Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
les authentication and may allow unauthorized access to user or administrative accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/opensourcepos/opensourcepos - https://opensourcepos.org/ - https://github.com/omkaryepre/vulnerability-research/tree/main/CVE-2025-63800
CVE ID: CVE-2025-63807 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-21T14:39:39.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force attacks on verification codes without authentication. Successful exploitation may result in account takeover via password reset or other authentication bypass methods. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Rycarl-Furry/3
bypass methods. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Rycarl-Furry/3e93c6f0d48a29518adf341e0fc7e2dd
CVE ID: CVE-2025-63811 State: PUBLISHED Published: 2025-11-12T00:00:00.000Z Last Updated: 2025-11-13T16:01:59.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high compression ratio. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dvsekhvalnov/jose2go/issues/33
CVE ID: CVE-2025-63828 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T16:50:10.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mertdurum06/BackdropCms-1.32.1/ - https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.txt
CVE ID: CVE-2025-63829 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T17:12:46.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: eProsima Fast-DDS v3.3 and before has an infinite loop vulnerability caused by integer overflow in the Time_t:: fraction() function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/eProsima/Fast-DDS/blob/master/src/cpp/fastdds/core/Time_t.cpp#L67 - https://gist.github.com/lkloliver/b00377bec754d4aa1dc731be210d5889
CVE ID: CVE-2025-63830 State: PUBLISHED Published: 2025-11-14T00:00:00.000Z Last Updated: 2025-11-14T21:27:26.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ckeditor.com/ckfinder/changelog/ - https://github.com/Shubham03007/CVE-2025-63830/blob/main/README.md
CVE ID: CVE-2025-63834 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-18T16:26:42.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the ssid parameter of the wireless settings. Remote attackers can inject malicious payloads that execute when any user visits the router's homepage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/babraink/cve_report/blob/main/cve_report/tenda/tendaAC18/wifiset_ssid_xss/README.md
CVE ID: CVE-2025-63835 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-18T16:31:59.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the guestSsid parameter of the /goform/WifiGuestSet interface. Remote attackers can exploit this vulnerability by sending oversized data to the guestSsid parameter, leading to denial of service (device crash) or potential remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/babraink/cve_report/blob/main/cve_report/tenda/tendaAC18/2_wifiguest_guestss
nrichment: References: - https://github.com/babraink/cve_report/blob/main/cve_report/tenda/tendaAC18/2_wifiguest_guestssid_overflow/README.md
CVE ID: CVE-2025-63848 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-20T21:46:59.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored cross site scripting (xss) vulnerability in SWISH prolog thru 2.2.0 allowing attackers to execute arbitrary code via crafted web IDE notebook. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SWI-Prolog - https://github.com/coderMohammed1/CVE-2025-63848
CVE ID: CVE-2025-63878 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-19T21:37:00.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/rumana-khatun-208aa731b/ - https://github.com/rumanaemu/CVE-Research/blob/main/CVE-2025-63878.md
CVE ID: CVE-2025-63879 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-19T16:31:45.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripted (XSS) vulnerability in the /ecommerce/products.php component of E-commerce Project v1.0 and earlier allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/rumana-khatun-208aa731b/ - https://github.com/rumanaemu/CVE-Research/blob/main/CVE-2025-63879.md
CVE ID: CVE-2025-63883 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T15:00:49.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 (Bhabishya-123/E-commerce). The site's client-side JavaScript reads attacker-controlled input (for example, values derived from the URL or page fragment) and inserts it into the DOM via unsafe sinks (innerHTML/insertAdjacentHTML/document.write) without proper sanitization or context-aware encoding. An attacker can craft a malicious URL that, when opened by a victim, causes arbitrary JavaScript to execute in the victim's browser under the electic-s
us URL that, when opened by a victim, causes arbitrary JavaScript to execute in the victim's browser under the electic-shop origin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/minhajultaivin/security-advisories/blob/main/CVE-2025-63883.md
CVE ID: CVE-2025-63885 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T18:27:03.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the model_desc field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AIxBlock-2023/awesome-ai-dev-platform-opensource/issues/278%2C - https://github.com/AIxBlock-2023/awesome-ai-dev-platform-opensource/pull/280/commits/04f3051187b884973beb42316489e3fb37116fdf
CVE ID: CVE-2025-63888 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-21T14:42:04.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/lcc316/df0kgm/mglhbxltgbmzfh2s - https://gist.github.com/Master-0-0/0bf54cbb335b586b42b0db0db804e7aa
