Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11672 State: PUBLISHED Published: 2025-10-13T07:32:57.405Z Last Updated: 2025-10-14T13:16:05.655Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: EBM Technologies Products: Uniweb/SoliPACS WebServer Problem Types: CWE-306 Description: Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a specific page to obtain user group names. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10419-de614-1.html - https://www.twcert.org.tw/en/cp-139-10420-d1a4f-2.html
CVE ID: CVE-2025-11673 State: PUBLISHED Published: 2025-10-13T07:35:45.341Z Last Updated: 2025-10-14T13:11:11.968Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: PiExtract Products: SOOP-CLM Problem Types: CWE-912 Description: SOOP-CLM developed by PiExtract has a Hidden Functionality vulnerability, allowing privileged remote attackers to exploit a hidden functionality to execute arbitrary code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10421-5cf6b-1.html - https://www.twcert.org.tw/en/cp-139-10422-e06c3-2.html
CVE ID: CVE-2025-11674 State: PUBLISHED Published: 2025-10-13T07:44:41.429Z Last Updated: 2025-10-14T14:07:16.161Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: PiExtract Products: SOOP-CLM Problem Types: CWE-918 Description: SOOP-CLM developed by PiExtract has a Server-Side Request Forgery vulnerability, allowing privileged remote attackers to read server files or probe internal network information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10421-5cf6b-1.html - https://www.twcert.org.tw/en/cp-139-10422-e06c3-2.html
CVE ID: CVE-2025-11675 State: PUBLISHED Published: 2025-10-13T07:56:11.168Z Last Updated: 2025-10-14T14:02:30.863Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ragic Products: Enterprise Cloud Database Problem Types: CWE-434 Description: Enterprise Cloud Database developed by Ragic has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10423-a3861-1.html - https://www.twcert.org.tw/en/cp-139-10424-4e42c-2.html
CVE ID: CVE-2025-11676 State: PUBLISHED Published: 2025-11-20T08:09:46.853Z Last Updated: 2025-11-20T15:28:29.556Z Vendors: TP-Link System Inc. Products: TL-WR940N V6 Problem Types: CWE-20 Description: Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 (UPnP modules), which allows unauthenticated adjacent attackers to perform DoS attack. This issue affects TL-WR940N V6 <= Build 220801. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/us/support/download/tl-wr940n/v6/#Firmware - https://www.tp-link.com/en/support/download/tl-wr940n/v6/#Firmware - https://www.tp-link.com/en/support/faq/4755/
CVE ID: CVE-2025-11677 State: PUBLISHED Published: 2025-10-20T13:41:10.787Z Last Updated: 2025-10-24T10:54:30.961Z Vendors: warmcat Products: libwebsockets Problem Types: CWE-416 Description: Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f556969160143ba94875d783971a - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11677
CVE ID: CVE-2025-11678 State: PUBLISHED Published: 2025-10-20T13:51:17.328Z Last Updated: 2025-10-20T14:00:37.720Z Vendors: warmcat Products: libwebsocket Problem Types: CWE-121 Description: Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://libwebsockets.org/git/libwebsockets/commit?id=2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a - https://www.nozominetwor
ttps://libwebsockets.org/git/libwebsockets/commit?id=2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11678
CVE ID: CVE-2025-11679 State: PUBLISHED Published: 2025-10-20T13:58:31.286Z Last Updated: 2025-10-20T14:03:41.592Z Vendors: warmcat Products: libwebsockets Problem Types: CWE-125 Description: Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to read past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big height dimension. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://libwebsockets.org/git/libwebsockets/commit?id=7df24cca7144d7bc9233b6b0a71108bd154ce10
ulnrichment: References: - https://libwebsockets.org/git/libwebsockets/commit?id=7df24cca7144d7bc9233b6b0a71108bd154ce101 - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11679
CVE ID: CVE-2025-11680 State: PUBLISHED Published: 2025-10-20T14:04:06.854Z Last Updated: 2025-10-20T14:34:57.848Z Vendors: warmcat Products: libwebsockets Problem Types: CWE-787 Description: Out-of-bounds Write in unfilter_scanline in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to write past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big width value that causes an integer overflow which value is used for determining the size of a heap allocation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
sed for determining the size of a heap allocation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://libwebsockets.org/git/libwebsockets/commit?id=2b715249f39291c86443b969a1088d59b6a89b78 - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11680
CVE ID: CVE-2025-11681 State: PUBLISHED Published: 2025-11-17T11:30:25.324Z Last Updated: 2025-11-17T14:36:42.885Z Vendors: M-Files Corporation Products: M-Files Server Problem Types: CWE-400 Description: Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to cause the MFserver process to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2025-11681/
CVE ID: CVE-2025-11682 State: PUBLISHED Published: 2025-10-27T07:39:54.263Z Last Updated: 2025-10-27T17:25:18.430Z Vendors: Perx Technologies Products: Customer Engagement & Loyalty Platform Problem Types: CWE-79, CWE-83 Description: Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript code in a victim's browser. The vulnerability is due to improper sanitization of SVG file uploads. An attacker can upload a malicious SVG file containing a script payload to a campaign. When another user views this image on the public LMT microsite, the script executes, which can
t payload to a campaign. When another user views this image on the public LMT microsite, the script executes, which can lead to session hijacking, data theft, or other unauthorized actions.This issue affects Customer Engagement & Loyalty Platform before 4.617.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.redguard.ch/blog/2025/10/27/advisory-perx-lmt-dashboard/
CVE ID: CVE-2025-11683 State: PUBLISHED Published: 2025-10-16T00:14:41.769Z Last Updated: 2025-10-16T13:42:17.584Z Vendors: TODDR Products: YAML::Syck Problem Types: CWE-119 Description: YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.co
outside that allocated to the module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cpan-authors/YAML-Syck/pull/65 - https://metacpan.org/dist/YAML-Syck/changes
CVE ID: CVE-2025-11690 State: PUBLISHED Published: 2025-11-04T10:25:45.416Z Last Updated: 2025-11-10T18:24:47.168Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N/E:F/RL:O/RC:C) Vendors: CFMOTO Products: RIDE Problem Types: CWE-639 Description: An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users’ vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own vehicle data. The fix for this vulner
nd fuel statistics belonging to other users, instead of being limited to their own vehicle data. The fix for this vulnerability is a server-side authorization fix. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.ncsc.nl/2025/ncsc-2025-0350.html
CVE ID: CVE-2025-11691 State: PUBLISHED Published: 2025-10-18T06:42:49.184Z Last Updated: 2025-10-20T17:59:48.112Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: themeisle Products: PPOM – Product Addons & Custom Fields for WooCommerce Problem Types: CWE-89 Description: The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_by_id() function in all versions up to, and including, 33.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append addition
ufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the Enable Legacy Price Calculations setting is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eefcc290-b7f7-4cf0-9ccc-db4c883d6426?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/trunk/classes/ppom.class.php#L337 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379431%40woocommerc
m.class.php#L337 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379431%40woocommerce-product-addon&new=3379431%40woocommerce-product-addon&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11692 State: PUBLISHED Published: 2025-10-15T08:25:59.373Z Last Updated: 2025-10-15T14:54:32.927Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: quicoto Products: Zip Attachments Problem Types: CWE-862 Description: The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to delete arbitrary files from the current wp_upload_dir directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vul
r directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8d746f-82e2-4615-92bb-35d20124dc56?source=cve - https://plugins.trac.wordpress.org/browser/zip-attachments/tags/1.6/download.php#L27
CVE ID: CVE-2025-11695 State: PUBLISHED Published: 2025-10-13T16:22:57.417Z Last Updated: 2025-10-21T03:55:19.647Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: MongoDB Products: Rust Driver Problem Types: CWE-295 Description: When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/RUST-2264
CVE ID: CVE-2025-11696 State: PUBLISHED Published: 2025-11-11T13:47:10.872Z Last Updated: 2025-11-12T20:03:19.564Z Vendors: Rockwell Automation Products: Studio 5000® Simulation Interface™ Problem Types: CWE-22 Description: A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to trigger outbound SMB requests, enabling the capture of NTLM hashes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1760.html
CVE ID: CVE-2025-11697 State: PUBLISHED Published: 2025-11-11T13:49:49.524Z Last Updated: 2025-11-12T20:03:12.471Z Vendors: Rockwell Automation Products: Studio 5000 ® Simulation Interface Problem Types: CWE-200 Description: A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to extract files using path traversal sequences, resulting in execution of scripts with Administrator privileges on system reboot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1760.html
CVE ID: CVE-2025-11700 State: PUBLISHED Published: 2025-11-12T15:30:38.691Z Last Updated: 2025-11-12T18:26:05.203Z Vendors: N-able Products: N-central Problem Types: CWE-611 Description: N-central versions < 2025.4 are vulnerable to an XML External Entities injection leading to information disclosure Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.n-able.com/s/security-advisory/aArVy0000000rabKAA/cve202511700-ncentral-importservicefromfile-xxe-injection
CVE ID: CVE-2025-11701 State: PUBLISHED Published: 2025-10-15T08:26:04.431Z Last Updated: 2025-10-15T13:24:45.463Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: quicoto Products: Zip Attachments Problem Types: CWE-862 Description: The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the za_create_zip_callback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to download attachments from private and password-protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
chments from private and password-protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e166d52d-73d1-4572-b9cc-ab935b05e13c?source=cve - http://plugins.trac.wordpress.org/browser/zip-attachments/tags/1.6/zip-attachments.php#L95 - http://plugins.trac.wordpress.org/browser/zip-attachments/tags/1.6/zip-attachments.php#L46
CVE ID: CVE-2025-11702 State: PUBLISHED Published: 2025-10-29T07:04:52.286Z Last Updated: 2025-10-30T03:56:00.997Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/ - https://gitlab.com/gitlab-org/gitlab/-/issue
bout.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/576900 - https://hackerone.com/reports/3356284
CVE ID: CVE-2025-11703 State: PUBLISHED Published: 2025-10-18T06:42:46.103Z Last Updated: 2025-10-20T18:45:13.127Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wpgmaps Products: WP Go Maps (formerly WP Google Maps) Problem Types: CWE-349 Description: The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48. This is due to the plugin not serving cached data from server-side responses and instead relying on user-input. This makes it possible for unauthenticated attackers to poison the cache location for location search results. Additional Analyst Notes: - CISA ADP Vulnrichmen
ted attackers to poison the cache location for location search results. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/531360c6-e78a-4344-be06-95735337a2d6?source=cve - https://research.cleantalk.org/cve-2025-11703 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378871%40wp-google-maps&new=3378871%40wp-google-maps&sfp_email=&sfph_mail= - https://github.com/CodeCabin/wp-google-maps/pull/1087/files
CVE ID: CVE-2025-11704 State: PUBLISHED Published: 2025-11-04T04:27:20.117Z Last Updated: 2025-11-04T15:51:56.144Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: impacttechlab Products: Elegance Menu Problem Types: CWE-98 Description: The Elegance Menu plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the 'elegance-menu' attribute of the `elegance-menu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access cont
.php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9cecce4d-5d4a-4286-97dc-88a379e21b60?source=cve - https://plugins.trac.wordpress.org/browser/elegance-menu/trunk/public/class-elegance-menu-public.php#L222 - https://wordpress.org/plugins/elegance-menu
CVE ID: CVE-2025-11705 State: PUBLISHED Published: 2025-10-29T04:27:11.600Z Last Updated: 2025-10-29T13:43:07.462Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: scheeeli Products: Anti-Malware Security and Brute-Force Firewall Problem Types: CWE-862 Description: The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the s
le for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c8838c-d29a-4df8-85b3-6e440ba7f962?source=cve - https://plugins.trac.wordpress.org/changeset/3379118/gotmls
CVE ID: CVE-2025-11708 State: PUBLISHED Published: 2025-10-14T12:27:35.228Z Last Updated: 2025-11-03T17:31:44.090Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: Use-after-free in MediaTrackGraphImpl::GetInstance() This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1988931 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advisories/mfsa2025-83/ - https://www.mozilla.org/security/advisories/mfsa2025-84/ - https://www.mozilla.org/secur
urity/advisories/mfsa2025-83/ - https://www.mozilla.org/security/advisories/mfsa2025-84/ - https://www.mozilla.org/security/advisories/mfsa2025-85/
CVE ID: CVE-2025-11709 State: PUBLISHED Published: 2025-10-14T12:27:33.692Z Last Updated: 2025-11-03T17:31:46.165Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability affects Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1989127 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advis
w_bug.cgi?id=1989127 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advisories/mfsa2025-82/ - https://www.mozilla.org/security/advisories/mfsa2025-83/ - https://www.mozilla.org/security/advisories/mfsa2025-84/ - https://www.mozilla.org/security/advisories/mfsa2025-85/
CVE ID: CVE-2025-11710 State: PUBLISHED Published: 2025-10-14T12:27:34.065Z Last Updated: 2025-11-03T17:31:48.074Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability affects Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1989899 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.moz
ugzilla.mozilla.org/show_bug.cgi?id=1989899 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advisories/mfsa2025-82/ - https://www.mozilla.org/security/advisories/mfsa2025-83/ - https://www.mozilla.org/security/advisories/mfsa2025-84/ - https://www.mozilla.org/security/advisories/mfsa2025-85/
CVE ID: CVE-2025-11711 State: PUBLISHED Published: 2025-10-14T12:27:34.470Z Last Updated: 2025-11-03T17:31:50.030Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability affects Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1989978 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advisories/mfsa2025-82/ - https://www