Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6613 State: PUBLISHED Published: 2025-06-25T09:25:49.562Z Last Updated: 2025-06-25T13:40:06.947Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Hospital Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in PHPGurukul Hospital Management System 4.0. Affected by this vulnerability is an unknown functionality of the file /doctor/manage-patient.php. The manipulation of the argument Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313831 - https://vuldb.com/?ctiid.313831 - https://vuldb.com/?submit.602005 - https://github.com/Vanshdhawan188/Stored-XSS-Hospital-Management/blob/main/Stored-XSS-Hospital-Management.md - https://phpgurukul.com/
CVE ID: CVE-2025-6614 State: PUBLISHED Published: 2025-06-25T16:00:16.008Z Last Updated: 2025-06-26T19:49:17.217Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-619L Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetWANType_Wizard5 of the file /goform/formSetWANType_Wizard5. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer
e exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313832 - https://vuldb.com/?ctiid.313832 - https://vuldb.com/?submit.602257 - https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_75/75.md - https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_75/75.md#poc - https://www.dlink.com/
CVE ID: CVE-2025-6615 State: PUBLISHED Published: 2025-06-25T16:00:18.252Z Last Updated: 2025-06-26T19:50:49.809Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-619L Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formAutoDetecWAN_wizard4 of the file /goform/formAutoDetecWAN_wizard4. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer sup
xploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313833 - https://vuldb.com/?ctiid.313833 - https://vuldb.com/?submit.602258 - https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_76/76.md - https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_76/76.md#poc - https://www.dlink.com/
CVE ID: CVE-2025-6616 State: PUBLISHED Published: 2025-06-25T16:31:05.816Z Last Updated: 2025-06-25T20:12:08.789Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-619L Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWAN_Wizard51 of the file /goform/formSetWAN_Wizard51. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by
s been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313834 - https://vuldb.com/?ctiid.313834 - https://vuldb.com/?submit.602259 - https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_77/77.md - https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_77/77.md#poc - https://www.dlink.com/
CVE ID: CVE-2025-6617 State: PUBLISHED Published: 2025-06-25T17:00:14.369Z Last Updated: 2025-06-25T18:27:28.803Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-619L Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formAdvanceSetup of the file /goform/formAdvanceSetup. The manipulation of the argument webpage leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Ad
the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313835 - https://vuldb.com/?ctiid.313835 - https://vuldb.com/?submit.602260 - https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_78/78.md - https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_78/78.md#poc - https://www.dlink.com/
CVE ID: CVE-2025-6618 State: PUBLISHED Published: 2025-06-25T17:31:07.361Z Last Updated: 2025-06-25T17:53:30.513Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: CA300-PoE Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been classified as critical. Affected is the function SetWLanApcliSettings of the file wps.so. The manipulation of the argument PIN leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313836 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313836 - https://vuldb.com/?ctiid.313836 - https://vuldb.com/?submit.602263 - https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_44/44.md - https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_44/44.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-6619 State: PUBLISHED Published: 2025-06-25T17:31:10.779Z Last Updated: 2025-06-25T17:52:47.782Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: CA300-PoE Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. Affected by this vulnerability is the function setUpgradeFW of the file upgrade.so. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
d to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313837 - https://vuldb.com/?ctiid.313837 - https://vuldb.com/?submit.602264 - https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_45/45.md - https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_45/45.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-6620 State: PUBLISHED Published: 2025-06-25T18:00:14.138Z Last Updated: 2025-06-26T13:33:58.901Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: CA300-PoE Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been rated as critical. Affected by this issue is the function setUpgradeUboot of the file upgrade.so. The manipulation of the argument FileName leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313838 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313838 - https://vuldb.com/?ctiid.313838 - https://vuldb.com/?submit.602265 - https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_46/46.md - https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_46/46.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-6621 State: PUBLISHED Published: 2025-06-25T18:00:16.473Z Last Updated: 2025-06-26T13:33:07.803Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: CA300-PoE Problem Types: CWE-78, CWE-77 Description: A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c.884. This affects the function QuickSetting of the file ap.so. The manipulation of the argument hour/minute leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313839 - https://v
d may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313839 - https://vuldb.com/?ctiid.313839 - https://vuldb.com/?submit.602266 - https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md - https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-6624 State: PUBLISHED Published: 2025-06-26T05:00:09.954Z Last Updated: 2025-06-26T13:32:06.648Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P) Vendors: n/a Products: snyk Problem Types: CWE-532 Description: Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode. The issue affects the following Snyk commands: 1. When snyk container test or snyk container monitor commands are run against a container r
