Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-64439 State: PUBLISHED Published: 2025-11-07T20:15:21.710Z Last Updated: 2025-11-07T20:21:52.610Z Vendors: langchain-ai Products: langgraph Problem Types: CWE-502 Description: LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 2.1.2 and below, the JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a Remote Code Execution (RCE) vulnerability when deserializing payloads saved in the "json" serialization mode. By default, the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library,
the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library, if illegal Unicode surrogate values caused serialization to fail, it would fall back to using the "json" mode. This issue is fixed in version 3.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langchain-ai/langgraph/security/advisories/GHSA-wwqv-p2pp-99h5 - https://github.com/langchain-ai/langgraph/commit/c5744f583b11745cd406f3059903e17bbcdcc8ac - https://github.com/langchain-ai/langgraph/blob/c5744f583b11745cd406f3059903e17bbcdcc8ac/libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py - https://github.com/langchain-ai/langgraph/rel
59903e17bbcdcc8ac/libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py - https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0
CVE ID: CVE-2025-64442 State: PUBLISHED Published: 2025-11-07T20:28:20.962Z Last Updated: 2025-11-07T20:44:02.514Z Vendors: humhub Products: humhub Problem Types: CWE-79 Description: HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to be executed in search previews. This issue is fixed in version 1.17.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/humhub/humhub/security/advisories/GHSA-2hgp-33j2-93cc - https://github.com/humhub/humhub/pull/7814 - https://github.com/humhub/humhub/releases/tag/v1.17.4
CVE ID: CVE-2025-64444 State: PUBLISHED Published: 2025-11-14T05:15:56.229Z Last Updated: 2025-11-14T15:21:59.245Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Sony Network Communications Inc. Products: NCP-HG100/Cellular model, NCP-HG100/WLAN model Problem Types: CWE-78 Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a remote attacker who has obtained the authentication information to log in to the management page of the product may execute an arbitrary OS command with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
product may execute an arbitrary OS command with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.sonynetwork.co.jp/faqsupport/manoma/web/knowledge11157.html - https://jvn.jp/en/jp/JVN49899607/
CVE ID: CVE-2025-64446 State: PUBLISHED Published: 2025-11-14T15:50:52.778Z Last Updated: 2025-11-20T21:16:49.529Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-23 Description: A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.forti
ests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-910
CVE ID: CVE-2025-64448 State: REJECTED Published: N/A Last Updated: 2025-11-05T03:55:08.764Z Description: No description available.
CVE ID: CVE-2025-64449 State: REJECTED Published: N/A Last Updated: 2025-11-05T03:55:08.291Z Description: No description available.
CVE ID: CVE-2025-64450 State: REJECTED Published: N/A Last Updated: 2025-11-05T03:55:07.816Z Description: No description available.
CVE ID: CVE-2025-64451 State: REJECTED Published: N/A Last Updated: 2025-11-05T03:55:07.339Z Description: No description available.
CVE ID: CVE-2025-64452 State: REJECTED Published: N/A Last Updated: 2025-11-05T03:55:06.849Z Description: No description available.
CVE ID: CVE-2025-64453 State: REJECTED Published: N/A Last Updated: 2025-11-05T03:55:06.364Z Description: No description available.
CVE ID: CVE-2025-64454 State: REJECTED Published: N/A Last Updated: 2025-11-05T03:55:05.883Z Description: No description available.
CVE ID: CVE-2025-64455 State: REJECTED Published: N/A Last Updated: 2025-11-05T03:55:05.246Z Description: No description available.
CVE ID: CVE-2025-64456 State: PUBLISHED Published: 2025-11-10T13:28:03.624Z Last Updated: 2025-11-11T04:55:34.273Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: JetBrains Products: ReSharper Problem Types: CWE-347 Description: In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-64457 State: REJECTED Published: 2025-11-10T13:28:23.970Z Last Updated: 2025-11-11T12:28:28.705Z Description: No description available.
