Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
lnrichment: References: - https://patchstack.com/database/wordpress/plugin/distance-based-shipping-calculator/vulnerability/wordpress-distance-based-shipping-calculator-plugin-2-0-22-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-26765 State: PUBLISHED Published: 2025-02-16T22:17:18.447Z Last Updated: 2025-02-18T19:34:21.938Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: enituretechnology Products: Distance Based Shipping Calculator Problem Types: CWE-862 Description: Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Distance Based Shipping Calculator: from n/a through 2.0.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/distance-based-shipping-calculator/vulnerabil
lnrichment: References: - https://patchstack.com/database/wordpress/plugin/distance-based-shipping-calculator/vulnerability/wordpress-distance-based-shipping-calculator-plugin-2-0-22-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26766 State: PUBLISHED Published: 2025-02-16T22:17:18.599Z Last Updated: 2025-02-18T19:34:07.277Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: VaultDweller Products: Leyka Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka allows Stored XSS. This issue affects Leyka: from n/a through 3.31.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/leyka/vulnerability/wordpress-leyka-plugin-3-31-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26767 State: PUBLISHED Published: 2025-02-16T22:17:18.804Z Last Updated: 2025-02-18T19:33:50.267Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Themeum Products: Qubely – Advanced Gutenberg Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely – Advanced Gutenberg Blocks allows Stored XSS. This issue affects Qubely – Advanced Gutenberg Blocks: from n/a through 1.8.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/qubely/vulnerability/wordpress-qubely-advanced-gutenberg-
References: - https://patchstack.com/database/wordpress/plugin/qubely/vulnerability/wordpress-qubely-advanced-gutenberg-blocks-plugin-1-8-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26768 State: PUBLISHED Published: 2025-02-16T22:17:18.973Z Last Updated: 2025-02-18T19:33:41.976Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: what3words Products: what3words Address Field Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in what3words what3words Address Field allows Stored XSS. This issue affects what3words Address Field: from n/a through 4.0.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/3-word-address-validation-field/vulnerability/wordpress-what3words-address-field-plugin-4-0-15-csrf-to-stored-xss-vulnerability?_s_id
s-validation-field/vulnerability/wordpress-what3words-address-field-plugin-4-0-15-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26769 State: PUBLISHED Published: 2025-02-17T11:38:14.017Z Last Updated: 2025-02-18T15:44:32.673Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Webilia Inc. Products: Vertex Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilia Inc. Vertex Addons for Elementor allows Stored XSS. This issue affects Vertex Addons for Elementor: from n/a through 1.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/addons-for-elementor-builder/vulnerability/wordpress-vertex-addons-fo
- https://patchstack.com/database/wordpress/plugin/addons-for-elementor-builder/vulnerability/wordpress-vertex-addons-for-elementor-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26770 State: PUBLISHED Published: 2025-02-17T11:38:14.181Z Last Updated: 2025-02-18T15:44:11.727Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Joe Products: Waymark Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Waymark allows Stored XSS. This issue affects Waymark: from n/a through 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/waymark/vulnerability/wordpress-waymark-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26771 State: PUBLISHED Published: 2025-02-17T11:38:14.380Z Last Updated: 2025-02-18T15:43:49.090Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: sonalsinha21 Products: SKT Blocks – Gutenberg based Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks – Gutenberg based Page Builder allows Stored XSS. This issue affects SKT Blocks – Gutenberg based Page Builder: from n/a through 1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/skt-blocks/vulnerability/word
s: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/skt-blocks/vulnerability/wordpress-skt-blocks-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26772 State: PUBLISHED Published: 2025-02-17T11:38:14.632Z Last Updated: 2025-02-18T19:31:09.381Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Detheme Products: DethemeKit For Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detheme DethemeKit For Elementor allows Stored XSS. This issue affects DethemeKit For Elementor: from n/a through 2.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dethemekit-for-elementor/vulnerability/wordpress-dethemekit-for-elementor-plugin-2-1-8-c
