Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-47726 State: PUBLISHED Published: 2025-06-04T07:24:17.382Z Last Updated: 2025-06-04T13:44:22.036Z Vendors: Delta Electronics Products: CNCSoft Problem Types: CWE-787 Description: Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00006_CNCSoft%20-%20Out-of-bounds%20Write.pdf
CVE ID: CVE-2025-47727 State: PUBLISHED Published: 2025-06-04T07:25:10.593Z Last Updated: 2025-06-04T13:44:12.064Z Vendors: Delta Electronics Products: CNCSoft Problem Types: CWE-787 Description: Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00006_CNCSoft%20-%20Out-of-bounds%20Write.pdf
CVE ID: CVE-2025-47728 State: PUBLISHED Published: 2025-06-04T08:11:06.007Z Last Updated: 2025-08-27T01:03:04.682Z Vendors: Delta Electronics Products: CNCSoft-G2 Problem Types: CWE-787 Description: Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00007_CNCSoft-G2%20-%20File%20Parsing%20Memory%20Corruption.pdf
CVE ID: CVE-2025-47729 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-10-21T22:55:16.821Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: TeleMessage Products: archiving backend Problem Types: CWE-912 Description: The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://news.ycombinator.com/item
the wild in May 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://news.ycombinator.com/item?id=43909220 - https://arstechnica.com/security/2025/05/signal-clone-used-by-trump-official-stops-operations-after-report-it-was-hacked/ - https://www.theregister.com/2025/05/05/telemessage_investigating/
CVE ID: CVE-2025-47730 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-08T15:41:48.292Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: TeleMessage Products: archiving backend Problem Types: CWE-798 Description: The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Signal) app with the credentials of logfile for the user and enRR8UVVywXYbFkqU#QDPRkO for the password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://news.ycombinator.com/item?id=43909220 - https://arstechnica.com/security/2025/05/signal-clone-used-by-trump-offi
https://news.ycombinator.com/item?id=43909220 - https://arstechnica.com/security/2025/05/signal-clone-used-by-trump-official-stops-operations-after-report-it-was-hacked/ - https://www.theregister.com/2025/05/05/telemessage_investigating/ - https://github.com/micahflee/TM-SGNL-Android/blob/bd7ccbb8bc79193fc4c57cae7cc1051e6250fa89/app/src/tm/java/org/archiver/ArchiveConstants.kt#L45-L46
CVE ID: CVE-2025-47732 State: PUBLISHED Published: 2025-05-08T22:17:27.315Z Last Updated: 2025-09-10T00:09:49.584Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Dataverse Problem Types: CWE-502 Description: Microsoft Dataverse Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47732
CVE ID: CVE-2025-47733 State: PUBLISHED Published: 2025-05-08T22:17:26.608Z Last Updated: 2025-09-10T00:09:48.998Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Power Apps Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47733
CVE ID: CVE-2025-47735 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-09T15:45:02.125Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Nugine Products: wgp Problem Types: CWE-362 Description: inner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Nugine/wgp/issues/1 - https://crates.io/crates/wgp
CVE ID: CVE-2025-47736 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-09T13:31:32.726Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: gwenn Products: libsql-sqlite3-parser Problem Types: CWE-228 Description: dialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tursodatabase/libsql/issues/2052 - https://github.com/gwenn/lemon-rs/issues/86 - https://github.com/gwenn/lemon-rs/pull/8 - https://crates.io/crates/libsql-sqlite3-parser
CVE ID: CVE-2025-47737 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-09T15:54:31.213Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Geal Products: trailer Problem Types: CWE-762 Description: lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Geal/trailer/issues/2 - https://crates.io/crates/trailer
CVE ID: CVE-2025-47748 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-05-30T17:01:48.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwrix Directory Manager v.11.0.0.0 and before & after v.11.1.25134.03 contains a hardcoded password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://netwrix.com - https://community.netwrix.com/t/adv-2025-014-critical-vulnerabilities-in-netwrix-directory-manager-formerly-imanami-groupid-v11/13951
CVE ID: CVE-2025-47749 State: PUBLISHED Published: 2025-05-19T07:43:43.944Z Last Updated: 2025-05-19T15:27:49.811Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. Products: V-SFT Problem Types: CWE-761 Description: V-SFT v6.2.5.0 and earlier contains an issue with free of pointer not at start of buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU9
t: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU97228144/
CVE ID: CVE-2025-47750 State: PUBLISHED Published: 2025-05-19T07:44:11.819Z Last Updated: 2025-05-19T15:27:26.832Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. Products: V-SFT Problem Types: CWE-787 Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6MemInIF!set_temp_type_default function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU97228144/
