
CVE ID: CVE-2025-1773 State: PUBLISHED Published: 2025-03-15T04:22:07.432Z Last Updated: 2025-03-17T16:55:58.670Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ShineTheme Products: Travel Booking WordPress Theme Problem Types: CWE-79 Description: The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additiona
pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/46c9dae7-d811-4b59-94c1-71a83652a14d?source=cve - https://travelerwp.com/traveler-changelog/
CVE ID: CVE-2025-1774 State: PUBLISHED Published: 2025-03-17T15:05:07.246Z Last Updated: 2025-03-17T15:17:24.213Z Vendors: NASK - PIB Products: BotSense Problem Types: CWE-142, CWE-143 Description: Incorrect string encoding vulnerability in NASK - PIB BotSense allows injection of an additional field separator character or value in the content of some fields of the generated event. A field with additional field separator characters or values can be included in the "extraData" field.This issue affects BotSense in versions before 2.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/03/CVE-2025-1774/ - https://cert.pl/posts/2025/03/CVE-2025-1774/
nrichment: References: - https://cert.pl/en/posts/2025/03/CVE-2025-1774/ - https://cert.pl/posts/2025/03/CVE-2025-1774/ - https://nask.pl/instytut/dla-biznesu/botsense/
CVE ID: CVE-2025-1776 State: PUBLISHED Published: 2025-02-28T13:46:38.948Z Last Updated: 2025-02-28T14:08:03.217Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Soteshop Products: Soteshop Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to execute arbitrary code via the ‘query’ parameter in /app-google-custom-search/searchResults. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incib
s on behalf of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-soteshop
CVE ID: CVE-2025-1777 State: PUBLISHED Published: 2025-06-06T05:22:43.193Z Last Updated: 2025-06-06T16:09:56.997Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: SeaTheme Products: BM Content Builder Problem Types: CWE-862 Description: The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst No
inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fb3e0251-c3b7-4360-87f3-7e4612d4f285?source=cve - https://www.seatheme.net/
CVE ID: CVE-2025-1778 State: PUBLISHED Published: 2025-06-06T05:22:42.535Z Last Updated: 2025-06-06T16:10:04.782Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SeaTheme Products: Art Theme Problem Types: CWE-862 Description: The Art Theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'arttheme_theme_option_restore' AJAX function in all versions up to, and including, 3.12.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the theme option. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c54c1fab-634d-4d1a-8234-8f1ae41c7cd4?source=cve - https://themeforest.net/item/art-simple-clean-wordpress-theme-for-creatives/20170299
CVE ID: CVE-2025-1780 State: PUBLISHED Published: 2025-03-01T03:22:19.179Z Last Updated: 2025-03-03T20:57:50.203Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: svenl77 Products: BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages Problem Types: CWE-862 Description: The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bp_delete_page() function in all versions up to, and including, 3.4.25. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins
4.25. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins page setting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc138cbb-2713-4b0a-8e3a-8e1a9266637f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3248127%40wc4bp&new=3248127%40wc4bp&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1781 State: PUBLISHED Published: 2025-03-28T13:48:22.127Z Last Updated: 2025-03-28T14:31:48.212Z Vendors: W3C Products: CSS Validator Problem Types: CWE-611 Description: There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF). This could be exploited to read arbitrary local files if an attacker has access to exception messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/google/security-research/security/advisories/GHSA-745m-xmq6-g6x7
CVE ID: CVE-2025-1782 State: REJECTED Published: 2025-04-14T18:41:21.745Z Last Updated: 2025-04-30T17:09:06.754Z Description: No description available.
