Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-55343 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-05T19:20:45.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via busqueda/busqueda.php txt_depe_codi, busqueda/busqueda.php txt_usua_codi, anexos_lista.php radi_temp, Administracion/listas/formArea_ajax.php codDepe, Administracion/listas/formDepeHijo_ajax.php codDepe, Administracion/listas/formDepePadre_ajax.php codInst, asociar_documentos/asociar_borrar_referencia.php radi_nume, asociar_documentos/asociar_documento_buscar_query.php radi_nume, asociar_documentos/asociar_documento_grabar.php tx
ume, asociar_documentos/asociar_documento_buscar_query.php radi_nume, asociar_documentos/asociar_documento_grabar.php txt_radi_nume, asociar_documentos/asociar_documento radi_nume, radicacion/buscar_usuario.php buscar_tipo, radicacion/formArea_ajax.php codDepe, radicacion/formDepeHijo_ajax.php codDepe, radicacion/formDepePadre_ajax.php codInst, radicacion/ver_datos_usuario.php destinatorio, reportes/reporte_TraspasoDocFisico.php verrad, tx/datos_imprimir_sobre.php txt_usua_codi, tx/datos_imprimir_sobre.php nume_radi_temp, tx/revertir_firma_digital_grabar.php txt_radi_nume, tx/tx_borrar_opcion_imp.php codigo_opc, tx/tx_realizar_tx.php txt_radicados, tx/tx_seguridad_documentos.php txt_radicado
tx/tx_borrar_opcion_imp.php codigo_opc, tx/tx_realizar_tx.php txt_radicados, tx/tx_seguridad_documentos.php txt_radicados, or uploadFiles/cargar_doc_digitalizado_paginador.php txt_depe_codi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://minka.gob.ec/quipux-comunitario/quipux-comunitario - https://seguridaddigital.ec/research/20251101/report-20251101.en.pdf
CVE ID: CVE-2025-55345 State: PUBLISHED Published: 2025-08-13T08:55:14.016Z Last Updated: 2025-08-13T19:58:27.552Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Problem Types: CWE-61 Description: Using Codex CLI in workspace-write mode inside a malicious context (repo, directory, etc) could lead to arbitrary file overwrite and potentially remote code execution due to symlinks being followed outside the allowed current working directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/codex-cli-symlink-arbitrary-file-overwrite-jfsa-2025-001378631/ - https://github.com/openai/codex/pull/1705
CVE ID: CVE-2025-55346 State: PUBLISHED Published: 2025-08-14T09:49:52.293Z Last Updated: 2025-08-14T15:44:20.060Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-94 Description: User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/flowise-js-injection-remote-code-exection-jfsa-2025-001379925/
CVE ID: CVE-2025-55366 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T19:50:51.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://jsherp.com - https://github.com/jishenghua/jshERP - https://github.com/cina666/CVE/blob/main/jshERP/CVE-2025-55366.md
CVE ID: CVE-2025-55367 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T19:52:07.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://jsherp.com - https://github.com/jishenghua/jshERP - https://github.com/cina666/CVE/blob/main/jshERP/CVE-2025-55367.md
CVE ID: CVE-2025-55368 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T14:50:02.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://jsherp.com - https://github.com/jishenghua/jshERP - https://github.com/cina666/CVE/blob/main/jshERP/CVE-2025-55368.md
CVE ID: CVE-2025-55370 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T14:49:14.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://jsherp.com - https://github.com/jishenghua/jshERP - https://github.com/cina666/CVE/blob/main/jshERP/%E8%B6%8A%E6%9D%83%E8%8E%B7%E5%8F%96%E4%BB%BB%E6%84%8F%E8%B4%A6%E5%8F%B7%E4%BF%A1%E6%81%AF%E5%AE%9E%E7%8E%B0%E4%BB%BB%E6%84%8F%E7%99%BB%E5%BD%95.md
CVE ID: CVE-2025-55371 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T19:53:13.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the handler by executing the getAllList method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://jsherp.com - https://github.com/jishenghua/jshERP - https://github.com/cina666/CVE/blob/main/jshERP/%E8%B6%8A%E6%9D%83%E8%87%B4%E4%BB%BB%E6%84%8F%E6%8E%A5%E7%AE%A1%E8%B4%A6%E5%8F%B7.md
CVE ID: CVE-2025-55372 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-03T19:49:49.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstorm.news/files/id/208951/
CVE ID: CVE-2025-55373 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-02T19:51:43.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commands with Administrator rights. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://beakon.com.au - http://beakon.com - https://packetstorm.news/files/id/208952/
CVE ID: CVE-2025-55383 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T15:08:40.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moss before v0.15 has a file upload vulnerability. The "upload" function configuration allows attackers to upload files of any extension to any location on the target server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/deep-project/moss/issues/16