CVE ID: CVE-2025-63889 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-20T21:48:21.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/lcc316/df0kgm/xqkrw5rfz5vqxo9t - https://gist.github.com/Master-0-0/dd63209602f04267f1a27a75a064df26
CVE ID: CVE-2025-63891 State: PUBLISHED Published: 2025-11-14T00:00:00.000Z Last Updated: 2025-11-16T21:04:36.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attacker to disclose full database contents (including schema and credential hashes) via an unauthenticated HTTP GET request to /obs/database/obs_db.sql. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://simple.com - http://sourcecodester.com - https://github.com/lucascdsm/CVEs/blob/main/CVE-2025-63891.md
CVE ID: CVE-2025-63892 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T15:02:34.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected is the function create_classroom of the file /classroom.php of the component My Classrooms Management Page. This manipulation of the argument name/description causes stored cross site scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://student.com - http://sourcecodester.com - https://github.com/minhajultaivin/security-advisories/blob/main/CVE-2025-63892.md
CVE ID: CVE-2025-63914 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T19:29:20.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui.py file does not check the contents of uploaded ZIP files. Although the contents are extracted into a temporary folder that is cleared before each extraction, successfully uploading a ZIP bomb could still cause the server to consume excessive resources during decompression. Moreover, if no further files are uploaded afterward, the extracted data could occupy disk space and potentially render the system
f no further files are uploaded afterward, the extracted data could occupy disk space and potentially render the system unavailable. Anyone with permission to upload files can carry out this attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Cinnamon/kotaemon - https://github.com/WxDou/CVE-2025-63914
CVE ID: CVE-2025-63916 State: PUBLISHED Published: 2025-11-17T00:00:00.000Z Last Updated: 2025-11-17T19:00:52.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properly sanitize user-supplied file paths before passing them to cmd.exe, allowing attackers to execute arbitrary system commands with the privileges of the user running the application. The vulnerability exists in the CMD() function within GIFSicleTool\Form_gif_sicle_tool.cs, which constructs shell commands by concatenating unsanitized user input (file paths) and executes them via cmd.exe.
.cs, which constructs shell commands by concatenating unsanitized user input (file paths) and executes them via cmd.exe. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luotengyuan/MyScreenTools/blob/master/GIFSicleTool/Form_gif_sicle_tool.cs - https://github.com/luotengyuan/MyScreenTools/tree/master - https://github.com/cydtseng/Vulnerability-Research/blob/main/myscreentools/OSCommandInjection-GifCompression.md
CVE ID: CVE-2025-63917 State: PUBLISHED Published: 2025-11-17T00:00:00.000Z Last Updated: 2025-11-17T19:48:24.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. The application uses .NET's XmlDocument class without disabling external entity resolution, enabling attackers to: Read arbitrary files from the victim's filesystem, exfiltrate sensitive data via out-of-band (OOB) HTTP requests, perform SSRF attacks against internal network resources, or cause a denial of service via entity expansion attacks. Additional Analyst Notes: - CISA ADP Vulnrichment:
esources, or cause a denial of service via entity expansion attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cnblogs.com/pdfpatcher - https://github.com/wmjordan/PDFPatcher - https://github.com/cydtseng/Vulnerability-Research/blob/main/pdfpatcher/XXE-Importers.md
CVE ID: CVE-2025-63918 State: PUBLISHED Published: 2025-11-17T00:00:00.000Z Last Updated: 2025-11-18T16:25:47.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: PDFPatcher executable does not validate user-supplied file paths, allowing directory traversal attacks allowing attackers to upload arbitrary files to arbitrary locations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cnblogs.com/pdfpatcher - https://github.com/wmjordan/PDFPatcher - https://github.com/cydtseng/Vulnerability-Research/blob/main/pdfpatcher/DirectoryTraversal-ImageExport.md
CVE ID: CVE-2025-63927 State: PUBLISHED Published: 2025-11-12T00:00:00.000Z Last Updated: 2025-11-13T15:59:54.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-use-after-free vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08). During multi-threaded client execution, the function Iec10x_Scheduled can access memory that has already been freed, potentially causing program crashes or undefined behavior. This may be exploited to trigger a denial-of-service or memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/airpig2011/IEC104/issues/20 - https://songsong.host/mybugs/CVE-2025-63927.html
CVE ID: CVE-2025-63929 State: PUBLISHED Published: 2025-11-12T00:00:00.000Z Last Updated: 2025-11-13T16:09:20.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08). When multiple threads enqueue elements concurrently via IEC10X_PrioEnQueue, the function may dereference a null or freed queue pointer, resulting in a segmentation fault and potential denial-of-service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/airpig2011/IEC104/issues/21 - https://songsong.host/mybugs/CVE-2025-63929.html
