Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
il notification settings. This has been fixed in Formie 2.1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/verbb/formie/security/advisories/GHSA-2xm2-23ff-p8ww
CVE ID: CVE-2025-32427 State: PUBLISHED Published: 2025-04-11T13:42:13.854Z Last Updated: 2025-04-11T14:48:00.321Z Vendors: verbb Products: formie Problem Types: CWE-79 Description: Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers w
of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export. This vulnerability is fixed in 2.1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/verbb/formie/security/advisories/GHSA-p9hh-mh5x-wvx3
CVE ID: CVE-2025-32428 State: PUBLISHED Published: 2025-04-14T23:29:40.494Z Last Updated: 2025-04-15T02:54:15.365Z Vendors: jupyterhub Products: jupyter-remote-desktop-proxy Problem Types: CWE-668 Description: Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network. This vulnerability does not affect users having TurboVNC as the vncserver executable. This issue is fixed in 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
urboVNC as the vncserver executable. This issue is fixed in 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jupyterhub/jupyter-remote-desktop-proxy/security/advisories/GHSA-vrq4-9hc3-cgp7 - https://github.com/jupyterhub/jupyter-remote-desktop-proxy/commit/7dd54c25a4253badd8ea68895437e5a66a59090d
CVE ID: CVE-2025-32429 State: PUBLISHED Published: 2025-07-24T22:22:35.102Z Last Updated: 2025-07-25T13:32:47.835Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-89 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vr59-gm53-v7cq - h
CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vr59-gm53-v7cq - https://github.com/xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101 - https://github.com/xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3 - https://jira.xwiki.org/browse/XWIKI-23093
CVE ID: CVE-2025-32430 State: PUBLISHED Published: 2025-08-05T23:27:07.471Z Last Updated: 2025-08-06T20:27:07.444Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, two templates contain reflected XSS vulnerabilities, allowing an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL. This permits the attacker to perform arbitrary actions using the permissions of the victim.
an attacker-controlled URL. This permits the attacker to perform arbitrary actions using the permissions of the victim. This issue is fixed in versions 16.4.8, 16.10.6 and 17.3.0-rc-1. To workaround the issue, manually patch the WAR with the same changes as the original patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m9x4-w7p9-mxhx - https://github.com/xwiki/xwiki-platform/commit/e5926a938cbecc8b1eaa48053d8d370cff107cb0 - https://jira.xwiki.org/browse/XWIKI-23096
CVE ID: CVE-2025-32431 State: PUBLISHED Published: 2025-04-21T15:34:04.637Z Last Updated: 2025-04-21T15:55:15.087Z Vendors: traefik Products: traefik Problem Types: CWE-22 Description: Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions
arget a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.24, 3.3.6, and 3.4.0-rc2. A workaround involves adding a `PathRegexp` rule to the matcher to prevent matching a route with a `/../` in the path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/traefik/traefik/security/advisories/GHSA-6p68-w45g-48j7 - https://github.com/traefik/traefik/pull/11684 - https://github.com/traefik/traefik/releases/tag/v2.11.24 - https://github.com/traefik/traefik/releases/tag/v3.3.6 - https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2
CVE ID: CVE-2025-32432 State: PUBLISHED Published: 2025-04-25T15:04:06.272Z Last Updated: 2025-04-29T03:55:14.713Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: craftcms Products: cms Problem Types: CWE-94 Description: Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892. Additional Analyst
as been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3 - https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47 - https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical - https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical - https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical
CVE ID: CVE-2025-32433 State: PUBLISHED Published: 2025-04-16T21:34:37.457Z Last Updated: 2025-11-03T19:53:28.075Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: erlang Products: otp Problem Types: CWE-306 Description: Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-
ess to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 - https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12 - https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f - https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891
CVE ID: CVE-2025-32434 State: PUBLISHED Published: 2025-04-18T15:48:18.851Z Last Updated: 2025-04-18T16:06:51.966Z Vendors: pytorch Products: pytorch Problem Types: CWE-502 Description: PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6
CVE ID: CVE-2025-32435 State: PUBLISHED Published: 2025-04-15T22:19:46.856Z Last Updated: 2025-04-16T13:32:55.159Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: NixOS Products: hydra Problem Types: CWE-95 Description: Hydra is a Continuous Integration service for Nix based projects. Evaluation of untrusted non-flake nix code could potentially access secrets that are accessible by the hydra user/group. This should not affect the signing keys, that are owned by the hydra-queue-runner and hydra-www users respectively. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NixOS/hydra/security/advisories/GHSA-j7w7-965w-vjxw - https://
