Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
oncurrent execution using shared resource with improper synchronization ('race condition') in Inbox COM Objects allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59282
CVE ID: CVE-2025-59284 State: PUBLISHED Published: 2025-10-14T17:00:48.588Z Last Updated: 2025-11-22T04:08:54.919Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-200 Description: Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vu
ing locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59284
CVE ID: CVE-2025-59285 State: PUBLISHED Published: 2025-10-14T17:01:46.994Z Last Updated: 2025-11-22T04:09:50.178Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Monitor Problem Types: CWE-502 Description: Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59285
CVE ID: CVE-2025-59286 State: PUBLISHED Published: 2025-10-09T21:04:15.392Z Last Updated: 2025-11-22T04:09:56.217Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft 365 Copilot's Business Chat Problem Types: CWE-77 Description: Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59286
CVE ID: CVE-2025-59287 State: PUBLISHED Published: 2025-10-14T17:01:47.629Z Last Updated: 2025-11-22T04:09:50.715Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-502 Description
tallation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-502 Description: Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
CVE ID: CVE-2025-59288 State: PUBLISHED Published: 2025-10-14T17:00:49.154Z Last Updated: 2025-11-22T04:08:55.552Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RC:C) Vendors: Microsoft Products: microsoft/playwright Problem Types: CWE-347 Description: Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59288
CVE ID: CVE-2025-59289 State: PUBLISHED Published: 2025-10-14T17:01:48.272Z Last Updated: 2025-11-22T04:09:51.164Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-415 Description: Double free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA A
indows Bluetooth Service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59289
CVE ID: CVE-2025-59290 State: PUBLISHED Published: 2025-10-14T17:00:49.650Z Last Updated: 2025-11-22T04:08:56.196Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-416 Description: Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - C
in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59290
CVE ID: CVE-2025-59291 State: PUBLISHED Published: 2025-10-14T17:00:50.205Z Last Updated: 2025-11-22T04:08:56.729Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Compute Gallery Problem Types: CWE-73 Description: External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59291
CVE ID: CVE-2025-59292 State: PUBLISHED Published: 2025-10-14T17:00:50.776Z Last Updated: 2025-11-22T04:08:57.231Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Compute Gallery Problem Types: CWE-73 Description: External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59292
CVE ID: CVE-2025-59294 State: PUBLISHED Published: 2025-10-14T17:00:51.334Z Last Updated: 2025-11-22T04:08:57.784Z Severity: LOW (CVSS 2.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, W
er Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-200 Description: Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information with a physical attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59294
CVE ID: CVE-2025-59295 State: PUBLISHED Published: 2025-10-14T17:00:51.908Z Last Updated: 2025-11-22T04:08:58.415Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607,
ver Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-122 Description: Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network. Additional Analy
ed buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59295
CVE ID: CVE-2025-59297 State: PUBLISHED Published: 2025-10-03T02:21:47.522Z Last Updated: 2025-10-07T01:03:20.129Z Vendors: Delta Electronics Products: DIAScreen Problem Types: CWE-787 Description: Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00018_DIAScreen%20File%20Parsing%20Out-Of-Bounds%20Write%20Vulnerability.pdf
CVE ID: CVE-2025-59298 State: PUBLISHED Published: 2025-10-03T02:22:49.151Z Last Updated: 2025-10-07T01:03:48.728Z Vendors: Delta Electronics Products: DIAScreen Problem Types: CWE-787 Description: Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00018_DIAScreen%20File%20Parsing%20Out-Of-Bounds%20Write%20Vulnerability.pdf
CVE ID: CVE-2025-59299 State: PUBLISHED Published: 2025-10-03T02:24:30.081Z Last Updated: 2025-10-07T01:04:04.708Z Vendors: Delta Electronics Products: DIAScreen Problem Types: CWE-787 Description: Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00018_DIAScreen%20File%20Parsing%20Out-Of-Bounds%20Write%20Vulnerability.pdf
CVE ID: CVE-2025-59300 State: PUBLISHED Published: 2025-10-03T02:24:40.509Z Last Updated: 2025-10-07T01:04:20.201Z Vendors: Delta Electronics Products: DIAScreen Problem Types: CWE-787 Description: Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00018_DIAScreen%20File%20Parsing%20Out-Of-Bounds%20Write%20Vulnerability.pdf
CVE ID: CVE-2025-59303 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T17:10:15.387Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: HAProxy Products: HAProxy Kubernetes Ingress Controller Problem Types: CWE-791 Description: HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining an ingress token secret as a response. The fixed versions of HAProxy Enterprise Kubernetes Ingress Controller are 3.0.16-ee1, 1.11.13-ee1, and 1.9.15-ee1. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
ess Controller are 3.0.16-ee1, 1.11.13-ee1, and 1.9.15-ee1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://haproxy.com/blog/cve-2025-59303-haproxy-kubernetes-ingress-controller-secret-leak
CVE ID: CVE-2025-59304 State: PUBLISHED Published: 2025-09-17T00:00:00.000Z Last Updated: 2025-09-26T16:41:54.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote attacker to achieve Remote Code Execution via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Swetrix/swetrix/pull/397 - https://www.depthfirst.com/post/anatomy-of-an-automated-patch-fixing-a-file-upload-rce-cve-2025-59304
CVE ID: CVE-2025-59305 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-25T16:29:09.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated user to invoke migration control functions. This can lead to data corruption or denial of service through unauthorized access to TRPC endpoints such as backgroundMigrations.all, backgroundMigrations.status, and backgroundMigrations.retry. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://depthfirst.com/post/how-an-authorization-flaw-reveals-a-common-security-blind-spot-cve-2025-59305
References: - https://depthfirst.com/post/how-an-authorization-flaw-reveals-a-common-security-blind-spot-cve-2025-59305-case-study
CVE ID: CVE-2025-59307 State: PUBLISHED Published: 2025-09-17T04:07:06.697Z Last Updated: 2025-09-17T12:47:18.629Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Century Corporation Products: RAID Manager Problem Types: CWE-428 Description: RAID Manager provided by Century Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.century.co.jp/support/products-info/notice-r-m.html - https://jvn.jp/en/jp/JVN84697061/
CVE ID: CVE-2025-59328 State: PUBLISHED Published: 2025-09-15T16:26:58.442Z Last Updated: 2025-11-04T21:13:48.540Z Vendors: Apache Software Foundation Products: Apache Fory Problem Types: CWE-502 Description: A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). The issue stems from the insecure deserialization of untrusted data. An attacker can supply a large, specially crafted data payload that, when processed, consumes an excessive amount of CPU resources during the deserialization process. This leads to CPU exhaustion, rendering the application or system using the Apache Fory library unresponsive and unavailable to legitimate users. Users of Apache F
application or system using the Apache Fory library unresponsive and unavailable to legitimate users. Users of Apache Fory are strongly advised to upgrade to version 0.12.2 or later to mitigate this vulnerability. Developers of libraries and applications that depend on Apache Fory should update their dependency requirements to Apache Fory 0.12.2 or later and release new versions of their software. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fory.apache.org/security/
CVE ID: CVE-2025-59330 State: PUBLISHED Published: 2025-09-15T19:19:22.213Z Last Updated: 2025-09-15T19:42:22.624Z Vendors: Qix- Products: node-error-ex Problem Types: CWE-506 Description: error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a
Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the com
ackage owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 1.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Qix-/node-error-ex/security/advisories/GHSA-6jp5-hh4c-8c5h - https://github.com/debug-js/debug/issues/1005 - https://socket.dev/blog/npm-author
rity/advisories/GHSA-6jp5-hh4c-8c5h - https://github.com/debug-js/debug/issues/1005 - https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack - https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised - https://www.ox.security/blog/npm-packages-compromised
CVE ID: CVE-2025-59331 State: PUBLISHED Published: 2025-09-15T19:21:29.858Z Last Updated: 2025-09-15T19:39:50.341Z Vendors: Qix- Products: node-is-arrayish Problem Types: CWE-506 Description: is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was use
ments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-
enting further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 0.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Qix-/node-is-arrayish/security/advisories/GHSA-frh7-2f84-v9mw - https://github.
chment: References: - https://github.com/Qix-/node-is-arrayish/security/advisories/GHSA-frh7-2f84-v9mw - https://github.com/debug-js/debug/issues/1005 - https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack - https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised - https://www.ox.security/blog/npm-packages-compromised
CVE ID: CVE-2025-59332 State: PUBLISHED Published: 2025-09-15T20:06:56.961Z Last Updated: 2025-09-15T20:41:39.570Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: dolfinus Products: 3DAlloy Problem Types: CWE-79 Description: 3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the <3d> parser tag and the {{#3d}} parser function allow users to provide custom attributes that are then appended to the canvas HTML element that is being output by the extension. The attributes are not sanitized, which means that arbitrary JavaScript can be inserted and executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dol
pt can be inserted and executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dolfinus/3DAlloy/security/advisories/GHSA-f2rp-232x-mqrh - https://github.com/dolfinus/3DAlloy/commit/9fac7936254886265ac89c8824c4816d009b7a1b
CVE ID: CVE-2025-59333 State: PUBLISHED Published: 2025-09-16T14:18:48.881Z Last Updated: 2025-09-16T18:19:09.072Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: executeautomation Products: mcp-database-server Problem Types: CWE-284 Description: The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate security controls to properly enforce a "read-only" mode. This vulnerability affects only the npm distribution; other distributions are not impacted. As a result, the server is susceptible to abuse and attacks on affected database systems such as PostgreSQL, and pot
ed. As a result, the server is susceptible to abuse and attacks on affected database systems such as PostgreSQL, and potentially others that expose elevated functionalities. These attacks may lead to denial of service and other unexpected behaviors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/executeautomation/mcp-database-server/security/advisories/GHSA-65hm-pwj5-73pw
CVE ID: CVE-2025-59334 State: PUBLISHED Published: 2025-09-16T16:48:34.887Z Last Updated: 2025-09-16T18:26:18.183Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: mohammadzain2008 Products: Linkr Problem Types: CWE-347 Description: Linkr is a lightweight file delivery system that downloads files from a webserver. Linkr versions through 2.0.0 do not verify the integrity or authenticity of .linkr manifest files before using their contents, allowing a tampered manifest to inject arbitrary file entries into a package distribution. An attacker can modify a generated .linkr manifest (for example by adding a new entry with a malicious URL) and when a user runs th