he following Snyk commands: 1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and --username/-u). 2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs. 3. When snyk iac test is executed with a Remote IAC Custom rules bundl
nyk may be written into the local CLI debug logs. 3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607 - https://github.com/snyk/cli/commit/38322f377da7e5f1391e1f641710be50989fa4df - https://github.com/snyk/cli/releases/tag/v1.1297.3 - https://docs.snyk.io/snyk-cli/debugging-the-snyk-cli - https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18
CVE ID: CVE-2025-6625 State: PUBLISHED Published: 2025-08-18T06:58:15.222Z Last Updated: 2025-08-18T12:22:54.996Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric, Schneider ELectric Products: Modicon M340, BMXNOR0200H: Ethernet / Serial RTU Module, BMXNGD0100: M580 Global Data module, BMXNOC0401: Modicon M340 X80 Ethernet Communication modules, BMXNOE0100: Modbus/TCP Ethernet Modicon M340 module, BMXNOE0110: Modbus/TCP Ethernet Modicon M340 FactoryCast module Problem Types: CWE-20 Description: CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device. A
ion vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-05.pdf
CVE ID: CVE-2025-6626 State: PUBLISHED Published: 2025-08-02T07:24:21.083Z Last Updated: 2025-08-04T14:12:57.848Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: shortpixel Products: ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization Problem Types: CWE-79 Description: The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in
This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/56ab6429-4b1b-461a-9fcd-b4be84985118?source=cve - https://plugins.trac.wordpress.org/browser/shortpixel-adaptive-images/tags/3.10.4/includes/front/vanilla-js-loader.class.php#L48 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3337681%40shortpixel-adap
ass.php#L48 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3337681%40shortpixel-adaptive-images&new=3337681%40shortpixel-adaptive-images&sfp_email=&sfph_mail=
CVE ID: CVE-2025-6627 State: PUBLISHED Published: 2025-06-25T18:31:07.699Z Last Updated: 2025-06-26T19:55:12.344Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A702R Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formIpv6Setup of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313852 - https://vuldb.com/?ctiid.313852 - https://vuldb.com/?submit.602292 - https://github.com/d2pq/cve/blob/main/616/24.md - https://github.com/d2pq/cve/blob/main/616/24.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-6631 State: PUBLISHED Published: 2025-07-29T17:53:04.135Z Last Updated: 2025-08-19T13:21:00.832Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Shared Components Problem Types: CWE-787 Description: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com
SA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE ID: CVE-2025-6632 State: PUBLISHED Published: 2025-08-06T20:42:35.541Z Last Updated: 2025-08-19T13:21:17.924Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Autodesk Products: 3ds Max Problem Types: CWE-125 Description: A maliciously crafted PSD file, when linked or imported into Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/secu
richment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0016
CVE ID: CVE-2025-6633 State: PUBLISHED Published: 2025-08-06T20:43:13.848Z Last Updated: 2025-08-19T13:21:31.765Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: 3ds Max Problem Types: CWE-787 Description: A maliciously crafted RBG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-adv
: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0016
CVE ID: CVE-2025-6634 State: PUBLISHED Published: 2025-08-06T20:43:41.404Z Last Updated: 2025-08-19T13:21:45.875Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: 3ds Max Problem Types: CWE-120 Description: A maliciously crafted TGA file, when linked or imported into Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0016
CVE ID: CVE-2025-6635 State: PUBLISHED Published: 2025-07-29T17:53:35.895Z Last Updated: 2025-08-19T13:21:59.522Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Shared Components Problem Types: CWE-125 Description: A maliciously crafted PRT file, when linked or imported into certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autode
: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE ID: CVE-2025-6636 State: PUBLISHED Published: 2025-07-29T17:54:02.053Z Last Updated: 2025-08-19T13:22:14.824Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Shared Components Problem Types: CWE-416 Description: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/s
ulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE ID: CVE-2025-6637 State: PUBLISHED Published: 2025-07-29T17:56:50.031Z Last Updated: 2025-08-19T13:22:28.965Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Shared Components Problem Types: CWE-787 Description: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com
CVE ID: CVE-2025-6638 State: PUBLISHED Published: 2025-09-12T10:46:07.934Z Last Updated: 2025-09-12T11:52:53.854Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code pat
rom inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/6a6c933f-9ce8-4ded-8b3b-2c1444c61f36 - https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be
CVE ID: CVE-2025-6639 State: PUBLISHED Published: 2025-10-25T05:31:22.323Z Last Updated: 2025-10-27T15:58:11.487Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: themeum Products: Tutor LMS Pro Problem Types: CWE-285 Description: The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutor_assignment_submit() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and edit assignment submissi
es it possible for authenticated attackers, with Subscriber-level access and above, to view and edit assignment submissions of other students. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8dc16ba4-3c2e-43e2-82a0-b742276b9640?source=cve - https://wordpress.org/plugins/tutor/#developers
CVE ID: CVE-2025-6640 State: PUBLISHED Published: 2025-06-25T21:43:23.629Z Last Updated: 2025-06-30T20:22:03.888Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-416 Description: PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack o