Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48490 State: PUBLISHED Published: 2025-05-30T05:27:59.565Z Last Updated: 2025-05-30T12:31:32.111Z Vendors: Lomkit Products: laravel-rest-api Problem Types: CWE-20, CWE-1173 Description: Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across multiple contexts (such as index, store, and update actions), malicious actors could exploit this behavior by crafting requests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the applicat
quests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the application. This could lead to unauthorized data being accepted or processed by the API, depending on the context in which the validation was bypassed. This issue has been patched in version 2.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Lomkit/laravel-rest-api/security/advisories/GHSA-69rh-hccr-cxrj - https://github.com/Lomkit/laravel-rest-api/pull/172 - https://github.com/Lomkit/laravel-rest-api/commit/88b14587b4efd7e59d7379658c606d325bb513b4
CVE ID: CVE-2025-48491 State: PUBLISHED Published: 2025-05-30T03:38:53.828Z Last Updated: 2025-05-30T12:42:33.795Z Vendors: aryan6673 Products: project-ai Problem Types: CWE-798 Description: Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in the source code. This issue has been patched in the pre-beta version. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aryan6673/project-ai/security/advisories/GHSA-8486-vrcp-69rv - https://github.com/aryan6673/project-ai/commit/142252c43f1dacb3fed99e3336f5cd863b028bc2 - https://github.com/aryan6673/project-ai/commit/1de910f353eb2a68c980149b906e749545
52c43f1dacb3fed99e3336f5cd863b028bc2 - https://github.com/aryan6673/project-ai/commit/1de910f353eb2a68c980149b906e7495459296ad - https://github.com/aryan6673/project-ai/commit/54a69c3ccd301d35f3d54f4844d9910e609beb73 - https://github.com/aryan6673/project-ai/commit/7f3b93f9aa9085d5413b4019172b0e56676346d7 - https://github.com/aryan6673/project-ai/commit/8db90e3d9777850741804533ebde5824b4a5795c - https://github.com/aryan6673/project-ai/commit/99e0e0718edb0e59c5d3c5a69903b87c69fcfe7a - https://github.com/aryan6673/project-ai/commit/ab67979a46b0e343dc20a95a2b65d3c4994c31e7 - https://github.com/aryan6673/project-ai/commit/c1fb156418d98a1e6c60bb680db57e9558785093
CVE ID: CVE-2025-48492 State: PUBLISHED Published: 2025-05-30T06:13:55.599Z Last Updated: 2025-05-30T12:25:00.345Z Vendors: GetSimpleCMS-CE Products: GetSimpleCMS-CE Problem Types: CWE-77 Description: GetSimple CMS is a content management system. In versions starting from 3.3.16 to 3.3.21, an authenticated user with access to the Edit component can inject arbitrary PHP into a component file and execute it via a crafted query string, resulting in Remote Code Execution (RCE). This issue is set to be patched in version 3.3.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-g435-p72m-p582
CVE ID: CVE-2025-48493 State: PUBLISHED Published: 2025-06-05T16:33:20.330Z Last Updated: 2025-06-09T20:52:45.538Z Vendors: yiisoft Products: yii2-redis Problem Types: CWE-532 Description: The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs. Version 2.0.20 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yiisoft/yii2-redis/security/advisories/GHSA-g3p6-82vc-43jh - https://githu
ulnrichment: References: - https://github.com/yiisoft/yii2-redis/security/advisories/GHSA-g3p6-82vc-43jh - https://github.com/yiisoft/yii2-redis/commit/962252d2c57c187181e67bb66da3f27b4698358d
CVE ID: CVE-2025-48494 State: PUBLISHED Published: 2025-06-02T11:03:52.689Z Last Updated: 2025-06-02T13:05:27.835Z Vendors: Forceu Products: Gokapi Problem Types: CWE-79, CWE-87 Description: Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens the upload list, the script is then parsed. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if e
ssion system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users using a version prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A possible workaround would be to disable end-to-end encryption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Forceu/Gokapi/security/advisories/GHSA-95rc-wc32-gm53 - https://github.com/Forceu/Gokapi/commit/343cc566cfd7f4efcd522c92371561d494aed6b0 - https://github.com/Forceu/Gokapi/releases/tag/v2.0.0
CVE ID: CVE-2025-48495 State: PUBLISHED Published: 2025-06-02T11:08:07.017Z Last Updated: 2025-06-02T16:51:10.394Z Vendors: Forceu Products: Gokapi Problem Types: CWE-79, CWE-87 Description: Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, an authenticated user could inject JS into the API key overview, which would also be executed when another user clicks on his API tab. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for al
