Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-52836 State: PUBLISHED Published: 2025-07-16T11:27:52.763Z Last Updated: 2025-07-16T18:50:01.835Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Unity Business Technology Pty Ltd Products: The E-Commerce ERP Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP allows Privilege Escalation. This issue affects The E-Commerce ERP: from n/a through 2.1.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/profitori/vulnerability/wordpress-the-e-commerce-erp-2-1-1-3-privilege-escalation-vulnerabili
/database/wordpress/plugin/profitori/vulnerability/wordpress-the-e-commerce-erp-2-1-1-3-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-52837 State: PUBLISHED Published: 2025-07-10T18:57:50.659Z Last Updated: 2025-07-11T03:55:32.006Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Password Manager Problem Types: CWE-64 Description: Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an attacker the opportunity to abuse symbolic links and other methods to delete any file/folder and achieve privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-12946 - ht
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-12946 - https://www.zerodayinitiative.com/advisories/ZDI-25-586/
CVE ID: CVE-2025-52841 State: PUBLISHED Published: 2025-07-02T16:45:40.057Z Last Updated: 2025-07-02T20:00:10.652Z Vendors: Laundry Products: Laundry Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This issue affects Laundry: 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/tort - https://github.com/mohaiminur/laundry
CVE ID: CVE-2025-52842 State: PUBLISHED Published: 2025-07-02T19:49:29.962Z Last Updated: 2025-07-02T20:10:11.456Z Vendors: Laundry Products: Laundry Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Laundry on Linux, MacOS allows Account Takeover. This issue affects Laundry: 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/winehouse - https://github.com/mohaiminur/laundry
CVE ID: CVE-2025-52853 State: PUBLISHED Published: 2025-10-03T18:11:42.913Z Last Updated: 2025-10-03T19:12:08.464Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-52854 State: PUBLISHED Published: 2025-10-03T18:11:49.041Z Last Updated: 2025-10-03T19:11:52.322Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-52855 State: PUBLISHED Published: 2025-10-03T18:11:56.405Z Last Updated: 2025-10-03T19:11:44.238Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-52856 State: PUBLISHED Published: 2025-08-29T17:17:20.562Z Last Updated: 2025-08-30T03:55:40.600Z Vendors: QNAP Systems Inc. Products: VioStor Problem Types: CWE-287 Description: An improper authentication vulnerability has been reported to affect VioStor. If a remote attacker, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: VioStor 5.1.6 build 20250621 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-29
CVE ID: CVE-2025-52857 State: PUBLISHED Published: 2025-10-03T18:12:03.119Z Last Updated: 2025-10-03T19:11:34.444Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-52858 State: PUBLISHED Published: 2025-10-03T18:12:09.818Z Last Updated: 2025-10-03T19:11:24.029Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-52859 State: PUBLISHED Published: 2025-10-03T18:12:16.583Z Last Updated: 2025-10-03T19:11:12.494Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-52860 State: PUBLISHED Published: 2025-10-03T18:12:22.605Z Last Updated: 2025-10-03T19:10:53.233Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-52861 State: PUBLISHED Published: 2025-08-29T17:17:26.199Z Last Updated: 2025-08-29T17:46:07.744Z Vendors: QNAP Systems Inc. Products: VioStor Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect VioStor. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: VioStor 5.1.6 build 20250621 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-28
CVE ID: CVE-2025-52862 State: PUBLISHED Published: 2025-10-03T18:14:13.658Z Last Updated: 2025-10-03T19:10:42.739Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-52865 State: PUBLISHED Published: 2025-11-07T15:15:20.701Z Last Updated: 2025-11-07T15:55:41.114Z Vendors: QNAP Systems Inc. Products: File Station 5 Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-38
CVE ID: CVE-2025-52866 State: PUBLISHED Published: 2025-10-03T18:14:20.905Z Last Updated: 2025-10-03T19:10:32.185Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-52867 State: PUBLISHED Published: 2025-10-03T18:14:29.913Z Last Updated: 2025-10-03T19:10:18.252Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-400, CWE-770 Description: An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-35
