Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8553 State: PUBLISHED Published: 2025-08-05T08:32:06.027Z Last Updated: 2025-08-05T13:13:47.829Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: atjiu Products: pybbs Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0. This vulnerability affects unknown code of the file /admin/sensitive_word/list. The manipulation of the argument word leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix thi
used. The patch is identified as 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318682 - https://vuldb.com/?ctiid.318682 - https://vuldb.com/?submit.622197 - https://github.com/atjiu/pybbs/issues/206 - https://github.com/atjiu/pybbs/issues/206#issuecomment-3134773560 - https://github.com/atjiu/pybbs/issues/206#issue-3256420783 - https://github.com/atjiu/pybbs/commit/2fe4a51afbce0068c291bc1818bbc8f7f3b01a22
CVE ID: CVE-2025-8554 State: PUBLISHED Published: 2025-08-05T09:02:06.967Z Last Updated: 2025-08-05T13:13:00.962Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: atjiu Products: pybbs Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in atjiu pybbs up to 6.0.0. This issue affects some unknown processing of the file /admin/user/list. The manipulation of the argument Username leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to f
ic and may be used. The patch is named 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318683 - https://vuldb.com/?ctiid.318683 - https://vuldb.com/?submit.622198 - https://github.com/atjiu/pybbs/issues/207 - https://github.com/atjiu/pybbs/issues/207#issuecomment-3134773217 - https://github.com/atjiu/pybbs/issues/207#issue-3256426074 - https://github.com/atjiu/pybbs/commit/2fe4a51afbce0068c291bc1818bbc8f7f3b01a22
CVE ID: CVE-2025-8555 State: PUBLISHED Published: 2025-08-05T09:32:06.162Z Last Updated: 2025-08-05T13:10:49.420Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: atjiu Products: pybbs Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. Affected is an unknown function of the file /search. The manipulation of the argument keyword leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
The name of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318684 - https://vuldb.com/?ctiid.318684 - https://vuldb.com/?submit.622199 - https://github.com/atjiu/pybbs/issues/208 - https://github.com/atjiu/pybbs/issues/208#issuecomment-3134772931 - https://github.com/atjiu/pybbs/issues/208#issue-3256435530 - https://github.com/atjiu/pybbs/commit/2fe4a51afbce0068c291bc1818bbc8f7f3b01a22
CVE ID: CVE-2025-8556 State: PUBLISHED Published: 2025-08-06T08:48:17.946Z Last Updated: 2025-11-07T20:16:32.585Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Builds for Red Hat OpenShift, Custom Metric Autoscaler operator for Red Hat Openshift, Multicluster Global Hub, OpenShift Pipelines, OpenShift Serverless, OpenShift Service Mesh 3, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 8, Red Hat Developer Hub, Red Hat Edge Manager preview, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL A
d Hat Edge Manager preview, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Workspaces Operator, Red Hat OpenShift for Windows Containers, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat Trusted Application Pipeline, Red Hat Trusted Artifact Signer, Red Hat Trusted Profile Analyzer Problem Types: CWE-347 Description: A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-orde
mentation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2025-8556 - https://bugzilla.redhat.com/show_bug.cgi?id=2371624 - https://github.com/cloudflare/circl - https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm - https://github.com/cloudflare/circl/tree/v1.6.1
CVE ID: CVE-2025-8557 State: PUBLISHED Published: 2025-09-11T18:34:27.875Z Last Updated: 2025-09-11T18:56:07.128Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: XClarity Orchestrator (LXCO) Problem Types: CWE-420 Description: An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability: An attacker with access to a device on the local Lenovo XClarity Orchestrator (LXCO) network segment may be able to manipulate the local device to create an alternate communication channel which could allow the attacker, under certain conditions, to directly interact with backend LXCO API services typically inacc
could allow the attacker, under certain conditions, to directly interact with backend LXCO API services typically inaccessible to users. While access controls may limit the scope of interaction, this could result in unauthorized access to internal functionality or data. This issue is not exploitable from remote networks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-201014