eady able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users of versions prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A workaround would be to not open the API page if it is possible that another user might have injected code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Forceu/Gokapi/security/advisories/GHSA-4xg4-54hm-9j77 - https://github.com/Forceu/Gokapi/commit/65ddbc68fbfdf1c80cadb477f4bcbb7f2c4fdbf8
CVE ID: CVE-2025-48496 State: PUBLISHED Published: 2025-07-10T23:43:33.592Z Last Updated: 2025-07-11T13:54:00.868Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Emerson Products: ValveLink SOLO, ValveLink DTM, ValveLink PRM, ValveLink SNAP-ON Problem Types: CWE-427 Description: Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01 - https://www.emerson.com/en-us/support/security-notifications - https://www.emerson.co
ts/ics-advisories/icsa-25-189-01 - https://www.emerson.com/en-us/support/security-notifications - https://www.emerson.com/en-us/support/software-downloads-drivers
CVE ID: CVE-2025-48497 State: PUBLISHED Published: 2025-06-26T06:04:41.333Z Last Updated: 2025-06-26T13:33:32.765Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: iroha Soft Co., Ltd. Products: iroha Board Problem Types: CWE-352 Description: Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL while being logged in to the affected product, arbitrary learning histories may be registered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://irohaboard.irohasoft.jp/security/ - https://jvn.jp/en/jp/JVN92520966/
CVE ID: CVE-2025-48498 State: PUBLISHED Published: 2025-07-22T15:26:31.314Z Last Updated: 2025-11-03T20:04:53.548Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Bloomberg Products: Comdb2 Problem Types: CWE-476 Description: A null pointer dereference vulnerability exists in the Distributed Transaction component of Bloomberg Comdb2 8.1 when processing a number of fields used for coordination. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
e crafted message to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2199
CVE ID: CVE-2025-48499 State: PUBLISHED Published: 2025-08-04T05:17:01.537Z Last Updated: 2025-08-07T16:05:44.214Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: FUJIFILM Business Innovation Corp. Products: DocuPrint CP225 w, DocuPrint CP228 w, DocuPrint CP115 w, DocuPrint CP118 w, DocuPrint CP116 w, DocuPrint CP119 w, DocuPrint CM225 fw, DocuPrint CM228 fw, DocuPrint CM115 w, DocuPrint CM118 w, Apoes 2150 N, Apoes 2350 NDA, Apoes 2150 ND, Apoes 2150 NDA Problem Types: CWE-787 Description: Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet ma
LM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet may cause a denial-of-service (DoS) condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0804_announce.html - https://jvn.jp/en/vu/JVNVU93897456/
CVE ID: CVE-2025-48500 State: PUBLISHED Published: 2025-08-13T14:46:54.682Z Last Updated: 2025-08-14T03:55:59.425Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: F5 Products: BIG-IP Edge Client, BIG-IP Problem Types: CWE-353 Description: A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K0001517
evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000151782
CVE ID: CVE-2025-48501 State: PUBLISHED Published: 2025-07-07T04:51:39.574Z Last Updated: 2025-07-07T17:51:06.538Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Nimesa Products: Nimesa Backup and Recovery Problem Types: CWE-78 Description: An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed on the server where the product is running. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/marketplace/seller-profile?id=08fb48d1-5d60-4feb-93c6-c0c219278a2c - https://jvn.jp/en/jp/JVN88251376/
CVE ID: CVE-2025-48502 State: PUBLISHED Published: 2025-11-21T19:07:34.889Z Last Updated: 2025-11-24T21:02:33.311Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: AMD Products: AMD μProf Problem Types: CWE-1285 Description: Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html
CVE ID: CVE-2025-48507 State: PUBLISHED Published: 2025-11-23T17:07:56.914Z Last Updated: 2025-11-24T14:35:47.857Z Vendors: AMD Products: Kria™ SOM, Zynq™ UltraScale+™ MPSoCs, Zynq™ UltraScale+™ RFSoCs Problem Types: CWE-1284 Description: The security state of the calling processor into Arm® Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memories, access to crypto operations, and the ability to turn on and off subsystems within the SOC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8017.html
CVE ID: CVE-2025-48510 State: PUBLISHED Published: 2025-11-24T20:56:39.348Z Last Updated: 2025-11-24T21:07:15.170Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: AMD Products: AMD μProf Problem Types: CWE-394 Description: Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html
