Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-53882 State: PUBLISHED Published: 2025-07-23T09:31:18.547Z Last Updated: 2025-09-03T07:23:06.351Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: SUSE Products: openSUSE Tumbleweed Problem Types: CWE-807 Description: A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sent SIGHUP to arbitrary processes. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53882
CVE ID: CVE-2025-53883 State: PUBLISHED Published: 2025-10-30T10:50:07.580Z Last Updated: 2025-10-31T03:55:20.245Z Vendors: SUSE Products: Container suse manager 5.0, SUSE Manager Server LTS 4.3 Problem Types: CWE-80 Description: A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-202
13.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53883
CVE ID: CVE-2025-53884 State: PUBLISHED Published: 2025-09-17T12:27:03.128Z Last Updated: 2025-09-17T13:24:19.979Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SUSE Products: neuvector Problem Types: CWE-759 Description: NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53884 - https://github.com/neuvector/neuvector/security/advisories/GHSA-8ff6-pc43-jwv3
CVE ID: CVE-2025-53885 State: PUBLISHED Published: 2025-07-14T23:18:57.503Z Last Updated: 2025-07-15T13:43:35.843Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-532 Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template string. Malicious admins can log sensitive data from other users when they are created or updated. Version 11.9.0 contains a fix for the issue
ns can log sensitive data from other users when they are created or updated. Version 11.9.0 contains a fix for the issue. As a workaround, avoid logging sensitive data to the console outside the context of development. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-x3vm-88hf-gpxp - https://github.com/directus/directus/pull/25355 - https://github.com/directus/directus/commit/859f664f56fb50401c407b095889cea38ff580e5 - https://github.com/directus/directus/releases/tag/v11.9.0
CVE ID: CVE-2025-53886 State: PUBLISHED Published: 2025-07-14T23:35:56.448Z Last Updated: 2025-07-15T13:41:18.865Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-200, CWE-212, CWE-532 Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are logged including security sensitive data like access and refresh tokens in cookies. Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them trigge
s. Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the Flow. Version 11.9.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-f24x-rm6g-3w5v - https://github.com/directus/directus/pull/25354 - https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb - https://github.com/directus/directus/releases/tag/v11.9.0
CVE ID: CVE-2025-53887 State: PUBLISHED Published: 2025-07-14T23:40:59.198Z Last Updated: 2025-07-15T19:49:03.448Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-200 Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the `/server/specs/oas` endpoint without authentication. With the exact version information a malicious attacker can look for known vulnerabilities in Directus core or any of its s
h the exact version information a malicious attacker can look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. Version 11.9.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-rmjh-cf9q-pv7q - https://github.com/directus/directus/pull/25353 - https://github.com/directus/directus/commit/e74f3e4e92edc33b5f83eefb001a3d2a85af17a3 - https://github.com/directus/directus/releases/tag/v11.9.0
CVE ID: CVE-2025-53888 State: PUBLISHED Published: 2025-07-18T15:32:15.856Z Last Updated: 2025-07-18T15:47:07.789Z Vendors: RIOT-OS Products: RIOT Problem Types: CWE-120 Description: RIOT-OS, an operating system that supports Internet of Things devices, has an ineffective size check implemented with `assert()` can lead to buffer overflow in versions up to and including 2025.04. Assertions are usually compiled out in production builds. If assertions are the only defense against untrusted inputs, the software may be exposed to attacks that utilize the lack of proper input checks. In the `l2filter_add()` function shown below, `addr_len` is checked using an assertion and is subsequently used as
cks. In the `l2filter_add()` function shown below, `addr_len` is checked using an assertion and is subsequently used as an argument in a `memcpy()` call. When assertions are disabled, there would be no size check for `addr_len`. As a consequence, if an attacker were to provide an `addr_len` value larger than `CONFIG_L2FILTER_ADDR_MAXLEN`, they can trigger a buffer overflow and write past the `list[i].addr` buffer. If the unchecked input is attacker-controlled, the impact of the buffer overflow can range from a denial of service to arbitrary code execution. Commit f6f7de4ccc107c018630e4c15500825caf02e1c2 contains a patch for the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment
107c018630e4c15500825caf02e1c2 contains a patch for the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-7972-w7f9-3j9m - https://github.com/RIOT-OS/RIOT/commit/f6f7de4ccc107c018630e4c15500825caf02e1c2 - https://github.com/RIOT-OS/RIOT/blob/2025.04/sys/net/link_layer/l2filter/l2filter.c#L47
CVE ID: CVE-2025-53889 State: PUBLISHED Published: 2025-07-14T23:50:23.283Z Last Updated: 2025-07-15T19:48:56.003Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: directus Products: directus Problem Types: CWE-287 Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a manual trigger are not validating whether the user triggering the Flow has permissions to the items provided as payload to the Flow. Depending on what the Flow is set up to do this can lead to the Flow executing potential tasks on the attacker's behalf without authenticating. Bad
