Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rences: - https://patchstack.com/database/wordpress/plugin/penci-shortcodes/vulnerability/wordpress-penci-shortcodes-performance-plugin-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-59588 State: PUBLISHED Published: 2025-09-22T18:25:48.562Z Last Updated: 2025-09-23T14:11:26.991Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PenciDesign Products: Soledad Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign Soledad allows PHP Local File Inclusion. This issue affects Soledad: from n/a through 8.6.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/soledad/vulnerability/wordpress-soledad-theme-8-6-8-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-59589 State: PUBLISHED Published: 2025-09-22T18:25:47.876Z Last Updated: 2025-09-23T17:51:04.198Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: PenciDesign Products: Soledad Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad allows DOM-Based XSS. This issue affects Soledad: from n/a through 8.6.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/soledad/vulnerability/wordpress-soledad-theme-8-6-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-59590 State: PUBLISHED Published: 2025-09-22T18:25:47.186Z Last Updated: 2025-09-23T17:51:10.734Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: David Lingren Products: Media Library Assistant Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media Library Assistant allows Stored XSS. This issue affects Media Library Assistant: from n/a through 3.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3
atchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-28-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-59591 State: PUBLISHED Published: 2025-09-22T18:25:46.381Z Last Updated: 2025-09-23T16:21:30.501Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: AdvancedCoding Products: wpDiscuz Problem Types: CWE-862 Description: Missing Authorization vulnerability in AdvancedCoding wpDiscuz allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects wpDiscuz: from n/a through 7.6.33. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpdiscuz/vulnerability/wordpress-wpdiscuz-plugin-7-6-33-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-59592 State: PUBLISHED Published: 2025-09-22T18:25:45.095Z Last Updated: 2025-09-23T16:24:08.088Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Fernando Acosta Products: Make Column Clickable Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fernando Acosta Make Column Clickable Elementor allows Stored XSS. This issue affects Make Column Clickable Elementor: from n/a through 1.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/make-column-clickable-elementor/vulnerability/wordp
ment: References: - https://patchstack.com/database/wordpress/plugin/make-column-clickable-elementor/vulnerability/wordpress-make-column-clickable-elementor-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-59593 State: PUBLISHED Published: 2025-10-22T14:32:39.727Z Last Updated: 2025-11-13T10:33:43.711Z Vendors: Extend Themes Products: Colibri Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through < 1.0.334. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/colibri-page-builder/vulnerability/wordpress-colibri-page-builder-plugin-1-0-334-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-59595 State: PUBLISHED Published: 2025-11-04T22:46:38.884Z Last Updated: 2025-11-04T22:57:45.870Z Vendors: Absolute Products: Secure Access Description: CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12. An attacker can send a specially crafted packet to a server in a non-default configuration and cause the server to crash. References: - https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-59595
CVE ID: CVE-2025-59596 State: PUBLISHED Published: 2025-11-04T22:51:31.244Z Last Updated: 2025-11-05T14:18:58.843Z Vendors: Absolute Security Products: Secure Access Description: CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. If a local networking policy is active, attackers on an adjacent network may be able to send a crafted packet and cause the client system to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-59596
CVE ID: CVE-2025-59668 State: PUBLISHED Published: 2025-09-30T04:06:11.279Z Last Updated: 2025-10-31T14:12:10.064Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: NIHON KOHDEN CORPORATION Products: Central Monitor CNS-6201 Problem Types: CWE-476 Description: Multiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability. When processing a crafted certain UDP packet, the affected device may abnormally terminate. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nihonkohden.com/security.html - https://jvn.jp/en/vu/JVNVU96989989/
CVE ID: CVE-2025-59669 State: PUBLISHED Published: 2025-11-18T17:01:19.617Z Last Updated: 2025-11-18T19:34:51.604Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-798 Description: A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker with shell access to the device to connect to redis service and access its data Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-843
CVE ID: CVE-2025-59670 State: REJECTED Published: N/A Last Updated: 2025-09-19T02:55:09.439Z Description: No description available.
CVE ID: CVE-2025-59671 State: REJECTED Published: N/A Last Updated: 2025-09-19T02:55:08.980Z Description: No description available.
CVE ID: CVE-2025-59672 State: REJECTED Published: N/A Last Updated: 2025-09-19T02:55:08.499Z Description: No description available.
CVE ID: CVE-2025-59673 State: REJECTED Published: N/A Last Updated: 2025-09-19T02:55:07.891Z Description: No description available.
CVE ID: CVE-2025-59674 State: REJECTED Published: N/A Last Updated: 2025-09-19T02:55:07.427Z Description: No description available.
CVE ID: CVE-2025-59675 State: REJECTED Published: N/A Last Updated: 2025-09-19T02:55:06.957Z Description: No description available.
CVE ID: CVE-2025-59676 State: REJECTED Published: N/A Last Updated: 2025-09-19T02:55:06.476Z Description: No description available.