- CISA ADP Vulnrichment: References: - https://github.com/NixOS/hydra/security/advisories/GHSA-j7w7-965w-vjxw - https://github.com/NixOS/nixpkgs/pull/397919 - https://github.com/NixOS/hydra/commit/8d750265135b7e203520036a742afdf301b4013f - https://github.com/nix-community/nix-eval-jobs/releases/tag/v2.28.1
CVE ID: CVE-2025-32438 State: PUBLISHED Published: 2025-04-15T19:57:04.668Z Last Updated: 2025-04-15T20:08:58.816Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: NixOS Products: nixpkgs Problem Types: CWE-378, CWE-379 Description: make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled (the default) a local user is able to create a program that will be executed by root during shutdown. Patches exist for NixOS 24.11 and 25.05 / unstable. As a workaround, set systemd.shutdownRamfs.enable = false;. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
le. As a workaround, set systemd.shutdownRamfs.enable = false;. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NixOS/nixpkgs/security/advisories/GHSA-m7pq-h9p4-8rr4 - https://github.com/NixOS/nixpkgs/commit/b17590193d8e5697000c23c66afcf11e1753734d - https://github.com/NixOS/nixpkgs/commit/fbf76bf72b161b9f4ab97704a8258776d5f3ffba
CVE ID: CVE-2025-32439 State: PUBLISHED Published: 2025-04-15T19:27:18.885Z Last Updated: 2025-04-15T20:14:22.736Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: roderickvd Products: pleezer Problem Types: CWE-460 Description: pleezer is a headless Deezer Connect player. Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In versions before 0.16.0, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table. Even during normal usage, every track change and playback event would leave behind zombie processes. This leads to inevitable resource exhaustion
every track change and playback event would leave behind zombie processes. This leads to inevitable resource exhaustion over time as the system's process table fills up, eventually preventing new processes from being created. The issue is exacerbated if events occur rapidly, whether through normal use (e.g., skipping through a playlist) or potential manipulation of the Deezer Connect protocol traffic. This issue has been fixed in version 0.16.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/roderickvd/pleezer/security/advisories/GHSA-472w-7w45-g3w5
CVE ID: CVE-2025-32440 State: PUBLISHED Published: 2025-05-27T21:59:40.497Z Last Updated: 2025-05-28T13:45:52.417Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: jokob-sk Products: NetAlertX Problem Types: CWE-306 Description: NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to update settings without authentication. An attacker can trigger sensitive functions within util.php by sending crafted requests to /index.php. This issue has been patched in version 25.4.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/joko
een patched in version 25.4.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jokob-sk/NetAlertX/security/advisories/GHSA-h4x5-vr54-vjrx - https://github.com/jokob-sk/NetAlertX/releases/tag/v25.4.14
CVE ID: CVE-2025-32441 State: PUBLISHED Published: 2025-05-07T23:01:19.722Z Last Updated: 2025-05-08T14:02:25.736Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: rack Products: rack Problem Types: CWE-362, CWE-367, CWE-613 Description: Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the `Rack::Session::Pool` middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session. Rack session middleware prepares the session at the beginning of request, then saves is back to the store with possible changes applied by host rack application. This way the session be
request, then saves is back to the store with possible changes applied by host rack application. This way the session becomes to be a subject of race conditions in general sense over concurrent rack requests. When using the `Rack::Session::Pool` middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. Version 2.2.14 contains a patch for the issue. Some other mitigations are available. Either ensure the application invalidates sessions atomicall
patch for the issue. Some other mitigations are available. Either ensure the application invalidates sessions atomically by marking them as logged out e.g., using a `logged_out` flag, instead of deleting them, and check this flag on every request to prevent reuse; or implement a custom session store that tracks session invalidation timestamps and refuses to accept session data if the session was invalidated after the request began. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rack/rack/security/advisories/GHSA-vpfw-47h7-xj4g - https://github.com/rack/rack/commit/c48e52f7c57e99e1e1bf54c8760d4f082cd1c89d - https://github.com/rack/rack/blob/v2.2.13/lib/ra
/github.com/rack/rack/commit/c48e52f7c57e99e1e1bf54c8760d4f082cd1c89d - https://github.com/rack/rack/blob/v2.2.13/lib/rack/session/abstract/id.rb#L263-L270