CVE ID: CVE-2025-1783 State: PUBLISHED Published: 2025-03-08T09:22:55.376Z Last Updated: 2025-03-11T16:07:38.268Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kometschuh Products: Gallery Styles Problem Types: CWE-79 Description: The Gallery Styles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery Block in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: -
arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9443e36-648c-4984-8b06-28e9da959e26?source=cve - https://plugins.trac.wordpress.org/browser/gallery-styles/tags/1.3.4/gallery-styles.php#L34 - https://plugins.trac.wordpress.org/changeset/3251908/gallery-styles/trunk/gallery-styles.php
CVE ID: CVE-2025-1784 State: PUBLISHED Published: 2025-03-26T05:22:53.484Z Last Updated: 2025-03-26T18:39:14.887Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brainstormforce Products: Spectra – WordPress Gutenberg Blocks Problem Types: CWE-79 Description: The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb block in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesse
h Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9ac33fd5-602b-4810-96e1-850ea6ee739d?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.0/classes/class-uagb-init-blocks.php#L1276 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3243058%40ultimate-addons-for-gutenberg&new=3243058%40ultimate-addons-for-gutenberg&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1785 State: PUBLISHED Published: 2025-03-13T07:31:39.039Z Last Updated: 2025-03-13T20:13:02.111Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: codename065 Products: Download Manager Problem Types: CWE-22 Description: The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_newfile' action. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite select file types outside of the originally intended directory, which may cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
irectory, which may cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bc5c7974-4c10-4880-8823-2accee3c0da4?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3252990%40download-manager&new=3252990%40download-manager&sfp_email=&sfph_mail=#file4
CVE ID: CVE-2025-1786 State: PUBLISHED Published: 2025-03-01T10:00:07.495Z Last Updated: 2025-03-03T20:35:48.511Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: rizinorg Products: rizin Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in rizinorg rizin up to 0.7.4. It has been rated as critical. This issue affects the function msf_stream_directory_free in the library /librz/bin/pdb/pdb.c. The manipulation of the argument -P leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.0 is able to address this issue. It is recommended t
n disclosed to the public and may be used. Upgrading to version 0.8.0 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298007 - https://vuldb.com/?ctiid.298007 - https://vuldb.com/?submit.502317 - https://github.com/rizinorg/rizin/issues/4893 - https://github.com/user-attachments/files/18765730/rz-bin-6fb50-poc.zip - https://github.com/rizinorg/rizin/milestone/18
CVE ID: CVE-2025-1788 State: PUBLISHED Published: 2025-03-01T12:31:08.574Z Last Updated: 2025-03-03T20:37:29.635Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: rizinorg Products: rizin Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as critical, was found in rizinorg rizin up to 0.8.0. This affects the function rz_utf8_encode in the library /librz/util/utf8.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
be used. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298011 - https://vuldb.com/?ctiid.298011 - https://vuldb.com/?submit.502345 - https://github.com/rizinorg/rizin/issues/4910 - https://github.com/rizinorg/rizin/issues/4910#issuecomment-2662963253 - https://github.com/user-attachments/files/18817099/rz-bin-poc-01.zip - https://github.com/rizinorg/rizin/pull/4762
CVE ID: CVE-2025-1791 State: PUBLISHED Published: 2025-03-01T13:31:04.040Z Last Updated: 2025-03-03T20:36:54.749Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Zorlan Products: SkyCaiji Problem Types: CWE-434, CWE-284 Description: A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical. This vulnerability affects the function fileAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument save_data leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.29
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298012 - https://vuldb.com/?ctiid.298012 - https://vuldb.com/?submit.502648 - https://github.com/sheratan4/cve/issues/5
CVE ID: CVE-2025-1792 State: PUBLISHED Published: 2025-05-30T14:22:08.404Z Last Updated: 2025-06-12T17:07:00.539Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-1793 State: PUBLISHED Published: 2025-06-05T04:54:47.071Z Last Updated: 2025-06-05T14:08:26.589Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: run-llama Products: run-llama/llama_index Problem Types: CWE-89 Description: Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index library in a web application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8cb1555a
a web application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c - https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e
CVE ID: CVE-2025-1795 State: PUBLISHED Published: 2025-02-28T18:59:31.784Z Last Updated: 2025-11-03T20:57:12.370Z Vendors: Python Software Foundation Products: CPython Description: During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/python/cpython/issues/100884 - https://github.com/python/cpython/pull/100885 - https://git
erences: - https://github.com/python/cpython/issues/100884 - https://github.com/python/cpython/pull/100885 - https://github.com/python/cpython/pull/119099 - https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48 - https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593 - https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74 - https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/ - https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d - https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090