CVE ID: CVE-2025-52873 State: PUBLISHED Published: 2025-09-18T21:22:38.150Z Last Updated: 2025-09-19T13:15:17.771Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Cognex Products: In-Sight 2000 series, In-Sight 7000 series, In-Sight 8000 series, In-Sight 9000 series, In-Sight Explorer Problem Types: CWE-732 Description: Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and device reboots, which require authentication. A user with protected privileges can successfully invoke the SetSystemConfig functionality to modify relevant device properties (such as network
ivileges can successfully invoke the SetSystemConfig functionality to modify relevant device properties (such as network settings), contradicting the security model proposed in the user manual. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE ID: CVE-2025-52875 State: PUBLISHED Published: 2025-06-23T14:13:46.775Z Last Updated: 2025-06-23T17:46:52.701Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-52876 State: PUBLISHED Published: 2025-06-23T14:13:47.315Z Last Updated: 2025-06-23T17:46:33.196Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-52877 State: PUBLISHED Published: 2025-06-23T14:13:47.898Z Last Updated: 2025-06-23T16:11:17.152Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-52878 State: PUBLISHED Published: 2025-06-23T14:13:48.367Z Last Updated: 2025-06-23T15:17:33.935Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-862 Description: In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-52879 State: PUBLISHED Published: 2025-06-23T14:13:48.832Z Last Updated: 2025-06-24T14:34:54.571Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-52880 State: PUBLISHED Published: 2025-06-24T19:56:12.692Z Last Updated: 2025-06-24T20:09:48.364Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: gotson Products: komga Problem Types: CWE-799 Description: Komga is a media server for comics, mangas, BDs, magazines and eBooks. A Cross-Site Scripting (XSS) vulnerability has been discovered in versions 1.8.0 through 1.21.3 when serving EPUB resources, either directly from the API, or when reading using the epub reader. The vulnerability lets an attacker perform actions on the victim's behalf. When targeting an admin user, this can be combined with controlling a server-side command to achieve arb
ictim's behalf. When targeting an admin user, this can be combined with controlling a server-side command to achieve arbitrary code execution. For this vulnerability to be exploited, a malicious EPUB file has to be present in a Komga library, and subsequently accessed in the Epub reader by an admin user. Version 1.22.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gotson/komga/security/advisories/GHSA-m7mm-6jxp-2m4x - https://github.com/gotson/komga/commit/5f9cc449b7846ed2066752c72c9ce7b20c3a85a7
CVE ID: CVE-2025-52881 State: PUBLISHED Published: 2025-11-06T20:23:36.237Z Last Updated: 2025-11-06T21:07:09.382Z Vendors: opencontainers Products: runc Problem Types: CWE-61, CWE-363 Description: runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect c
as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm - https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x
ners/runc/security/advisories/GHSA-cgrx-mc8f-2prm - https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r - https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2 - https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480 - https://github.com/opencontainers/runc/commit/ff6fe1324663538167eca8b3d3eec61e1bd4fa51 - https://github.com/opencontainers/runc/commit/ed6b1693b8b3ae7eb0250a7e76fc888cdacf98c1 - https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64 - https://github.com/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2182165 - https://github.com/opencontainers/runc/co
thub.com/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2182165 - https://github.com/opencontainers/runc/commit/d40b3439a9614a86e87b81a94c6811ec6fa2d7d2 - https://github.com/opencontainers/runc/commit/b3dd1bc562ed9996d1a0f249e056c16624046d28 - https://github.com/opencontainers/runc/commit/77d217c7c3775d8ca5af89e477e81568ef4572db - https://github.com/opencontainers/runc/commit/77889b56db939c323d29d1130f28f9aea2edb544 - https://github.com/opencontainers/runc/commit/6fc191449109ea14bb7d61238f24a33fe08c651f - https://github.com/opencontainers/runc/commit/4b37cd93f86e72feac866442988b549b5b7bf3e6 - https://github.com/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5802c58
6e72feac866442988b549b5b7bf3e6 - https://github.com/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5802c58 - https://github.com/opencontainers/runc/commit/435cc81be6b79cdec73b4002c0dae549b2f6ae6d - https://github.com/opencontainers/runc/commit/3f925525b44d247e390e529e772a0dc0c0bc3557 - https://github.com/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.md - http://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322 - http://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3
