Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-10979 State: PUBLISHED Published: 2025-09-25T23:02:07.534Z Last Updated: 2025-09-26T19:13:10.702Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: n/a Products: JeecgBoot Problem Types: CWE-285, CWE-266 Description: A weakness has been identified in JeecgBoot up to 3.8.2. The impacted element is an unknown function of the file /sys/role/exportXls. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CI
ted. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325850 - https://vuldb.com/?ctiid.325850 - https://vuldb.com/?submit.653337 - https://www.cnblogs.com/aibot/p/19063353
CVE ID: CVE-2025-10980 State: PUBLISHED Published: 2025-09-25T23:32:07.502Z Last Updated: 2025-09-26T19:15:16.785Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: n/a Products: JeecgBoot Problem Types: CWE-285, CWE-266 Description: A security vulnerability has been detected in JeecgBoot up to 3.8.2. This affects an unknown function of the file /sys/position/exportXls. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnr
dor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325851 - https://vuldb.com/?ctiid.325851 - https://vuldb.com/?submit.653340 - https://www.cnblogs.com/aibot/p/19063355
CVE ID: CVE-2025-10981 State: PUBLISHED Published: 2025-09-26T00:02:07.436Z Last Updated: 2025-09-26T15:18:45.375Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: n/a Products: JeecgBoot Problem Types: CWE-285, CWE-266 Description: A vulnerability was detected in JeecgBoot up to 3.8.2. This impacts an unknown function of the file /sys/tenant/exportXls. Performing manipulation results in improper authorization. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325852 - https://vuldb.com/?ctiid.325852 - https://vuldb.com/?submit.653341 - https://www.cnblogs.com/aibot/p/19063356
CVE ID: CVE-2025-10985 State: PUBLISHED Published: 2025-10-14T14:20:03.363Z Last Updated: 2025-10-21T03:55:21.843Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Mobile Problem Types: CWE-78 Description: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Endpoint-Manager-Mobile-EPMM-10-2025-Multiple-CVEs?language=en_US
CVE ID: CVE-2025-10986 State: PUBLISHED Published: 2025-10-14T14:22:08.308Z Last Updated: 2025-10-14T16:02:36.853Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Ivanti Products: Endpoint Manager Mobile Problem Types: CWE-22 Description: Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in unintended locations on disk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Endpoint-Manager-Mobile-EPMM-10-2025-Multiple-CVEs?language=en_US
CVE ID: CVE-2025-10987 State: PUBLISHED Published: 2025-09-26T00:02:10.888Z Last Updated: 2025-09-26T15:18:19.021Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: YunaiV Products: yudao-cloud Problem Types: CWE-285, CWE-266 Description: A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Request Handler. This manipulation of the argument contactId causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure b
ely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325910 - https://vuldb.com/?ctiid.325910 - https://vuldb.com/?submit.653735 - https://www.cnblogs.com/aibot/p/19063573
CVE ID: CVE-2025-10988 State: PUBLISHED Published: 2025-09-26T00:32:07.187Z Last Updated: 2025-09-26T15:17:58.863Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: YunaiV Products: ruoyi-vue-pro Problem Types: CWE-285, CWE-266 Description: A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325911 - https://vuldb.com/?ctiid.325911 - https://vuldb.com/?submit.653736 - https://www.cnblogs.com/aibot/p/19063563
CVE ID: CVE-2025-10989 State: PUBLISHED Published: 2025-09-26T00:32:10.683Z Last Updated: 2025-09-26T15:17:38.723Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: yangzongzhuan Products: RuoYi Problem Types: CWE-285, CWE-266 Description: A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorization. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Ad
the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325912 - https://vuldb.com/?ctiid.325912 - https://vuldb.com/?submit.653737 - https://www.cnblogs.com/aibot/p/19063507