CVE ID: CVE-2025-55398 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:07:57.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in mouse07410 asn1c thru 0.9.29 (2025-03-20) - a fork of vlm asn1c. In UPER (Unaligned Packed Encoding Rules), asn1c-generated decoders fail to enforce INTEGER constraints when the bound is positive and exceeds 32 bits in length, potentially allowing incorrect or malicious input to be processed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mouse07410/asn1c/issues/222
CVE ID: CVE-2025-55409 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-25T15:47:43.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. This allows attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://foxcms.com - https://www.notion.so/CVE-2025-55409-2222b2fd0210804facb7cfe5d9db1ebd
CVE ID: CVE-2025-55420 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T15:49:04.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6. When a crafted script is sent via a GET request, it is reflected unsanitized into the HTML response. This permits execution of arbitrary JavaScript code when a logged-in user submits the malicious input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.notion.so/FoxCMS-V1-2-6-Reflected-XSS-in-index-php-2222b2fd021080589d27ef8e1b9ebd86?source=copy_link
CVE ID: CVE-2025-55422 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T17:53:09.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://foxcms.com - https://www.notion.so/CVE-2025-55422-2222b2fd0210803c8ae8cfefeb5e9c88
CVE ID: CVE-2025-55443 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-27T14:05:54.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details (IP/port) that are stored in plaintext within log files on the device's external storage. This allows attackers with access to these logs to: 1. Authenticate to the MDM web platform to execute administrative operations (device shutdown/factory reset/software installation); 2. Connect to the MQTT server to intercept/publish device data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
the MQTT server to intercept/publish device data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/raiji1n/a2ce5dd46c312e3bd38b9b2446b95860
CVE ID: CVE-2025-55444 State: PUBLISHED Published: 2025-08-20T00:00:00.000Z Last Updated: 2025-08-21T13:47:10.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0. A remote attacker can inject arbitrary SQL queries, leading to database enumeration and potential remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Anudeepkadambala/88c6065f1de1597be96e50a573cde56e - https://github.com/mathurvishal/Online-Artwork-and-Fine-Arts-MCA-Major-Project - https://github.com/Anudeepkadambala/CVE-Repor
//github.com/mathurvishal/Online-Artwork-and-Fine-Arts-MCA-Major-Project - https://github.com/Anudeepkadambala/CVE-Reports/security/advisories/GHSA-r4mf-mr9h-f27m - https://github.com/Anudeepkadambala/CVE-Reports/blob/main/CVE-2025-55444_Disclosure.md
CVE ID: CVE-2025-55454 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:06:57.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated arbitrary file upload vulnerability in the component /msg/sendfiles of DooTask v1.0.51 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.notion.so/Dootask-Arbitrary-file-upload-vulnerability-2162818a9e118053a586cf4bc05fd1fa
CVE ID: CVE-2025-55455 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-25T16:00:19.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: DooTask v1.0.51 was dicovered to contain an authenticated arbitrary download vulnerability via the component /msg/sendtext. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.notion.so/Dootask-arbitrary-file-download-vulnerability-2172818a9e11804087d3c6829289ebbd?source=copy_link - https://www.notion.so/Dootask-arbitrary-file-download-vulnerability-2172818a9e11804087d3c6829289ebbd
CVE ID: CVE-2025-55472 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-02T19:49:38.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of user-supplied input in the columns[0][data] parameter, which is directly used in SQL queries without proper validation or parameterization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tirrenotechnologies/tirreno - https://github.com/tirrenotechnologies/tirreno/releases/tag/v0.9.6 - https://cyberducky.medium.com/blind-sql-injecti
o - https://github.com/tirrenotechnologies/tirreno/releases/tag/v0.9.6 - https://cyberducky.medium.com/blind-sql-injection-found-in-tirreno-security-analytics-cbd791cec1c0
CVE ID: CVE-2025-55473 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-02T19:50:31.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: Asian Arts Talents Foundation (AATF) Website v5.1.x and Docker version 2024.12.8.1 are vulnerable to Cross Site Scripting (XSS). The vulnerability exists in the /ip.php endpoint, which processes and displays the X-Forwarded-For HTTP header without proper sanitization or output encoding. This allows an attacker to inject malicious JavaScript code that will execute in visitor browsers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hub.docker.com/r/aatf/aatf.us - https://github.com/AATF/aatf.us -
Notes: - CISA ADP Vulnrichment: References: - https://hub.docker.com/r/aatf/aatf.us - https://github.com/AATF/aatf.us - https://cyber-ducky.com/xss-found-in-asian-arts-talent-foundation-2/