k.com/database/wordpress/plugin/dethemekit-for-elementor/vulnerability/wordpress-dethemekit-for-elementor-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26773 State: PUBLISHED Published: 2025-02-17T11:38:14.852Z Last Updated: 2025-02-18T19:30:52.704Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Adnan Products: Analytify Problem Types: CWE-862 Description: Missing Authorization vulnerability in Adnan Analytify allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Analytify: from n/a through 5.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-analytify/vulnerability/wordpress-analytify-plugin-5-5-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26774 State: PUBLISHED Published: 2025-02-22T15:52:48.226Z Last Updated: 2025-02-24T12:27:25.605Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Rock Solid Products: Responsive Modal Builder for High Conversion – Easy Popups Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rock Solid Responsive Modal Builder for High Conversion – Easy Popups allows Reflected XSS. This issue affects Responsive Modal Builder for High Conversion – Easy Popups: from n/a through 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/datab
s: from n/a through 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-popups/vulnerability/wordpress-responsive-modal-builder-for-high-conversion-easy-popups-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26775 State: PUBLISHED Published: 2025-02-17T11:38:15.074Z Last Updated: 2025-02-18T19:30:45.150Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: RealMag777 Products: BEAR Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 BEAR allows Stored XSS. This issue affects BEAR: from n/a through 1.1.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-bulk-editor/vulnerability/wordpress-bear-plugin-1-1-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26776 State: PUBLISHED Published: 2025-02-22T15:52:48.403Z Last Updated: 2025-02-24T12:26:33.969Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: NotFound Products: Chaty Pro Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server. This issue affects Chaty Pro: from n/a through 3.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/chaty-pro/vulnerability/wordpress-chaty-pro-plugin-3-3-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-26778 State: PUBLISHED Published: 2025-02-17T11:38:15.283Z Last Updated: 2025-02-18T19:30:35.122Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Gallery Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Gallery allows Stored XSS. This issue affects Gallery: from n/a through 2.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gallery/vulnerability/wordpress-gallery-custom-links-plugin-2-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26779 State: PUBLISHED Published: 2025-02-16T22:17:19.112Z Last Updated: 2025-02-18T19:33:34.190Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Fahad Mahmood Products: Keep Backup Daily Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fahad Mahmood Keep Backup Daily allows Path Traversal. This issue affects Keep Backup Daily: from n/a through 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/keep-backup-daily/vulnerability/wordpress-keep-backup-daily-plugin-2-1-0-arbitrary-file-download-vu
ase/wordpress/plugin/keep-backup-daily/vulnerability/wordpress-keep-backup-daily-plugin-2-1-0-arbitrary-file-download-vulnerability?_s_id=cve
CVE ID: CVE-2025-26780 State: PUBLISHED Published: 2025-07-07T00:00:00.000Z Last Updated: 2025-07-08T17:36:59.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in L2 in Samsung Mobile Processor and Modem Exynos 2400 and Modem 5400. The lack of a length check leads to a Denial of Service via a malformed PDCP packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26780/
CVE ID: CVE-2025-26781 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-21T14:57:13.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 9110, W920, W930, Modem 5123, and Modem 5300. Incorrect handling of RLC AM PDUs leads to a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26781/
CVE ID: CVE-2025-26782 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-21T14:53:44.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 9110, W920, W930, Modem 5123, and Modem 5300. Incorrect handling of RLC AM PDUs leads to a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26782/
CVE ID: CVE-2025-26783 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-15T14:55:51.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, W1000, Modem 5300, and Modem 5400. Incorrect handling of undefined values leads to a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26783/