is set up to do this can lead to the Flow executing potential tasks on the attacker's behalf without authenticating. Bad actors could execute the manual trigger Flows without authentication, or access rights to the said collection(s) or item(s). Users with manual trigger Flows configured are impacted as these endpoints do not currently validate if the user has read access to `directus_flows` or to the relevant collection/items. The manual trigger Flows should have tighter security requirements as compared to webhook Flows where users are expected to perform do their own checks. Version 11.9.0 fixes the issue. As a workaround, implement permission checks for read access to Flows and read acce
cks. Version 11.9.0 fixes the issue. As a workaround, implement permission checks for read access to Flows and read access to relevant collection/items. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-7cvf-pxgp-42fc - https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb - https://github.com/directus/directus/releases/tag/v11.9.0
CVE ID: CVE-2025-53890 State: PUBLISHED Published: 2025-07-14T23:57:09.574Z Last Updated: 2025-07-15T19:48:50.099Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pyload Products: pyload Problem Types: CWE-94 Description: pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially the backend server. Exploitation requires no user interaction or authentication and can result in session hijacking, credential theft, and full system remote code execution. Commit 909e5c978
ntication and can result in session hijacking, credential theft, and full system remote code execution. Commit 909e5c97885237530d1264cfceb5555870eb9546, the patch for the issue, is included in version 0.5.0b3.dev89. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pyload/pyload/security/advisories/GHSA-8w3f-4r8f-pf53 - https://github.com/pyload/pyload/pull/4586 - https://github.com/pyload/pyload/commit/909e5c97885237530d1264cfceb5555870eb9546
CVE ID: CVE-2025-53891 State: PUBLISHED Published: 2025-07-15T00:07:20.570Z Last Updated: 2025-07-15T19:48:43.365Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: TimeLineOfficial Products: Time-Line- Problem Types: CWE-434 Description: The timelineofficial/Time-Line- repository contains the source code for the TIME LINE website. A vulnerability was found in the TIME LINE website where uploaded files (instruction/message media) are not strictly validated for type and size. A user may upload renamed or oversized files that can disrupt performance or bypass restrictions. This could result in malicious file upload, denial of service, or client-side crashes. Ver
mance or bypass restrictions. This could result in malicious file upload, denial of service, or client-side crashes. Version 1.0.5 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TimeLineOfficial/Time-Line-/security/advisories/GHSA-rvxq-q975-8vv2
CVE ID: CVE-2025-53892 State: PUBLISHED Published: 2025-07-16T13:42:09.383Z Last Updated: 2025-07-22T14:58:34.382Z Vendors: intlify Products: vue-i18n Problem Types: CWE-79 Description: Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even wh
erpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph - https://github.com/intlify/vue-i18n/pull/2229 - https://github.com/intlify/vue-i18n/pull/2230 - https://github.com/intlify/vue-i18n/commit/49f982443ab8fd94ecc427b265ce97d57df94d7e - https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab09
2443ab8fd94ecc427b265ce97d57df94d7e - https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab099 - https://github.com/intlify/vue-i18n/releases/tag/v10.0.8 - https://github.com/intlify/vue-i18n/releases/tag/v11.1.10 - https://github.com/intlify/vue-i18n/releases/tag/v9.14.5
CVE ID: CVE-2025-53893 State: PUBLISHED Published: 2025-07-15T17:47:30.856Z Last Updated: 2025-07-15T18:44:39.994Z Vendors: filebrowser Products: filebrowser Problem Types: CWE-400, CWE-789 Description: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.38.0, a Denial of Service (DoS) vulnerability exists in the file processing logic when reading a file on endpoint `Filebrowser-Server-IP:PORT/files/{file-name}` . While the server correctly handles and stores uploaded files, it attempts to load the entire content into memory during read operations without size checks or resource limit
d files, it attempts to load the entire content into memory during read operations without size checks or resource limits. This allows an authenticated user to upload a large file and trigger uncontrolled memory consumption on read, potentially crashing the server and making it unresponsive. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7xqm-7738-642x - https://github.com/filebrowser/filebrowser/issues/5294
CVE ID: CVE-2025-53895 State: PUBLISHED Published: 2025-07-15T16:39:00.635Z Last Updated: 2025-07-15T17:19:29.391Z Vendors: zitadel Products: zitadel Problem Types: CWE-863, CWE-384 Description: ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for upd
and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-6c5p-6www-pcmr - https://github.com/zitadel/zitadel/releases/tag/v2.70.14 - https://github.com/zitadel/zitadel/releases/tag/v2.71.13 - https://github.com/zitadel/zitadel/releases/tag/v3.3.2 - https://github.com/zitadel/zitadel/releases/tag/v4.0.0-rc.2
CVE ID: CVE-2025-53901 State: PUBLISHED Published: 2025-07-18T17:10:11.815Z Last Updated: 2025-07-18T17:31:45.514Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: bytecodealliance Products: wasmtime Problem Types: CWE-672 Description: Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder). The specific bug is triggered by calling `path_open` after calling `fd_renumber` with either two equal argument values or a second argument being equal to a previously-closed file descriptor number value