CVE ID: CVE-2025-52882 State: PUBLISHED Published: 2025-06-24T20:01:49.595Z Last Updated: 2025-06-24T20:43:49.835Z Vendors: anthropics Products: claude-code Problem Types: CWE-1385 Description: Claude Code is an agentic coding tool. Claude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages. Claude Code for VSCode IDE extensions versions 0.2.116 through 1.0.23 are vulnerable. For Jetbrains IDE plugins, Claude Code [beta] versions 0.1.1 through 0.1.8 are vulnerable. In VSCode (and forks), exploi
For Jetbrains IDE plugins, Claude Code [beta] versions 0.1.1 through 0.1.8 are vulnerable. In VSCode (and forks), exploitation would allow an attacker to read arbitrary files, see the list of files open in the IDE, get selection and diagnostics events from the IDE, or execute code in limited situations where a user has an open Jupyter Notebook and accepts a malicious prompt. In JetBrains IDEs, an attacker could get selection events, a list of open files, and a list of syntax errors. Claude released a patch for this issue on June 13th, 2025. Although Claude Code auto-updates when a user launch it and auto-updates the extensions, users should take the following steps, though the exact steps de
when a user launch it and auto-updates the extensions, users should take the following steps, though the exact steps depend on one's integrated development environment (IDE). For VSCode, Cursor, Windsurf, VSCodium, and other VSCode forks, check the extension Claude Code for VSCode. Open the list of Extensions (View->Extensions), look for Claude Code for VSCode among installed extensions, update or uninstall any version prior to 1.0.24, and restart the IDE. For JetBrains IDEs including IntelliJ, PyCharm, and Android Studio, check the plugin Claude Code [Beta]. Open the Plugins list, look for Claude Code [Beta] among installed extensions, update or uninstall any version prior to 0.1.9, and re
ins list, look for Claude Code [Beta] among installed extensions, update or uninstall any version prior to 0.1.9, and restart the IDE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/anthropics/claude-code/security/advisories/GHSA-9f65-56v6-gxw7
CVE ID: CVE-2025-52883 State: PUBLISHED Published: 2025-06-24T20:12:59.904Z Last Updated: 2025-06-24T20:47:53.097Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: meshtastic Products: Meshtastic-Android Problem Types: CWE-1287 Description: Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct message to a victim impersonating any other node of the mesh. This message will be displayed in the same chat that the victim normally communicates with the other node and it will appear as using PKC, while it is not. This means that the victim will be provided with
s with the other node and it will appear as using PKC, while it is not. This means that the victim will be provided with a false sense of security due to the green padlock displayed when using PKC and they'll read the attacker's message as legitimate. Version 2.5.21 contains a patch for the issue. It is suggested to implement a stricter control on whether a message has been received using PKC or using the shared Meshtastic channel key. Moreover, instead of showing no green padlock icon in the chat with no PKC, consider using an explicit indicator like, for example, the yellow half-open padlock displayed when in HAM mode. This remediation, however, applies to the client applications rather th
ow half-open padlock displayed when in HAM mode. This remediation, however, applies to the client applications rather than the Meshtastic firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/meshtastic/Meshtastic-Android/security/advisories/GHSA-h4rg-g6f3-ghh7 - https://github.com/meshtastic/Meshtastic-Android/pull/1720
CVE ID: CVE-2025-52884 State: PUBLISHED Published: 2025-06-24T20:20:17.287Z Last Updated: 2025-06-24T20:49:13.684Z Vendors: risc0 Products: risc0-ethereum Problem Types: CWE-159 Description: RISC Zero is a zero-knowledge verifiable general computing platform, with Ethereum integration. The risc0-ethereum repository contains Solidity verifier contracts, Steel EVM view call library, and supporting code. Prior to versions 2.1.1 and 2.2.0, the `Steel.validateCommitment` Solidity library function will return `true` for a crafted commitment with a digest value of zero. This violates the semantics of `validateCommitment`, as this does not commitment to a block that is in the current chain. Because