CVE ID: CVE-2025-59677 State: REJECTED Published: N/A Last Updated: 2025-09-19T02:55:05.993Z Description: No description available.
CVE ID: CVE-2025-59678 State: REJECTED Published: N/A Last Updated: 2025-09-19T02:55:05.356Z Description: No description available.
CVE ID: CVE-2025-59681 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-11-04T21:13:55.046Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: djangoproject Products: Django Problem Types: CWE-89 Description: An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refere
these methods (on MySQL and MariaDB). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/g/django-announce - https://www.djangoproject.com/weblog/2025/oct/01/security-releases/
CVE ID: CVE-2025-59682 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-11-04T21:13:56.342Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: djangoproject Products: Django Problem Types: CWE-23 Description: An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangop
irectory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/g/django-announce - https://www.djangoproject.com/weblog/2025/oct/01/security-releases/
CVE ID: CVE-2025-59684 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-01T15:08:49.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://digisign.ro/products-services/signing-applications/ - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-59684
CVE ID: CVE-2025-59685 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-28T20:30:22.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kazaar 1.25.12 allows a JWT with none in the alg field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kazaar.com/ - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-59685
CVE ID: CVE-2025-59686 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-28T20:31:45.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kazaar.com/ - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-59686
CVE ID: CVE-2025-59687 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-21T20:06:55.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and notifications of an arbitrary organization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aurora-impaqtr.com/ - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-59687
CVE ID: CVE-2025-59689 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-10-21T22:45:17.910Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Libraesva Products: Email Security Gateway Problem Types: CWE-77 Description: Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.libraesv
a fix has been released in 5.5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.libraesva.com/security-blog/ - https://docs.libraesva.com/knowledgebase/security-advisory-command-injection-vulnerability-cve-2025-59689/
CVE ID: CVE-2025-59691 State: PUBLISHED Published: 2025-09-18T00:00:00.000Z Last Updated: 2025-09-19T13:08:52.061Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: PureVPN Products: PureVPN Problem Types: CWE-669 Description: PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi-Fi reconnect or system resume. In the CLI client, the VPN auto-reconnects and claims to be connected, but IPv6 traffic is no longer routed or blocked. In the GUI client, the IPv6 connection remains functional after disconnection until the user clicks Reconnect. In both cases, the real IPv6 address is e
ection remains functional after disconnection until the user clicks Reconnect. In both cases, the real IPv6 address is exposed to external services, violating user privacy and defeating the advertised IPv6 leak protection. This affects CLI 2.0.1 and GUI 2.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://anagogistis.com/posts/purevpn-ipv6-leak/
CVE ID: CVE-2025-59692 State: PUBLISHED Published: 2025-09-18T00:00:00.000Z Last Updated: 2025-09-19T13:08:31.242Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: PureVPN Products: PureVPN Problem Types: CWE-669 Description: PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply default ACCEPT policies when connecting to a VPN server. This removes firewall rules that may have been configured manually or by other software (e.g., UFW, container engines, or system security policies). Upon VPN disconnect, the original firewall state is not restored. As a result, the system may bec
em security policies). Upon VPN disconnect, the original firewall state is not restored. As a result, the system may become unintentionally exposed to network traffic that was previously blocked. This affects CLI 2.0.1 and GUI 2.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://anagogistis.com/posts/purevpn-ipv6-leak/
CVE ID: CVE-2025-59712 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T13:49:53.627Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: snipeitapp Products: Snipe-IT Problem Types: CWE-79 Description: Snipe-IT before 8.1.18 allows XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/grokability/snipe-it/releases/tag/v8.1.18
CVE ID: CVE-2025-59713 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T13:49:25.986Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: snipeitapp Products: Snipe-IT Problem Types: CWE-502 Description: Snipe-IT before 8.1.18 allows unsafe deserialization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/grokability/snipe-it/releases/tag/v8.1.18
CVE ID: CVE-2025-59714 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T13:48:56.733Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Internet2 Products: Grouper Problem Types: CWE-863 Description: In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spaces.at.internet2.edu/display/Grouper/Grouper+bug+-+GRP-6311+-+non-Grouper-admins+can+configure+loader+jobs
CVE ID: CVE-2025-59715 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T13:32:40.156Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: SMSEagle Products: SMSEagle Problem Types: CWE-79 Description: SMSEagle before 6.11 allows reflected XSS via a username or contact phone number. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.smseagle.eu/security-advisory/resolved-xss-in-smseagle-software-6-11/
CVE ID: CVE-2025-59716 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-05T20:10:32.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user rather than a non-existent user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/owncloud/guests - https://yeswehack.com/reports/411806 - https://marketplace.owncloud.com/apps/guests - http
/github.com/owncloud/guests - https://yeswehack.com/reports/411806 - https://marketplace.owncloud.com/apps/guests - https://gist.github.com/thesmartshadow/64ae0449e909174d0479a4f23657147f
CVE ID: CVE-2025-59717 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T13:32:08.575Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: DigitalOcean Products: @digitalocean/do-markdownit Problem Types: CWE-843 Description: In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string (instead of an array). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/digitalocean/do-markdownit - https://gist.github.com/thesmartshadow/dd19665f1f51a4e3c7a766e70c9eafd0 - https:
github.com/digitalocean/do-markdownit - https://gist.github.com/thesmartshadow/dd19665f1f51a4e3c7a766e70c9eafd0 - https://www.npmjs.com/package/@digitalocean/do-markdownit
CVE ID: CVE-2025-59720 State: REJECTED Published: N/A Last Updated: 2025-09-20T02:55:09.775Z Description: No description available.
CVE ID: CVE-2025-59721 State: REJECTED Published: N/A Last Updated: 2025-09-20T02:55:09.292Z Description: No description available.
CVE ID: CVE-2025-59722 State: REJECTED Published: N/A Last Updated: 2025-09-20T02:55:08.785Z Description: No description available.
CVE ID: CVE-2025-59723 State: REJECTED Published: N/A Last Updated: 2025-09-20T02:55:08.168Z Description: No description available.
CVE ID: CVE-2025-59724 State: REJECTED Published: N/A Last Updated: 2025-09-20T02:55:07.611Z Description: No description available.
CVE ID: CVE-2025-59725 State: REJECTED Published: N/A Last Updated: 2025-09-20T02:55:06.883Z Description: No description available.
CVE ID: CVE-2025-59726 State: REJECTED Published: N/A Last Updated: 2025-09-20T02:55:06.409Z Description: No description available.
CVE ID: CVE-2025-59727 State: REJECTED Published: N/A Last Updated: 2025-09-20T02:55:05.638Z Description: No description available.
CVE ID: CVE-2025-59728 State: PUBLISHED Published: 2025-10-06T08:08:27.410Z Last Updated: 2025-10-08T03:55:08.382Z Vendors: FFmpeg Products: MPEG-DASH Problem Types: CWE-787 Description: When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below [0], it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is not an empty string, it is assigned to root_url at [1].If the last (non-NUL) byte in this buffer is not '/' then we append '/' in-place at [2]. This will write two bytes into the buffer, starting at the last valid
er is not '/' then we append '/' in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer. We recommend upgrading to version 8.0 or beyond. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/433502298
CVE ID: CVE-2025-59729 State: PUBLISHED Published: 2025-10-06T08:08:46.060Z Last Updated: 2025-10-06T16:28:37.534Z Vendors: FFmpeg Products: FFmpeg Problem Types: CWE-787 Description: When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer. If we load a DHAV file that is larger than MAX_DURATION_BUFFER_SIZE bytes (0x100000) for example 0x101000 bytes, then at [0] we have size = 0x101000. At [1] we have end_buffer_size = 0x100000, and at [2] we have end_buffer_pos = 0x1000. The loop then scans backwards through the buffer looking for the dhav tag; when it is found, we'll calcul
_pos = 0x1000. The loop then scans backwards through the buffer looking for the dhav tag; when it is found, we'll calculate end_pos based on a 32-bit offset read from the buffer. There is subsequently a check [3] that end_pos is within the section of the file that has been copied into end_buffer, but it only correctly handles the cases where end_pos is before the start of the file or after the section copied into end_buffer, and not the case where end_pos is within the the file, but before the section copied into end_buffer. If we provide such an offset, (end_pos - end_buffer_pos) can underflow, resulting in the subsequent access at [4] occurring before the beginning of the allocation. We re
er_pos) can underflow, resulting in the subsequent access at [4] occurring before the beginning of the allocation. We recommend upgrading to version 8.0 or beyond. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/433513232
CVE ID: CVE-2025-59730 State: PUBLISHED Published: 2025-10-06T08:09:11.029Z Last Updated: 2025-10-06T16:23:59.447Z Vendors: FFmpeg Products: FFmpeg Problem Types: CWE-787 Description: When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the resolution. This codec can encode the frame contents using a run-length encoding algorithm. There are no checks that the decoded frame fits in the allocated buffer, leading to a heap-buffer-overflow. process_frame_obj initializes the buffers based on the fram
in the allocated buffer, leading to a heap-buffer-overflow. process_frame_obj initializes the buffers based on the frame resolution: We recommend upgrading to version 8.0 or beyond. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/434637586
CVE ID: CVE-2025-59731 State: PUBLISHED Published: 2025-10-06T08:09:23.410Z Last Updated: 2025-10-19T14:53:00.719Z Vendors: FFmpeg Products: FFmpeg Problem Types: CWE-787 Description: When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size. We recommend upgrading to version 8.0 or beyond. Additiona