th either two equal argument values or a second argument being equal to a previously-closed file descriptor number value. The corrupt state introduced in `fd_renumber` will lead to the subsequent opening of a file descriptor to panic. This panic cannot introduce memory unsafety or allow WebAssembly to break outside of its sandbox, however. There is no possible heap corruption or memory unsafety from this panic. This bug is in the implementation of Wasmtime's `wasmtime-wasi` crate which provides an implementation of WASIp1. The bug requires a specially crafted call to `fd_renumber` in addition to the ability to open a subsequent file descriptor. Opening a second file descriptor is only possib
number` in addition to the ability to open a subsequent file descriptor. Opening a second file descriptor is only possible when a preopened directory was provided to the guest, and this is common amongst embeddings. A panic in the host is considered a denial-of-service vector for WebAssembly embedders and is thus a security issue in Wasmtime. This bug does not affect WASIp2 and embedders using components. In accordance with Wasmtime's release process, patch releases are available as 24.0.4, 33.0.2, and 34.0.2. Users of other release of Wasmtime are recommended to move to a supported release of Wasmtime. Embedders who are using components or are not providing guest access to create more file
supported release of Wasmtime. Embedders who are using components or are not providing guest access to create more file descriptors (e.g. via a preopened filesystem directory) are not affected by this issue. Otherwise, there is no workaround at this time, and affected embeddings are recommended to update to a patched version which will not cause a panic in the host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-fm79-3f68-h2fc - https://docs.wasmtime.dev/security-what-is-considered-a-security-vulnerability.html - https://docs.wasmtime.dev/stability-release.html - https://github.com/WebAssembly/WASI/blob/e
urity-vulnerability.html - https://docs.wasmtime.dev/stability-release.html - https://github.com/WebAssembly/WASI/blob/e1aa1cae4dda4c1f70f23fe11e922aae92f240a8/legacy/preview1/witx/wasi_snapshot_preview1.witx#L245-L260 - https://github.com/bytecodealliance/wasmtime/blob/037a6edadbc225decbea00a551aabf04203717d9/crates/wasi/src/preview1.rs#L1824-L1836
CVE ID: CVE-2025-53902 State: PUBLISHED Published: 2025-07-29T19:36:10.910Z Last Updated: 2025-07-29T19:41:49.056Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-863 Description: Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5, users may potentially access confidential information from artifacts that they are not authorized to view. This is fixed in Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Editio
ized to view. This is fixed in Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-6f24-5v47-rj6j - https://github.com/Enalean/tuleap/commit/ebe054df8a2672afee41af84e5ba14b57ef8b789 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ebe054df8a2672afee41af84e5ba14b57ef8b789 - https://tuleap.net/plugins/tracker/?aid=43704
CVE ID: CVE-2025-53903 State: PUBLISHED Published: 2025-07-15T18:22:37.438Z Last Updated: 2025-07-15T18:36:46.822Z Vendors: The-Scratch-Channel Products: the-scratch-channel.github.io Problem Types: CWE-79 Description: The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/users.js` doesn't properly sanitize text box inputs, leading to a potential vulnerability to cross-site scripting attacks. Commit 90b39eb56b27b2bac29001abb1a3cac0964b8ddb addresses this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/The-Scratch-Channel/the-scratch-channel.github.io/security/advisories/GHSA-25wp-g9g6-7fr9 - https
: - https://github.com/The-Scratch-Channel/the-scratch-channel.github.io/security/advisories/GHSA-25wp-g9g6-7fr9 - https://github.com/The-Scratch-Channel/the-scratch-channel.github.io/commit/90b39eb56b27b2bac29001abb1a3cac0964b8ddb
CVE ID: CVE-2025-53904 State: PUBLISHED Published: 2025-07-16T17:02:01.404Z Last Updated: 2025-07-18T14:27:37.622Z Vendors: The-Scratch-Channel Products: the-scratch-channel.github.io Problem Types: CWE-79, CWE-692 Description: The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/admin.js` contains code that could make the website vulnerable to cross-site scripting. No known patches exist as of time of publication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/The-Scratch-Channel/the-scratch-channel.github.io/security/advisories/GHSA-hgh4-pj74-f5rr - https://github.com/The-Scratch-Channel/the-scratch-
-scratch-channel.github.io/security/advisories/GHSA-hgh4-pj74-f5rr - https://github.com/The-Scratch-Channel/the-scratch-channel.github.io/blob/main/api/admin.js#L18
CVE ID: CVE-2025-53905 State: PUBLISHED Published: 2025-07-15T20:48:34.764Z Last Updated: 2025-11-04T21:12:41.157Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L) Vendors: vim Products: vim Problem Types: CWE-22 Description: Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process e
riting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1552 contains a patch for the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vim/vim/security/advisories/GHSA-74v4-f3x9-ppvr - https://github.com/vim/vim/commit/87757c6b0a4b2c1f71c72ea8e1438b8fb116b2
m/vim/security/advisories/GHSA-74v4-f3x9-ppvr - https://github.com/vim/vim/commit/87757c6b0a4b2c1f71c72ea8e1438b8fb116b239
CVE ID: CVE-2025-53906 State: PUBLISHED Published: 2025-07-15T20:52:40.137Z Last Updated: 2025-11-04T21:12:42.458Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L) Vendors: vim Products: vim Problem Types: CWE-22 Description: Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process e