CVE ID: CVE-2025-47751 State: PUBLISHED Published: 2025-05-19T07:44:36.296Z Last Updated: 2025-05-19T15:26:53.592Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. Products: V-SFT Problem Types: CWE-787 Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6EditData!CDataRomErrorCheck::MacroCommandCheck function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU97228144/
CVE ID: CVE-2025-47752 State: PUBLISHED Published: 2025-05-19T07:44:58.141Z Last Updated: 2025-05-19T15:20:36.962Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. Products: V-SFT Problem Types: CWE-787 Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6ComFile!MakeItemGlidZahyou function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU97228144/
CVE ID: CVE-2025-47753 State: PUBLISHED Published: 2025-05-19T07:45:27.403Z Last Updated: 2025-05-19T15:18:55.399Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. Products: V-SFT Problem Types: CWE-125 Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!CDrawSLine::GetRectArea function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU97228144/
CVE ID: CVE-2025-47754 State: PUBLISHED Published: 2025-05-19T07:45:52.316Z Last Updated: 2025-05-19T15:12:19.196Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. Products: V-SFT Problem Types: CWE-125 Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!Conv_Macro_Data function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU97228144/
CVE ID: CVE-2025-47755 State: PUBLISHED Published: 2025-05-19T07:46:09.956Z Last Updated: 2025-05-19T15:00:48.857Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. Products: V-SFT Problem Types: CWE-125 Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!VS4_SaveEnvFile function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU97228144/
CVE ID: CVE-2025-47756 State: PUBLISHED Published: 2025-05-19T07:46:38.474Z Last Updated: 2025-05-19T14:47:36.093Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. Products: V-SFT Problem Types: CWE-125 Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!CGamenDataRom::set_mr400_strc function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU97228144/
CVE ID: CVE-2025-47757 State: PUBLISHED Published: 2025-05-19T07:47:16.674Z Last Updated: 2025-05-19T14:44:26.818Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. Products: V-SFT Problem Types: CWE-125 Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6MemInIF.dll!set_plc_type_default function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU97228144/
CVE ID: CVE-2025-47758 State: PUBLISHED Published: 2025-05-19T07:47:32.122Z Last Updated: 2025-05-19T16:01:07.022Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. Products: V-SFT Problem Types: CWE-121 Description: V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6File!CTxSubFile::get_ProgramFile_name function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU97228144/
CVE ID: CVE-2025-47759 State: PUBLISHED Published: 2025-05-19T07:47:43.969Z Last Updated: 2025-05-19T16:00:36.040Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. Products: S-SFT Problem Types: CWE-121 Description: V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6ComFile!CV7BaseMap::WriteV7DataToRom function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU97228144/
CVE ID: CVE-2025-47760 State: PUBLISHED Published: 2025-05-19T07:48:00.492Z Last Updated: 2025-05-19T15:48:52.253Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. Products: V-SFT Problem Types: CWE-121 Description: V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6MemInIF!set_temp_type_default function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU97228144/
CVE ID: CVE-2025-47761 State: PUBLISHED Published: 2025-11-18T17:01:11.767Z Last Updated: 2025-11-24T10:19:47.636Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiClientWindows Problem Types: CWE-782 Description: An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via fortips driver. Success of the attack would require bypassing the Windows memory protections such as Heap integrity and HSP. In addition, it requires a valid and running VPN IPSec c
the Windows memory protections such as Heap integrity and HSP. In addition, it requires a valid and running VPN IPSec connection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-112
CVE ID: CVE-2025-47762 State: REJECTED Published: N/A Last Updated: 2025-05-10T02:55:08.567Z Description: No description available.
CVE ID: CVE-2025-47763 State: REJECTED Published: N/A Last Updated: 2025-05-10T02:55:08.051Z Description: No description available.
CVE ID: CVE-2025-47764 State: REJECTED Published: N/A Last Updated: 2025-05-10T02:55:07.549Z Description: No description available.
CVE ID: CVE-2025-47765 State: REJECTED Published: N/A Last Updated: 2025-05-10T02:55:07.105Z Description: No description available.
CVE ID: CVE-2025-47766 State: REJECTED Published: N/A Last Updated: 2025-05-10T02:55:06.644Z Description: No description available.
CVE ID: CVE-2025-47767 State: REJECTED Published: N/A Last Updated: 2025-05-10T02:55:06.090Z Description: No description available.
CVE ID: CVE-2025-47768 State: REJECTED Published: N/A Last Updated: 2025-05-10T02:55:05.619Z Description: No description available.
CVE ID: CVE-2025-47769 State: REJECTED Published: N/A Last Updated: 2025-05-10T02:55:05.170Z Description: No description available.
CVE ID: CVE-2025-47770 State: REJECTED Published: N/A Last Updated: 2025-05-10T02:55:04.700Z Description: No description available.
CVE ID: CVE-2025-47771 State: PUBLISHED Published: 2025-06-19T23:41:41.357Z Last Updated: 2025-06-20T15:55:29.328Z Vendors: powsybl Products: powsybl-core Problem Types: CWE-502 Description: PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in an InputStream and returns a SparseMatrix object. This issue has been patched in com.powsybl:powsybl-math: 6.7.2. A workaround for this issue involves not using SparseMatrix deserialization (SparseMatrix.read(
ybl:powsybl-math: 6.7.2. A workaround for this issue involves not using SparseMatrix deserialization (SparseMatrix.read(...) methods). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/powsybl/powsybl-core/security/advisories/GHSA-f5cx-h789-j959 - https://github.com/powsybl/powsybl-core/commit/8ed16ce41683c4aef5f6aa1dd5ae8642aa5ed2bd - https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2
CVE ID: CVE-2025-47773 State: PUBLISHED Published: 2025-11-10T19:13:09.254Z Last Updated: 2025-11-10T19:37:10.297Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is edited via an AJAX call. Versions 2.7.13 and 3.2.2 protect rendered HTML content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-9qmf-5457-9xp3
CVE ID: CVE-2025-47774 State: PUBLISHED Published: 2025-05-15T17:38:58.487Z Last Updated: 2025-05-15T18:33:29.976Z Vendors: vyperlang Products: vyper Problem Types: CWE-691 Description: Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (`msg.data` or `<address>.code`). The reason is that for these source locations, the check that `length >= 1` is skipped. The result is that a 0-length bytestring constructed with slice can be passed to `make_byte_array_copier`, which elides evaluation of its source argument when t
constructed with slice can be passed to `make_byte_array_copier`, which elides evaluation of its source argument when the max length is 0. The impact is that side effects in the `start` argument may be elided when the `length` argument is 0, e.g. `slice(msg.data, self.do_side_effect(), 0)`. The fix in pull request 4645 disallows any invocation of `slice()` with length 0, including for the ad hoc locations discussed in this advisory. The fix is expected to be part of version 0.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-3vcg-j39x-cwfm - https://github.com/vyperlang/vyper/pull/4645 - https://github.com/vyper
/vyper/security/advisories/GHSA-3vcg-j39x-cwfm - https://github.com/vyperlang/vyper/pull/4645 - https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L315-L319 - https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/codegen/core.py#L189-L191
CVE ID: CVE-2025-47775 State: PUBLISHED Published: 2025-05-14T15:18:37.058Z Last Updated: 2025-05-14T15:42:42.206Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: bullfrogsec Products: bullfrog Problem Types: CWE-201 Description: Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bullfrogsec/bullfrog/security/advisories/GHSA-m32f-fjw2-37v3 - https://github.com/bullfrogsec/bullfrog/commit/ae7744ae4
/bullfrogsec/bullfrog/security/advisories/GHSA-m32f-fjw2-37v3 - https://github.com/bullfrogsec/bullfrog/commit/ae7744ae4b3a6f8ffc2e49f501e30bf1a43d4671 - https://github.com/bullfrogsec/bullfrog/releases/tag/v0.8.4
CVE ID: CVE-2025-47776 State: PUBLISHED Published: 2025-11-04T20:31:01.759Z Last Updated: 2025-11-05T18:48:23.378Z Vendors: mantisbt Products: mantisbt Problem Types: CWE-305 Description: Mantis Bug Tracker (MantisBT) is an open source issue tracker. Due to incorrect use of loose (==) instead of strict (===) comparison in the authentication code in versions 2.27.1 and below.PHP type juggling will cause certain MD5 hashes matching scientific notation to be interpreted as numbers. Instances using the MD5 login method allow an attacker who knows the victim's username and has access to an account with a password hash that evaluates to zero to log in without knowing the victim's actual password,
ccess to an account with a password hash that evaluates to zero to log in without knowing the victim's actual password, by using any other password with a hash that also evaluates to zero This issue is fixed in version 2.27.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mantisbt/mantisbt/security/advisories/GHSA-4v8w-gg5j-ph37 - https://github.com/mantisbt/mantisbt/commit/966554a19cf1bdbcfbfb3004766979faa748f9a2
CVE ID: CVE-2025-47777 State: PUBLISHED Published: 2025-05-14T15:23:28.565Z Last Updated: 2025-05-14T15:39:38.173Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: nanbingxyz Products: 5ire Problem Types: CWE-20, CWE-79 Description: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Versions prior to 0.11.1 are vulnerable to stored cross-site scripting in chatbot responses due to insufficient sanitization. This, in turn, can lead to Remote Code Execution (RCE) via unsafe Electron protocol handling and exposed Electron APIs. All users of 5ire client versions prior to patched releases, particularly those inte