CVE ID: CVE-2025-8558 State: PUBLISHED Published: 2025-11-03T18:40:03.946Z Last Updated: 2025-11-03T19:03:11.645Z Vendors: Proofpoint Products: Insider Threat Management (ITM) Server Problem Types: CWE-306 Description: Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent network to perform agent unregistration when the number of registered agents exceeds the licensed limit. Successful exploitation prevents the server from receiving new events from affected agents, resulting in a partial loss of integrity and availability with no impact to confidentiality. Additional Analyst Notes: - CIS
lting in a partial loss of integrity and availability with no impact to confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2025-003
CVE ID: CVE-2025-8559 State: PUBLISHED Published: 2025-09-30T03:35:29.725Z Last Updated: 2025-09-30T15:30:55.175Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: sanzeeb3 Products: All in One Music Player Problem Types: CWE-22 Description: The All in One Music Player plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.1 via the 'theme' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/thre
n sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a35aa722-041f-4126-b742-bcf5219424ed?source=cve - https://plugins.svn.wordpress.org/all-in-one-music-player/tags/1.3.1/src/Plugin.php - https://wordpress.org/plugins/all-in-one-music-player/#developers
CVE ID: CVE-2025-8560 State: PUBLISHED Published: 2025-09-30T03:35:26.716Z Last Updated: 2025-09-30T15:24:18.646Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ghosttoast Products: FancyTabs Problem Types: CWE-79 Description: The FancyTabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA
rary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68cdbe3e-6169-4177-873d-1028912ecad6?source=cve - https://plugins.svn.wordpress.org/fancytabs/trunk/fancytabs.php - https://wordpress.org/plugins/fancytabs/#developers
CVE ID: CVE-2025-8561 State: PUBLISHED Published: 2025-10-15T05:23:49.080Z Last Updated: 2025-10-15T17:56:14.837Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ovatheme Products: Ova Advent Problem Types: CWE-87 Description: The Ova Advent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Add
ess and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/da6bf521-0c22-4839-8fa6-a0d67e28cfbd?source=cve - https://themeforest.net/item/em4u-event-management-multipurpose-wordpress-theme/20846579 - https://themeforest.net/item/em4u-event-management-multipurpose-wordpress-theme/20846579#item-description__change_log
CVE ID: CVE-2025-8562 State: PUBLISHED Published: 2025-08-25T09:23:49.848Z Last Updated: 2025-08-25T11:29:23.453Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: peterhebert Products: Custom Query Shortcode Problem Types: CWE-22 Description: The Custom Query Shortcode plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.4.0 via the 'lens' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/thre
n sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e37c664-76ed-4ede-88fd-e41b9969685f?source=cve - https://plugins.svn.wordpress.org/custom-query-shortcode/tags/0.4.0/init.php - https://wordpress.org/plugins/custom-query-shortcode/#developers - https://plugins.trac.wordpress.org/changeset/3348818/ - https://github.com/peterhebert/custom-query-shortcode/pull/1
CVE ID: CVE-2025-8564 State: PUBLISHED Published: 2025-09-06T03:22:37.236Z Last Updated: 2025-09-08T14:05:14.558Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sonalsinha21 Products: SKT Addons for Elementor Problem Types: CWE-79 Description: The SKT Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesse
h contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8d182c47-3840-4ab7-a4b8-cfaf02586a5b?source=cve - https://wordpress.org/plugins/skt-addons-for-elementor/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3347016%40skt-addons-for-elementor&new=3347016%40skt-addons-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8565 State: PUBLISHED Published: 2025-09-18T09:31:29.072Z Last Updated: 2025-09-18T14:03:15.102Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: wplegalpages Products: Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages Problem Types: CWE-862 Description: The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the wplp_gdpr_install_plugin_ajax_handler() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, wit
_handler() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to install arbitrary repository plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed5f2c6d-a548-44c1-a07a-e33999bb164d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3355766%40wplegalpages%2Ftrunk&old=3348524%40wplegalpages%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8566 State: PUBLISHED Published: 2025-09-30T03:35:24.160Z Last Updated: 2025-09-30T15:23:43.697Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cssigniterteam Products: GutenBee – Gutenberg Blocks Problem Types: CWE-79 Description: The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via parameters in the CountUp and Google Maps Blocks in all versions up to, and including, 2.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f99e32b-3985-4c50-817e-f54245e8b9c1?source=cve - https://wordpress.org/plugins/gutenbee/