CVE ID: CVE-2025-64458 State: PUBLISHED Published: 2025-11-05T15:07:17.031Z Last Updated: 2025-11-05T16:20:57.265Z Vendors: djangoproject Products: Django Problem Types: CWE-407 Description: An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affec
haracters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/g/django-announce - https://www.djangoproject.com/weblog/2025/nov/05/security-releases/
CVE ID: CVE-2025-64459 State: PUBLISHED Published: 2025-11-05T15:09:58.239Z Last Updated: 2025-11-08T12:49:45.129Z Vendors: djangoproject Products: Django Problem Types: CWE-89 Description: An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue. Additional Analyst N
evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/g/django-announce - https://www.djangoproject.com/weblog/2025/nov/05/security-releases/
CVE ID: CVE-2025-64472 State: REJECTED Published: N/A Last Updated: 2025-11-06T03:55:09.707Z Description: No description available.
CVE ID: CVE-2025-64473 State: REJECTED Published: N/A Last Updated: 2025-11-06T03:55:09.228Z Description: No description available.
CVE ID: CVE-2025-64474 State: REJECTED Published: N/A Last Updated: 2025-11-06T03:55:08.778Z Description: No description available.
CVE ID: CVE-2025-64475 State: REJECTED Published: N/A Last Updated: 2025-11-06T03:55:08.310Z Description: No description available.
CVE ID: CVE-2025-64476 State: REJECTED Published: N/A Last Updated: 2025-11-06T03:55:07.823Z Description: No description available.
CVE ID: CVE-2025-64477 State: REJECTED Published: N/A Last Updated: 2025-11-06T03:55:07.255Z Description: No description available.
CVE ID: CVE-2025-64478 State: REJECTED Published: N/A Last Updated: 2025-11-06T03:55:06.796Z Description: No description available.
CVE ID: CVE-2025-64479 State: REJECTED Published: N/A Last Updated: 2025-11-06T03:55:06.294Z Description: No description available.
CVE ID: CVE-2025-64480 State: REJECTED Published: N/A Last Updated: 2025-11-06T03:55:05.652Z Description: No description available.
CVE ID: CVE-2025-64481 State: PUBLISHED Published: 2025-11-07T20:35:39.827Z Last Updated: 2025-11-13T14:23:19.366Z Severity: NONE (CVSS N/A CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) Vendors: simonw Products: datasette Problem Types: CWE-601 Description: Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slash is required) will redirect the user to https://example.com/foo/bar. This problem has been patched in both Datasette 0.65.2 and 1.0a21. To workaround this issue, if Datasette is runn
o/bar. This problem has been patched in both Datasette 0.65.2 and 1.0a21. To workaround this issue, if Datasette is running behind a proxy, that proxy could be configured to replace // with / in incoming request URLs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/simonw/datasette/security/advisories/GHSA-w832-gg5g-x44m - https://github.com/simonw/datasette/issues/2429 - https://github.com/simonw/datasette/commit/f257ca6edb64848c3b04b54d41e347c54fe57c05
CVE ID: CVE-2025-64482 State: PUBLISHED Published: 2025-11-12T21:37:25.220Z Last Updated: 2025-11-13T16:47:39.188Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Enalean Products: tuleap Problem Types: CWE-352 Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1762267347 and Tuleap Enterprise Edition prior to versions 17.01-, 16.13-6, and 16.12-9 don't have cross-site request forgery protections in the file release system. An attacker could use this vulnerability to trick victims into changing the commit rules or immutable tags of a SVN repo. Tuleap
ker could use this vulnerability to trick victims into changing the commit rules or immutable tags of a SVN repo. Tuleap Community Edition 16.13.99.1762267347, Tuleap Enterprise Edition 17.0-1, Tuleap Enterprise Edition 16.13-6, and Tuleap Enterprise Edition 16.12-9 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-w7h4-9vf6-q7rc - https://github.com/Enalean/tuleap/commit/899b5c1693324211947b72f2810ae8944e1bd0d5 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=899b5c1693324211947b72f2810ae8944e1bd0d5 - https://tuleap.net/plugins/tracker/?aid=45259
CVE ID: CVE-2025-64483 State: PUBLISHED Published: 2025-11-21T17:55:33.219Z Last Updated: 2025-11-21T18:10:54.710Z Vendors: wazuh Products: wazuh-dashboard-plugins Problem Types: CWE-284 Description: Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in certain configurations allows authenticated users with read-only API roles to retrieve agent enrollment credentials through the /utils/configuration endpoint. These credentials can be used to register new agents within the same Wazuh tenant without requiring elevated permissions through the UI. This issue has been patched in version 4.13.0. Ad
me Wazuh tenant without requiring elevated permissions through the UI. This issue has been patched in version 4.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wazuh/wazuh-dashboard-plugins/security/advisories/GHSA-gwf3-8gm3-qrmj
CVE ID: CVE-2025-64484 State: PUBLISHED Published: 2025-11-10T21:33:58.018Z Last Updated: 2025-11-14T19:24:55.471Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: oauth2-proxy Products: oauth2-proxy Problem Types: CWE-644 Description: OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject und
s (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy’s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a ratio
`X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don't treat underscores and hyphens in Headers the same way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6 - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2 - https://datatracker
ecurity/advisories/GHSA-vjrc-mh2v-45x6 - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2 - https://datatracker.ietf.org/doc/html/rfc822#section-3.2 - https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html - https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx
CVE ID: CVE-2025-64485 State: PUBLISHED Published: 2025-11-07T23:21:06.984Z Last Updated: 2025-11-10T16:47:40.892Z Vendors: cvat-ai Products: cvat Problem Types: CWE-22 Description: CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1, a malicious CVAT user with at least the User global role may create files in the root of the mounted file share, or overwrite existing files. If no file share is mounted, the user will be able to create files in the share directory of the import worker container, potentially filling up disk space. This issue is fixed in version 2.49.0. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
filling up disk space. This issue is fixed in version 2.49.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cvat-ai/cvat/security/advisories/GHSA-x396-w86c-gf6w - https://github.com/cvat-ai/cvat/commit/cace877189528a7ed4a224476f4bc0bd5a21d40c
CVE ID: CVE-2025-64486 State: PUBLISHED Published: 2025-11-07T23:25:55.996Z Last Updated: 2025-11-13T21:34:23.230Z Vendors: kovidgoyal Products: calibre Problem Types: CWE-73 Description: calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kovidgoyal/calibre/security/advisories/GHSA-hpwq-c98h-xp8g - https://gi
P Vulnrichment: References: - https://github.com/kovidgoyal/calibre/security/advisories/GHSA-hpwq-c98h-xp8g - https://github.com/kovidgoyal/calibre/commit/6f94bce214bf7d43c829804db3741afa5e83c0c5
CVE ID: CVE-2025-64488 State: PUBLISHED Published: 2025-11-07T23:59:46.011Z Last Updated: 2025-11-13T21:35:13.513Z Vendors: SuiteCRM Products: SuiteCRM Problem Types: CWE-89 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through 8.9.0 8.0.0-beta.1, an attacker can craft a malicious call_id that alters the logic of the SQL query or injects arbitrary SQL. An attack can lead to unauthorized data access and data ex-filtration, complete database compromise, and other various issues. This issue is fixed in versions 7.14.8 and 8.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment
ther various issues. This issue is fixed in versions 7.14.8 and 8.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-5v53-v44q-ww2c - https://github.com/SuiteCRM/SuiteCRM-Core/commit/30277cfe69755f7360a23d4805e06a5c38f14131 - https://github.com/SuiteCRM/SuiteCRM/commit/40da2845a170832a4e9e9fa0ebe731f8c34de42d
CVE ID: CVE-2025-64489 State: PUBLISHED Published: 2025-11-08T00:15:44.728Z Last Updated: 2025-11-13T21:36:24.585Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: SuiteCRM Products: SuiteCRM Problem Types: CWE-269 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account deactivation. An inactive user with an active session can continue to access the application and, critically, can self-reactivate their account. This undermines administrative control
nue to access the application and, critically, can self-reactivate their account. This undermines administrative controls and allows unauthorized persistence. This issue is fixed in versions 7.14.8 and 8.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-j6jg-9jj3-q2ph - https://github.com/SuiteCRM/SuiteCRM-Core/commit/30277cfe69755f7360a23d4805e06a5c38f14131 - https://github.com/SuiteCRM/SuiteCRM/commit/40da2845a170832a4e9e9fa0ebe731f8c34de42d
CVE ID: CVE-2025-64490 State: PUBLISHED Published: 2025-11-08T00:22:38.183Z Last Updated: 2025-11-13T21:37:07.901Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: SuiteCRM Products: SuiteCRM Problem Types: CWE-863 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 allow a low-privileged user with a restrictive role to view and create work items through the Resource Calendar and project screens, even when the related modules (Projects, Project Tasks, Tasks, Leads, Accounts, Meetings, Calls) are explicitly set to Disabled/None in Role Managem
s (Projects, Project Tasks, Tasks, Leads, Accounts, Meetings, Calls) are explicitly set to Disabled/None in Role Management. This indicates inconsistent ACL/RBAC enforcement across modules and views, resulting in unauthorized data exposure and modification. This issue is fixed in versions 7.14.8 and 8.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-jh8v-wqgj-hhc2
CVE ID: CVE-2025-64491 State: PUBLISHED Published: 2025-11-08T00:45:07.617Z Last Updated: 2025-11-10T16:45:15.296Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SuiteCRM Products: SuiteCRM Problem Types: CWE-79 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and below allow unauthenticated reflected Cross-Site Scripting (XSS). Successful exploitation could lead to full account takeover, for example by altering the login form to send credentials to an attacker-controlled server. As a reflected XSS issue, exploitation requires the victim to open a crafted malicious link, w
tacker-controlled server. As a reflected XSS issue, exploitation requires the victim to open a crafted malicious link, which can be delivered via phishing, social media, or other communication channels. This issue is fixed in version 7.14.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-prfm-6667-x3mv - https://github.com/SuiteCRM/SuiteCRM/commit/40da2845a170832a4e9e9fa0ebe731f8c34de42d
CVE ID: CVE-2025-64492 State: PUBLISHED Published: 2025-11-08T01:07:23.393Z Last Updated: 2025-11-10T15:14:20.621Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SuiteCRM Products: SuiteCRM-Core Problem Types: CWE-89 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind SQL Injection vulnerability. This vulnerability allows an authenticated attacker to infer data from the database by measuring response times, potentially leading to the extraction of sensitive information. It is possible for an attacker to enumerate database, table, and column n
ng to the extraction of sensitive information. It is possible for an attacker to enumerate database, table, and column names, extract sensitive data, or escalate privileges. This is fixed in version 8.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-54m4-4p54-j8hp
CVE ID: CVE-2025-64493 State: PUBLISHED Published: 2025-11-08T01:16:22.833Z Last Updated: 2025-11-10T16:39:27.970Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SuiteCRM Products: SuiteCRM-Core Problem Types: CWE-89 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind (time-based) SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the database, and does not require administrative access. This issue is fixed in version 8.9.1. Additional Analyst Notes: - CISA ADP Vuln
does not require administrative access. This issue is fixed in version 8.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-5gcj-mfqq-v8f7 - https://docs.suitecrm.com/community/security-policy
CVE ID: CVE-2025-64494 State: PUBLISHED Published: 2025-11-08T01:19:01.203Z Last Updated: 2025-11-10T15:11:01.604Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: charmbracelet Products: soft-serve Problem Types: CWE-150 Description: Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. This issue is fixed in version 0.10.0. Additional Analyst Notes: - CISA ADP Vulnrichmen