CVE ID: CVE-2025-10991 State: PUBLISHED Published: 2025-09-30T00:08:25.968Z Last Updated: 2025-09-30T13:40:21.308Z Vendors: TP-Link Systems Inc. Products: Tapo D230S1 V1.20 Description: The attacker may obtain root access by connecting to the UART port and this vulnerability requires the attacker to have the physical access to the device. This issue affects Tapo D230S1 V1.20: before 1.2.2 Build 20250907. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/en/support/faq/4693/
CVE ID: CVE-2025-10992 State: PUBLISHED Published: 2025-09-26T01:32:07.831Z Last Updated: 2025-09-26T15:17:10.064Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: roncoo Products: roncoo-pay Problem Types: CWE-285, CWE-266 Description: A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/lookupList. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, ver
disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325919 - https://vuldb.com/?ctiid.325919 - https://vuldb.com/?submit.653738 - https://www.cnblogs.com/aibot/p/19063472
CVE ID: CVE-2025-10993 State: PUBLISHED Published: 2025-09-26T01:32:12.111Z Last Updated: 2025-09-26T19:19:29.971Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:ND/RC:UR) Vendors: n/a Products: MuYuCMS Problem Types: CWE-94, CWE-74 Description: A security flaw has been discovered in MuYuCMS up to 2.7. Affected by this issue is some unknown functionality of the file /admin.php of the component Template Management. The manipulation results in code injection. It is possible to launch the attack remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325921 - https://vuldb.com/?ctiid.325921 - https://vuldb.com/?submit.654014 - https://gitee.c
s: - https://vuldb.com/?id.325921 - https://vuldb.com/?ctiid.325921 - https://vuldb.com/?submit.654014 - https://gitee.com/MuYuCMS/MuYuCMS/issues/ICXVCE
CVE ID: CVE-2025-10994 State: PUBLISHED Published: 2025-09-26T02:02:07.422Z Last Updated: 2025-09-26T19:26:09.605Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Open Babel Problem Types: CWE-416, CWE-119 Description: A weakness has been identified in Open Babel up to 3.1.1. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipulation causes use after free. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325922 - https:
uld be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325922 - https://vuldb.com/?ctiid.325922 - https://vuldb.com/?submit.654057 - https://github.com/openbabel/openbabel/issues/2834 - https://github.com/user-attachments/files/22318611/poc.zip
CVE ID: CVE-2025-10995 State: PUBLISHED Published: 2025-09-26T02:02:10.346Z Last Updated: 2025-09-26T19:26:48.445Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Open Babel Problem Types: CWE-119 Description: A security vulnerability has been detected in Open Babel up to 3.1.1. This vulnerability affects the function zlib_stream::basic_unzip_streambuf::underflow in the library /src/zipstreamimpl.h. Such manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
n disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325923 - https://vuldb.com/?ctiid.325923 - https://vuldb.com/?submit.654059 - https://github.com/openbabel/openbabel/issues/2832 - https://github.com/user-attachments/files/22318572/poc.zip
CVE ID: CVE-2025-10996 State: PUBLISHED Published: 2025-09-26T02:32:06.533Z Last Updated: 2025-09-26T19:27:33.922Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Open Babel Problem Types: CWE-122, CWE-119 Description: A vulnerability was detected in Open Babel up to 3.1.1. This issue affects the function OBSmilesParser::ParseSmiles of the file /src/formats/smilesformat.cpp. Performing manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325924 - https://vuldb.c
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325924 - https://vuldb.com/?ctiid.325924 - https://vuldb.com/?submit.654060 - https://github.com/openbabel/openbabel/issues/2831 - https://github.com/user-attachments/files/22318556/poc.zip
CVE ID: CVE-2025-10997 State: PUBLISHED Published: 2025-09-26T02:32:09.748Z Last Updated: 2025-09-26T19:28:43.143Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Open Babel Problem Types: CWE-122, CWE-119 Description: A flaw has been found in Open Babel up to 3.1.1. Impacted is the function ChemKinFormat::CheckSpecies of the file /src/formats/chemkinformat.cpp. Executing manipulation can lead to heap-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325925 - https://vuldb.com/?ctiid.