CVE ID: CVE-2025-55474 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-02T19:43:25.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious Markdown files to execute JavaScript when viewed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/brufdev/many-notes/releases/tag/v0.10.2 - https://cyber-ducky.com/stored-xss-found-in-many-notes-the-best-note-taking-app/ - https://medium.com/@cyberducky/how-i-found-a-stored-xss-in-markdown-rendering-e73cfc3cd93a
CVE ID: CVE-2025-55476 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-02T19:48:50.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint: GET /api/videos/public?sort= This parameter is unsafely evaluated in a SQL ORDER BY clause without proper sanitization, allowing an attacker to inject arbitrary SQL subqueries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ShaneIsrael/fireshare/issues/311 - https://github.com/ShaneIsrael/fireshare/releases/tag/v1.2.26 - https://cyber-ducky.com/blind-sql-injection-
ssues/311 - https://github.com/ShaneIsrael/fireshare/releases/tag/v1.2.26 - https://cyber-ducky.com/blind-sql-injection-in-fireshare-found-in-an-api-sort-parameter/
CVE ID: CVE-2025-55482 State: PUBLISHED Published: 2025-08-20T00:00:00.000Z Last Updated: 2025-08-20T15:04:40.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the formSetCfm function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/formSetCfm/poc.md
CVE ID: CVE-2025-55483 State: PUBLISHED Published: 2025-08-20T00:00:00.000Z Last Updated: 2025-08-20T15:03:42.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the function formSetMacFilterCfg via the parameters macFilterType and deviceList. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/formSetMacFilterCfg/poc.md
CVE ID: CVE-2025-55495 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T19:31:13.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/fromSetIpMacBind/poc.md
CVE ID: CVE-2025-55498 State: PUBLISHED Published: 2025-08-20T00:00:00.000Z Last Updated: 2025-08-20T15:06:42.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/fromSetSysTime/poc.md
CVE ID: CVE-2025-55499 State: PUBLISHED Published: 2025-08-20T00:00:00.000Z Last Updated: 2025-08-20T14:20:34.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the ntpServer parameter in the fromSetSysTime function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/fromSetSysTime/poc.md
CVE ID: CVE-2025-55503 State: PUBLISHED Published: 2025-08-20T00:00:00.000Z Last Updated: 2025-08-20T13:58:49.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 V15.03.06.23_multi has a stack overflow vulnerability via the deviceName parameter in the saveParentControlInfo function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/saveParentControlInfo/poc.md
CVE ID: CVE-2025-55521 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T18:48:13.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/akaunting/akaunting - https://nvd.nist.gov/vuln/detail/CVE-2021-36802 - https://github.com/vityuasd/VulList/blob/main/vul_2.md
CVE ID: CVE-2025-55522 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T19:10:36.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/akaunting/akaunting/tree/3.1.18 - https://github.com/vityuasd/VulList/blob/main/vul_1.md
CVE ID: CVE-2025-55523 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T19:20:29.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frdel/agent-zero/blob/v0.8.7/python/api/download_work_dir_file.py - https://www.cve.org/CVERecord?id=CVE-2025-6166 - https://github.com/agent0ai/agent-zero/issues/687
CVE ID: CVE-2025-55524 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T18:07:35.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frdel/agent-zero/blob/v0.8.7/python/api/restart.py - https://github.com/vityuasd/VulList/blob/main/vul_3.md
CVE ID: CVE-2025-55526 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-27T14:24:24.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Zie619/n8n-workflows/issues/48
CVE ID: CVE-2025-55551 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-29T17:37:31.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/issues/151401 - https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc
CVE ID: CVE-2025-55552 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-29T17:35:00.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/issues/147847 - https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc
CVE ID: CVE-2025-55553 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-29T17:30:11.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/issues/151432 - https://github.com/pytorch/pytorch/pull/154645 - https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc
CVE ID: CVE-2025-55554 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-26T19:57:13.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/issues/151510 - https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc
CVE ID: CVE-2025-55556 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-26T19:58:38.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/issues/82317 - https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc
CVE ID: CVE-2025-55557 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-29T16:14:32.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/issues/151738 - https://github.com/pytorch/pytorch/pull/151931 - https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc