Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-12432 State: PUBLISHED Published: 2025-11-10T20:00:15.299Z Last Updated: 2025-11-11T04:55:43.576Z Vendors: Google Products: Chrome Problem Types: CWE-362 Description: Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/439522866
CVE ID: CVE-2025-12433 State: PUBLISHED Published: 2025-11-10T20:00:15.801Z Last Updated: 2025-11-10T21:10:50.917Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/449760249
CVE ID: CVE-2025-12434 State: PUBLISHED Published: 2025-11-10T20:00:16.649Z Last Updated: 2025-11-10T20:43:32.911Z Vendors: Google Products: Chrome Problem Types: CWE-362 Description: Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/337356054
CVE ID: CVE-2025-12435 State: PUBLISHED Published: 2025-11-10T20:00:17.141Z Last Updated: 2025-11-10T20:56:16.184Z Vendors: Google Products: Chrome Problem Types: Incorrect security UI Description: Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/446463993
CVE ID: CVE-2025-12436 State: PUBLISHED Published: 2025-11-10T20:00:17.581Z Last Updated: 2025-11-10T20:59:06.875Z Vendors: Google Products: Chrome Problem Types: Policy bypass Description: Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/40054742
CVE ID: CVE-2025-12437 State: PUBLISHED Published: 2025-11-10T20:00:18.255Z Last Updated: 2025-11-12T17:09:32.636Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in PageInfo in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/446294487
CVE ID: CVE-2025-12438 State: PUBLISHED Published: 2025-11-10T20:00:18.745Z Last Updated: 2025-11-11T04:55:42.070Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/433027577
CVE ID: CVE-2025-12439 State: PUBLISHED Published: 2025-11-10T20:00:19.158Z Last Updated: 2025-11-10T21:02:26.622Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/382234536
CVE ID: CVE-2025-12440 State: PUBLISHED Published: 2025-11-10T20:00:19.833Z Last Updated: 2025-11-10T21:00:29.835Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/430555440
CVE ID: CVE-2025-12441 State: PUBLISHED Published: 2025-11-10T20:00:20.492Z Last Updated: 2025-11-10T21:10:02.839Z Vendors: Google Products: Chrome Problem Types: CWE-125 Description: Out of bounds read in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/444049512
CVE ID: CVE-2025-12443 State: PUBLISHED Published: 2025-11-10T20:00:21.131Z Last Updated: 2025-11-10T21:09:30.296Z Vendors: Google Products: Chrome Problem Types: CWE-125 Description: Out of bounds read in WebXR in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/452071845
CVE ID: CVE-2025-12444 State: PUBLISHED Published: 2025-11-10T20:00:21.687Z Last Updated: 2025-11-10T21:07:30.920Z Vendors: Google Products: Chrome Problem Types: Incorrect security UI Description: Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/390571618
CVE ID: CVE-2025-12445 State: PUBLISHED Published: 2025-11-10T20:00:22.141Z Last Updated: 2025-11-12T21:02:34.432Z Vendors: Google Products: Chrome Problem Types: Policy bypass Description: Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/428397712
CVE ID: CVE-2025-12446 State: PUBLISHED Published: 2025-11-10T20:00:22.662Z Last Updated: 2025-11-10T21:43:06.768Z Vendors: Google Products: Chrome Problem Types: Incorrect security UI Description: Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/444932667
CVE ID: CVE-2025-12447 State: PUBLISHED Published: 2025-11-10T20:00:23.190Z Last Updated: 2025-11-12T00:18:45.562Z Vendors: Google Products: Chrome Problem Types: Incorrect security UI Description: Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/442636157
CVE ID: CVE-2025-12450 State: PUBLISHED Published: 2025-10-29T09:27:57.311Z Last Updated: 2025-10-29T13:59:32.341Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: litespeedtech Products: LiteSpeed Cache Problem Types: CWE-79 Description: The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 7.5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes:
te if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/98f71c32-9453-4598-acb5-242818508c74?source=cve - https://github.com/litespeedtech/lscache_wp/commit/3d473f44d37ec2a834162ff1d86c017e9ae67db3
CVE ID: CVE-2025-12452 State: PUBLISHED Published: 2025-11-04T04:27:22.522Z Last Updated: 2025-11-04T15:08:35.205Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: bestiadurmiente Products: Visit Counter Problem Types: CWE-352 Description: The Visit Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the widgets.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes:
ted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9e0f3a5-35fb-4c7e-892f-8a41498e1d3c?source=cve - https://wordpress.org/plugins/visit-counter/
CVE ID: CVE-2025-12456 State: PUBLISHED Published: 2025-11-04T04:27:17.736Z Last Updated: 2025-11-04T16:43:20.440Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: centangle Products: Centangle-Team Problem Types: CWE-352 Description: The Centangle-Team plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to modify plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additionally, due to insufficient i
can trick a site administrator into performing an action such as clicking on a link. Additionally, due to insufficient input sanitization and output escaping on cai_name_color parameter, this issue allows to inject arbitrary web scripts in pages, that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ff637c7-677f-4d70-b3cb-770d0a47e691?source=cve - https://plugins.trac.wordpress.org/browser/centangle-team/trunk/inc_/cai_setting.php#L88 - https://plugins.trac.wordpress.org/browser/centangle-team/trunk/Centangle-Team-Showcase.php#L132 - https://plugins.trac.wordpres
plugins.trac.wordpress.org/browser/centangle-team/trunk/Centangle-Team-Showcase.php#L132 - https://plugins.trac.wordpress.org/browser/centangle-team/trunk/inc_/cai_setting.php#L172 - https://plugins.trac.wordpress.org/browser/centangle-team/trunk/inc_/cai_setting.php#L196
CVE ID: CVE-2025-12457 State: PUBLISHED Published: 2025-11-18T09:27:40.395Z Last Updated: 2025-11-18T21:11:24.416Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ideastocode Products: Enable SVG, WebP, and ICO Upload Problem Types: CWE-79 Description: The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
evel access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f267a5-012d-4b9a-a59d-9eccb04c557a?source=cve - https://plugins.trac.wordpress.org/browser/enable-svg-webp-ico-upload/tags/1.1.2/includes/class-svg.php#L21
CVE ID: CVE-2025-12460 State: PUBLISHED Published: 2025-10-31T13:53:58.574Z Last Updated: 2025-10-31T14:09:59.967Z Vendors: Afterlogic Products: Aurora Problem Types: CWE-79 Description: An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img HTML tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://auroramail.wordpress.com/2025/10/28/xss-vulnerability-in-afterlogic-webmail-and-aurora-corporate/
CVE ID: CVE-2025-12461 State: PUBLISHED Published: 2025-10-29T10:51:36.915Z Last Updated: 2025-10-29T13:33:58.079Z Vendors: Grupo Castilla Products: Epsilon RH Problem Types: CWE-522 Description: This vulnerability allows an attacker to access parts of the application that are not protected by any type of access control. The attacker could access this path ‘…/epsilonnet/License/About.aspx’ and obtain information on both the licence and the configuration of the product by knowing which modules are installed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/unprotected-access-parts-application-epsilon-rh-grupo-castilla
CVE ID: CVE-2025-12463 State: PUBLISHED Published: 2025-11-03T16:45:39.423Z Last Updated: 2025-11-03T20:51:37.271Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Guetebruck Products: G-Cam Problem Types: CWE-89 Description: An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi/viewer/Param.cgi` script. This has been confirmed on the EFD-2130 camera running firmware version 1.12.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.blacklanternsecurity.com/p/cve-2025-12463-98-unauthenticated
CVE ID: CVE-2025-12464 State: PUBLISHED Published: 2025-10-31T21:15:48.885Z Last Updated: 2025-11-12T10:12:25.796Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-121 Description: A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short fr
es and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-12464 - https://bugzilla.redhat.com/show_bug.cgi?id=2408845
CVE ID: CVE-2025-12466 State: PUBLISHED Published: 2025-10-29T23:14:51.343Z Last Updated: 2025-10-30T14:38:59.887Z Vendors: Drupal Products: Simple OAuth (OAuth2) & OpenID Connect Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-114
CVE ID: CVE-2025-12468 State: PUBLISHED Published: 2025-11-05T09:27:39.398Z Last Updated: 2025-11-05T15:43:54.382Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: amans2k Products: FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce Problem Types: CWE-200 Description: The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint bein
oint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback => '__return_true'`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2a2032-3d39-4195-8e6c-ab884164721a?source=cve - https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/api/wc/class-bwfan-api-wc-coupons.php#L19 - https://plugin
wordpress.org/browser/wp-marketing-automations/trunk/includes/api/wc/class-bwfan-api-wc-coupons.php#L19 - https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/class-bwfan-api-loader.php#L119
CVE ID: CVE-2025-12469 State: PUBLISHED Published: 2025-11-05T09:27:40.199Z Last Updated: 2025-11-05T15:39:59.784Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: amans2k Products: FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce Problem Types: CWE-862 Description: The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.4.1. This is due to the plugin not properly verifying that a user is authorized to perform administrative actions in the `bwfan_test_email` AJAX handler. The nonce used
ying that a user is authorized to perform administrative actions in the `bwfan_test_email` AJAX handler. The nonce used for verification is publicly exposed to all visitors (including unauthenticated users) via the frontend JavaScript localization, and the `check_nonce()` function accepts low-privilege authenticated users who possess this nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send arbitrary emails from the site with attacker-controlled subject and body content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72198b74-90f6-49c6-b261-6f9c1cdc9692?source=cve
References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72198b74-90f6-49c6-b261-6f9c1cdc9692?source=cve - https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/abstracts/class-bwfan-ajax-controller.php#L296 - https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/class-bwfan-common.php#L1896 - https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/class-bwfan-public.php#L70 - https://plugins.trac.wordpress.org/changeset/3388822/wp-marketing-automations/trunk/includes/abstracts/class-bwfan-ajax-controller.php
CVE ID: CVE-2025-12471 State: PUBLISHED Published: 2025-11-06T06:45:20.224Z Last Updated: 2025-11-06T15:28:04.500Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nerdpressteam Products: Hubbub Lite – Fast, free social sharing and follow buttons Problem Types: CWE-79 Description: The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dpsp_list_attention_search' parameter in all versions up to, and including, 1.36.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that ex
d output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fe848a09-edd3-4eea-befb-909d15ba1994?source=cve - https://plugins.trac.wordpress.org/browser/social-pug/tags/1.36.0/inc/admin/views/view-submenu-page-dashboard.php#L225 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3389831%40social-pug%2Ftrunk&old=3373974%40social-pug%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12472 State: PUBLISHED Published: 2025-11-19T10:27:56.520Z Last Updated: 2025-11-19T16:24:04.479Z Vendors: Google Cloud Products: Looker Problem Types: CWE-362 Description: An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The version
upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.103+ * 24.18.195+ * 25.0.72+ * 25.6.60+ * 25.8.42+ * 25.10.22+ Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins#gcp-2025-052