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325925 - https://vuldb.com/?ctiid.325925 - https://vuldb.com/?submit.654062 - https://github.com/openbabel/openbabel/issues/2830 - https://github.com/user-attachments/files/22318543/poc.zip
CVE ID: CVE-2025-10998 State: PUBLISHED Published: 2025-09-26T03:02:07.042Z Last Updated: 2025-09-26T19:29:31.971Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Open Babel Problem Types: CWE-476, CWE-404 Description: A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
t has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325926 - https://vuldb.com/?ctiid.325926 - https://vuldb.com/?submit.654063 - https://github.com/openbabel/openbabel/issues/2829 - https://github.com/user-attachments/files/22318526/poc.zip
CVE ID: CVE-2025-10999 State: PUBLISHED Published: 2025-09-26T03:02:10.346Z Last Updated: 2025-09-26T19:30:43.265Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Open Babel Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325927 - https://vuld
ld be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325927 - https://vuldb.com/?ctiid.325927 - https://vuldb.com/?submit.654064 - https://github.com/openbabel/openbabel/issues/2827 - https://github.com/user-attachments/files/22318503/poc.zip
CVE ID: CVE-2025-11000 State: PUBLISHED Published: 2025-09-26T03:32:05.999Z Last Updated: 2025-09-26T19:34:44.618Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Open Babel Problem Types: CWE-476, CWE-404 Description: A vulnerability was determined in Open Babel up to 3.1.1. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325928 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325928 - https://vuldb.com/?ctiid.325928 - https://vuldb.com/?submit.654066 - https://github.com/openbabel/openbabel/issues/2826 - https://github.com/user-attachments/files/22318474/poc.zip
CVE ID: CVE-2025-11001 State: PUBLISHED Published: 2025-11-19T21:16:49.635Z Last Updated: 2025-11-21T05:02:05.636Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: 7-Zip Products: 7-Zip Problem Types: CWE-22 Description: 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to tra
flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-949/
CVE ID: CVE-2025-11003 State: PUBLISHED Published: 2025-11-21T07:31:55.120Z Last Updated: 2025-11-21T14:56:50.662Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: admintwentytwenty Products: UiPress lite | Effortless custom dashboards, admin themes and pages Problem Types: CWE-862 Description: The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uip_save_ui_template' function in all versions up to, and including, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to save template
ng, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to save templates that contain custom JavaScript. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a01ccc-c98e-4fcc-8eaf-721ec46584fc?source=cve - https://plugins.trac.wordpress.org/browser/uipress-lite/tags/3.5.08/admin/core/uiBuilder.php#L613 - https://plugins.trac.wordpress.org/browser/uipress-lite/tags/3.5.08/admin/classes/PostTypes/UiTemplates.php#L416
CVE ID: CVE-2025-11005 State: PUBLISHED Published: 2025-09-25T20:17:45.856Z Last Updated: 2025-09-26T17:55:52.729Z Vendors: TOTOLINK Products: X6000R Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458_B20250708. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html - https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0005/PANW-2025-0005.md
CVE ID: CVE-2025-11007 State: PUBLISHED Published: 2025-11-04T03:26:45.901Z Last Updated: 2025-11-04T18:49:41.405Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ce21com Products: CE21 Suite Problem Types: CWE-306 Description: The CE21 Suite plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the wp_ajax_nopriv_ce21_single_sign_on_save_api_settings AJAX action in versions 2.2.1 to 2.3.1. This makes it possible for unauthenticated attackers to update the plugin's API settings including a secret key used for authentication. This allows unauthenticated attackers to create new admin accounts on an aff
uding a secret key used for authentication. This allows unauthenticated attackers to create new admin accounts on an affected site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5e24feac-1812-45d7-b3c3-27787eed1cf1?source=cve - https://wordpress.org/plugins/ce21-suite/
CVE ID: CVE-2025-11008 State: PUBLISHED Published: 2025-11-04T03:26:46.726Z Last Updated: 2025-11-04T18:48:23.226Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ce21com Products: CE21 Suite Problem Types: CWE-532 Description: The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log file. This makes it possible for unauthenticated attackers to extract sensitive data including authentication credentials, which can be used to log in as other users as long as they have used the plugin's custom authentication feature before. This may include administrators, which makes a comple
they have used the plugin's custom authentication feature before. This may include administrators, which makes a complete site takeover possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/91aa86d9-8e42-4deb-b6ca-c3b388fefcb1?source=cve - https://wordpress.org/plugins/ce21-suite/
CVE ID: CVE-2025-11010 State: PUBLISHED Published: 2025-09-26T11:02:06.635Z Last Updated: 2025-09-26T12:18:04.703Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: vstakhov Products: libucl Problem Types: CWE-122, CWE-119 Description: A vulnerability has been found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_include_common of the file /src/ucl_util.c. Such manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325953
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325953 - https://vuldb.com/?ctiid.325953 - https://vuldb.com/?submit.654068 - https://github.com/vstakhov/libucl/issues/337 - https://github.com/user-attachments/files/22317650/poc.zip
CVE ID: CVE-2025-11011 State: PUBLISHED Published: 2025-09-26T11:32:08.463Z Last Updated: 2025-09-26T12:13:34.196Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: BehaviorTree Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in BehaviorTree up to 4.7.0. Affected by this issue is the function JsonExporter::fromJson of the file /src/json_export.cpp. Performing manipulation of the argument Source results in null pointer dereference. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named 4b23dcaf0ce951a31299ebdd61df69f9ce99a76d. It is suggested to install a
ade public and could be used. The patch is named 4b23dcaf0ce951a31299ebdd61df69f9ce99a76d. It is suggested to install a patch to address this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325954 - https://vuldb.com/?ctiid.325954 - https://vuldb.com/?submit.654073 - https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1008 - https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1009 - https://github.com/user-attachments/files/22270928/poc.zip - https://github.com/BehaviorTree/BehaviorTree.CPP/commit/4b23dcaf0ce951a31299ebdd61df69f9ce99a76d