CVE ID: CVE-2025-63932 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-20T15:39:00.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. The HNAP service provided by cgibin does not filter the HTTP SOAPAction header field. The unauthenticated remote attacker can execute the shell command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/WhereisRain/DIR-868/tree/main - https://github.com/WhereisRain/DIR-868
CVE ID: CVE-2025-63952 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T19:04:38.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.magewell.com - https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-63952
CVE ID: CVE-2025-63953 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T19:03:16.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.magewell.com - https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-63953
CVE ID: CVE-2025-63955 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T21:01:42.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of PHPGurukul Student Record System v3.2 allows an attacker to trick an authenticated administrator into submitting a forged request. This leads to the unauthorized deletion of user accounts, causing a Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/student-record-system-php/ - https://github.com/Wayne-arul/CVE-Disclosures/tree/main/CVE-2025-63955
CVE ID: CVE-2025-63958 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T19:05:22.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authentication. This page leaks plaintext database credentials, file share paths, internal license server configuration, and software update parameters. An unauthenticated attacker can retrieve this information by accessing the endpoint directly, potentially leading to full system compromise. The vulnerability is due to missing access controls on a privileged administrative function. Add
full system compromise. The vulnerability is due to missing access controls on a privileged administrative function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.millensys.com/ - https://ozex.gitlab.io/tricks_hacks/2025-11-19-cve-2025-63958/index.html
CVE ID: CVE-2025-63994 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T18:06:36.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the /php/UploadHandler.php component of RichFilemanager v2.7.6 allows attackers to execute arbitrary code via uploading a crafted file. References: - https://github.com/psolom/RichFilemanager/issues/412
CVE ID: CVE-2025-64027 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-20T21:37:42.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript execute
he server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/grokability/snipe-it - https://github.com/cybercrewinc/CVE-2025-64027/
CVE ID: CVE-2025-64046 State: PUBLISHED Published: 2025-11-17T00:00:00.000Z Last Updated: 2025-11-17T15:52:10.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /system/update-run.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://rapidcms.com - https://gist.github.com/b1uel0n3/c8467f156f523fcf16dc572a34693126
CVE ID: CVE-2025-64047 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T19:42:14.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://rapidcms.com - https://gist.github.com/b1uel0n3/b105ad05dbcd3fe148a26e8180dddda7
CVE ID: CVE-2025-64048 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T19:59:03.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in the add() and getPost() functions within the ArticleAction.class.php file due to improper neutralization of user input in the article title field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://yccms.com - https://gist.github.com/b1uel0n3/8354650e683ffb0812bfe72b702b482d
CVE ID: CVE-2025-64076 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T13:55:54.103Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds Read (CWE-191, CWE-125): An incorrect variable reference and missing state reset in the chunk processing loop causes buffer_length to not be reset to zero after UTF-8 character consumption. This results in subsequent chunk_length calculations producing
not be reset to zero after UTF-8 character consumption. This results in subsequent chunk_length calculations producing negative values (e.g., chunk_length = 65536 - buffer_length), which are passed as signed integers to the read() method, potentially triggering unlimited read operations and resource exhaustion. (2) Memory Leak via Missing Reference Count Release (CWE-401): The main processing loop fails to release Python object references (Py_DECREF) for chunk objects allocated in each iteration. For CBOR strings longer than 65536 bytes, this causes cumulative memory leaks proportional to the payload size, enabling memory exhaustion attacks through repeated processing of large CBOR payloads
proportional to the payload size, enabling memory exhaustion attacks through repeated processing of large CBOR payloads. Both vulnerabilities can be exploited remotely without authentication by sending specially-crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters positioned at 65536-byte chunk boundaries. Successful exploitation results in denial of service through process crashes (CBORDecodeEOF exceptions) or memory exhaustion. The vulnerabilities affect all applications using cbor2's C extension to process untrusted CBOR data, including web APIs, IoT data collectors, and message queue processors. Fixed in commit 851473490281f82d82560b2368284ef33cf6e8
ding web APIs, IoT data collectors, and message queue processors. Fixed in commit 851473490281f82d82560b2368284ef33cf6e8f9 pushed with released version 5.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/agronholm/cbor2/issues/264 - https://github.com/agronholm/cbor2/pull/265 - https://github.com/agronholm/cbor2/commit/851473490281f82d82560b2368284ef33cf6e8f9