CVE ID: CVE-2025-48511 State: PUBLISHED Published: 2025-11-24T21:00:32.010Z Last Updated: 2025-11-24T21:13:33.411Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: AMD Products: AMD μProf Problem Types: CWE-1285 Description: Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in crash or denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html
CVE ID: CVE-2025-48522 State: PUBLISHED Published: 2025-09-04T18:34:04.810Z Last Updated: 2025-09-06T03:56:08.268Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/bdad29b85a6ca7c55a697e4e66356b744ef6cdb9 - https://source.android.com/security/bulletin/
.com/platform/frameworks/base/+/bdad29b85a6ca7c55a697e4e66356b744ef6cdb9 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-48523 State: PUBLISHED Published: 2025-09-04T18:34:05.838Z Last Updated: 2025-09-06T03:56:04.145Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Contacts/+/7c8dbcffbc9382fcdb788919106c3b0525db83ab - https://source.android.com/security/bulleti
platform/packages/apps/Contacts/+/7c8dbcffbc9382fcdb788919106c3b0525db83ab - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-48524 State: PUBLISHED Published: 2025-09-04T18:34:06.885Z Last Updated: 2025-09-05T17:23:17.692Z Vendors: Google Products: Android Problem Types: Denial of service Description: In isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Wifi/+/298745e0cb23cbef631aff1977b284155384bbf0 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-48526 State: PUBLISHED Published: 2025-09-04T18:34:07.920Z Last Updated: 2025-09-06T03:56:11.480Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another profile due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/IntentResolver/+/923a5673ac9d4b366097a8912a04e40e851
ences: - https://android.googlesource.com/platform/packages/modules/IntentResolver/+/923a5673ac9d4b366097a8912a04e40e85111ed4 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-48527 State: PUBLISHED Published: 2025-09-04T18:34:09.061Z Last Updated: 2025-09-05T15:08:36.842Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In multiple locations, there is a possible way to leak hidden work profile notifications due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/d8b1de7a18fc6a469c2d191ff9a0771f5d104fe4 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-48528 State: PUBLISHED Published: 2025-09-04T18:34:10.219Z Last Updated: 2025-09-06T03:55:47.958Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/ca71b9a63c40ef3fa741c76a2835146283fbb69a - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-48529 State: PUBLISHED Published: 2025-09-04T18:34:11.346Z Last Updated: 2025-09-04T20:27:57.757Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/opt/telephony/+/e5cdca27526f5c2c358880538c7a15d8d5d5dd6d - https://source.android.com/security/bulletin/2025
/frameworks/opt/telephony/+/e5cdca27526f5c2c358880538c7a15d8d5d5dd6d - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-48530 State: PUBLISHED Published: 2025-09-04T18:17:26.058Z Last Updated: 2025-09-05T15:07:57.861Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check. This could lead to remote code execution in combination with other bugs, with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2025-08-01
CVE ID: CVE-2025-48531 State: PUBLISHED Published: 2025-09-04T18:34:12.489Z Last Updated: 2025-09-06T03:56:05.104Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/cc1b1b5e493affcb1ef9c3543b10c89141f245c4 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-48532 State: PUBLISHED Published: 2025-09-04T18:34:13.538Z Last Updated: 2025-09-06T03:56:13.325Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In markMediaAsFavorite of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-48533 State: PUBLISHED Published: 2025-09-04T18:17:27.065Z Last Updated: 2025-09-05T15:09:40.842Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible way to use apps linked from a context menu of a lockscreen app due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2025-08-01
CVE ID: CVE-2025-48534 State: PUBLISHED Published: 2025-09-04T18:34:14.563Z Last Updated: 2025-09-05T13:48:41.724Z Vendors: Google Products: Android Problem Types: Denial of service Description: In getDefaultCBRPackageName of CellBroadcastHandler.java, there is a possible escalation of privilege due to a logic error in the code. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/584cec4f17eab96ac44bce4e1bce8d6a2c59cd75 - https://source.android.com/security/bulletin/2
modules/CellBroadcastService/+/584cec4f17eab96ac44bce4e1bce8d6a2c59cd75 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-48535 State: PUBLISHED Published: 2025-09-04T18:34:15.589Z Last Updated: 2025-09-06T03:56:10.725Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/1e4423730f8776bd09df7614
Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/1e4423730f8776bd09df7614474643ae735d2176 - https://source.android.com/security/bulletin/2025-09-01