CVE ID: CVE-2025-8567 State: PUBLISHED Published: 2025-08-19T08:24:15.867Z Last Updated: 2025-08-19T13:19:06.178Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: posimyththemes Products: Nexter Blocks – WordPress Gutenberg Blocks & 1000+ Starter Templates Problem Types: CWE-79 Description: The Nexter Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that
ible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca9ad8ca-aad1-4950-b540-64ffc4a07c12?source=cve - https://wordpress.org/plugins/the-plus-addons-for-block-editor/#developers - https://plugins.trac.wordpress.org/changeset/3342664/
CVE ID: CVE-2025-8568 State: PUBLISHED Published: 2025-08-12T02:24:48.413Z Last Updated: 2025-08-12T16:00:52.821Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: prabode Products: GMap Generator Problem Types: CWE-79 Description: The GMap Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘h’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA
trary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7875d6-e866-4625-94e5-2ef8a1d11503?source=cve - https://plugins.svn.wordpress.org/gmap-venturit/trunk/google-map.php - https://wordpress.org/plugins/gmap-venturit/#developers
CVE ID: CVE-2025-8570 State: PUBLISHED Published: 2025-09-11T07:24:59.419Z Last Updated: 2025-09-11T14:37:55.743Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: beyondcart Products: BeyondCart Connector Problem Types: CWE-798 Description: The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determine_current_user filter in versions 1.4.2 through 2.1.0. This makes it possible for unauthenticated attackers to craft valid tokens and assume any user’s identity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel
user’s identity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d0dd4fc0-1c6a-4556-b219-893563a27a69?source=cve - https://wordpress.org/plugins/beyondcart/#developers
CVE ID: CVE-2025-8571 State: PUBLISHED Published: 2025-08-05T22:37:14.759Z Last Updated: 2025-08-06T20:25:03.661Z Vendors: Concrete CMS Products: Concrete CMS Problem Types: CWE-20 Description: Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thank
lnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Fortbridge https://fortbridge.co.uk/ for performing a penetration test and vulnerability assessment on Concrete CMS and reporting this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://documentation.concretecms.org/developers/introduction/version-history/8521-release-notes - https://documentation.concretecms.org/9-x/developers/introduction/version-history/943-release-notes - https://www.concretecms.org/download
CVE ID: CVE-2025-8573 State: PUBLISHED Published: 2025-08-05T22:36:48.712Z Last Updated: 2025-08-11T17:18:44.249Z Vendors: Concrete CMS Products: Concrete CMS Problem Types: CWE-20 Description: Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks sealldev (Noah Cooper) for reporting via HackerOne. Additional Analyst Notes: - CISA ADP Vulnric
/SC:N/SI:N/SA:N. Thanks sealldev (Noah Cooper) for reporting via HackerOne. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.concretecms.org/download - https://documentation.concretecms.org/9-x/developers/introduction/version-history/943-release-notes
CVE ID: CVE-2025-8575 State: PUBLISHED Published: 2025-09-12T05:24:31.396Z Last Updated: 2025-09-12T16:30:45.507Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: aurelienlws Products: LWS Cleaner Problem Types: CWE-36 Description: The LWS Cleaner plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'lws_cl_delete_file' function in all versions up to, and including, 2.4.1.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.p
files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa37025a-7f20-4cfe-a7d0-38168f49b6d9?source=cve - https://plugins.trac.wordpress.org/browser/lws-cleaner/trunk/lws-cleaner.php#L1144 - https://plugins.trac.wordpress.org/changeset/3359598/
CVE ID: CVE-2025-8576 State: PUBLISHED Published: 2025-08-07T01:30:38.461Z Last Updated: 2025-08-12T03:55:10.390Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/414760982
CVE ID: CVE-2025-8577 State: PUBLISHED Published: 2025-08-07T01:30:38.705Z Last Updated: 2025-08-07T13:38:34.937Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/384050903
CVE ID: CVE-2025-8578 State: PUBLISHED Published: 2025-08-07T01:30:38.991Z Last Updated: 2025-08-12T03:55:09.146Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/423387026