CVE ID: CVE-2025-32442 State: PUBLISHED Published: 2025-04-18T15:59:06.670Z Last Updated: 2025-08-22T20:50:43.059Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: fastify Products: fastify Problem Types: CWE-1287 Description: Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different validation strategies for different content types have a possibility to bypass validation by providing a _slightly altered_ content type such as with different casing or altered whitespacing before `;`. This was patched in v5.3.1, but the initial patch did not cover all problems. This has
altered whitespacing before `;`. This was patched in v5.3.1, but the initial patch did not cover all problems. This has been fully patched in v5.3.2 and v4.29.1. A workaround involves not specifying individual content types in the schema. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc - https://github.com/fastify/fastify/commit/436da4c06dfbbb8c24adee3a64de0c51e4f47418 - https://github.com/fastify/fastify/commit/f3d2bcb3963cd570a582e5d39aab01a9ae692fe4 - https://hackerone.com/reports/3087928
CVE ID: CVE-2025-32444 State: PUBLISHED Published: 2025-04-30T00:25:00.655Z Last Updated: 2025-04-30T13:08:35.928Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: vllm-project Products: vllm Problem Types: CWE-502 Description: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration with mooncake, are vulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to listen on all network interfaces, increasing the likelihood that an attacker is able to reach the vulnerable ZeroMQ so
o listen on all network interfaces, increasing the likelihood that an attacker is able to reach the vulnerable ZeroMQ sockets to carry out an attack. vLLM instances that do not make use of the mooncake integration are not vulnerable. This issue has been patched in version 0.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vllm-project/vllm/security/advisories/GHSA-hj4w-hm2g-p6w5 - https://github.com/vllm-project/vllm/security/advisories/GHSA-x3m8-f7g5-qhm7 - https://github.com/vllm-project/vllm/commit/a5450f11c95847cf51a17207af9a3ca5ab569b2c - https://github.com/vllm-project/vllm/blob/32b14baf8a1f7195ca09484de3008063569b43c5/vllm/distributed/kv_transfe
b569b2c - https://github.com/vllm-project/vllm/blob/32b14baf8a1f7195ca09484de3008063569b43c5/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L179
CVE ID: CVE-2025-32445 State: PUBLISHED Published: 2025-04-15T19:22:36.051Z Last Updated: 2025-04-15T20:07:10.640Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: argoproj Products: argo-events Problem Types: CWE-250 Description: Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. The EventSource and Sensor CRs allow the corresponding orchestrated pod to be customized with spec.template and spec.template.container (with type k8s.io/api/core/v1
esponding orchestrated pod to be customized with spec.template and spec.template.container (with type k8s.io/api/core/v1.Container), thus, any specification under container such as command, args, securityContext , volumeMount can be specified, and applied to the EventSource or Sensor pod. With these, a user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under template. This vulnerability is fixed in v1.9.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-events/security/advisories/GHSA-hmp7-x699-cvhq - https://github.com/argoproj/argo-events/commit/184
ub.com/argoproj/argo-events/security/advisories/GHSA-hmp7-x699-cvhq - https://github.com/argoproj/argo-events/commit/18412293a699f559848b00e6e459c9ce2de0d3e2
CVE ID: CVE-2025-32446 State: PUBLISHED Published: 2025-11-11T16:51:05.095Z Last Updated: 2025-11-14T15:28:49.777Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: n/a Products: Intel QuickAssist Technology software Problem Types: Escalation of Privilege, CWE-822 Description: Untrusted pointer dereference for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are not present without
data manipulation. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01373.html
CVE ID: CVE-2025-32449 State: PUBLISHED Published: 2025-11-11T16:51:06.750Z Last Updated: 2025-11-14T15:28:43.716Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: PRI Driver software Problem Types: Escalation of Privilege, CWE-428 Description: Unquoted search path for some PRI Driver software before version 03.03.1002 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and
sult may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01394.html
CVE ID: CVE-2025-32451 State: PUBLISHED Published: 2025-08-13T13:37:18.689Z Last Updated: 2025-11-03T19:53:29.625Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Foxit Reader Problem Types: CWE-824 Description: A memory corruption vulnerability exists in Foxit Reader 2025.1.0.27937 due to the use of an uninitialized pointer. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a
he user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2202
CVE ID: CVE-2025-32454 State: PUBLISHED Published: 2025-05-13T09:38:44.621Z Last Updated: 2025-06-10T15:17:24.833Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Teamcenter Visualization V14.3, Teamcenter Visualization V2312, Teamcenter Visualization V2406, Teamcenter Visualization V2412, Tecnomatix Plant Simulation V2404 Problem Types: CWE-125 Description: A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.14), Teamcenter Visualization V2312 (All versions < V2312.0010), Teamcenter Visualization V2406 (All versions < V2406.0008), Teamcenter Visualization V2412 (All versions < V2412.0004), Tecnomatix