CVE ID: CVE-2025-26784 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-19T18:08:01.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The lack of a length check leads to out-of-bounds writes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26784/
CVE ID: CVE-2025-26785 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-27T18:09:41.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The lack of a length check leads to out-of-bounds writes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26785/
CVE ID: CVE-2025-26788 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-15T18:30:13.176Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: StrongKey Products: FIDO Server Problem Types: CWE-639 Description: StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.strongkey.com/index.php/skfs-v3/skfs-release-notes - https://www.securing.pl/en/cve-2025-26788-passkey-authentication-bypass-in-strongkey-fido-server/
CVE ID: CVE-2025-26789 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-14T15:33:35.216Z Vendors: Logpoint Products: AgentX Problem Types: CWE-1336 Description: An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://servicedesk.logpoint.com/hc/en-us/articles/24749416515741-Unauthorized-information-access-due-to-inadequate-access-controls
CVE ID: CVE-2025-26791 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-14T15:30:49.790Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Cure53 Products: DOMPurify Problem Types: CWE-79 Description: DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cure53/DOMPurify/releases/tag/3.2.4 - https://github.com/cure53/DOMPurify/commit/d18ffcb554e0001748865da03ac75dd7829f0f02 - https://nsysean.github.io/posts/dompurify-323-bypass/ - https://ensy.zip/posts/dompurify-323-bypa
5da03ac75dd7829f0f02 - https://nsysean.github.io/posts/dompurify-323-bypass/ - https://ensy.zip/posts/dompurify-323-bypass/
CVE ID: CVE-2025-26793 State: PUBLISHED Published: 2025-02-15T00:00:00.000Z Last Updated: 2025-02-24T16:39:41.829Z Vendors: Hirsch Products: Enterphone MESH Problem Types: CWE-1393 Description: The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE:
dminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE: the Supplier's perspective is that the "vulnerable systems are not following manufacturers' recommendations to change the default password." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.identiv.com/products/physical-access/hirsch/ - https://www.ericdaigle.ca/posts/breaking-into-dozens-of-apartments-in-five-minutes/ - https://news.ycombinator.com/item?id=43160884
CVE ID: CVE-2025-26794 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-22T00:09:59.316Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Exim Products: Exim Problem Types: CWE-89 Description: Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://exim.org - https://github.com/Exim/exim/wiki/EximSecurity - https://www.exim.org/static/doc/security/CVE-2025-26794.txt - https://code.exim.org/exim/exim/commit/bfe32b5c6ea033736a26da8421513206db9fe305 - https://bugzilla.suse.com/show_bug.cgi?id=1
://code.exim.org/exim/exim/commit/bfe32b5c6ea033736a26da8421513206db9fe305 - https://bugzilla.suse.com/show_bug.cgi?id=1237424 - https://github.com/NixOS/nixpkgs/pull/383926 - https://github.com/openbsd/ports/commit/584d2c49addce9ca0ae67882cc16969104d7f82d
CVE ID: CVE-2025-26795 State: PUBLISHED Published: 2025-05-14T10:43:05.586Z Last Updated: 2025-05-19T18:43:08.129Z Vendors: Apache Software Foundation Products: Apache IoTDB JDBC driver Problem Types: CWE-200, CWE-532 Description: Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver. This issue affects iotdb-jdbc: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 2.0.2 and 1.3.4, which fix the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/bj0ytxr5wg0c4jw8xm7rhfd8o
CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/bj0ytxr5wg0c4jw8xm7rhfd8ogho0r91
CVE ID: CVE-2025-26796 State: PUBLISHED Published: 2025-03-22T12:23:19.140Z Last Updated: 2025-03-24T14:05:19.477Z Vendors: Apache Software Foundation Products: Apache Oozie Problem Types: CWE-79 Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analy
d users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/fzrmsslnrpl0vpp0jr73fosmfjv4omdq
CVE ID: CVE-2025-26803 State: PUBLISHED Published: 2025-02-24T00:00:00.000Z Last Updated: 2025-02-24T17:00:10.319Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Phusion Products: Passenger Problem Types: CWE-908 Description: The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.phusionpassenger.com/support - https://github.com/phusion/passenger/compare/release-6.0.25...release-6.0.26 - https://github.com/phusion/passenger/releases/tag/release-6.0.26 - https://blog.phusion.nl/2025
.0.25...release-6.0.26 - https://github.com/phusion/passenger/releases/tag/release-6.0.26 - https://blog.phusion.nl/2025/02/19/passenger-6-0-26/ - https://github.com/phusion/passenger/commit/bb15591646687064ab2d578d5f9660b2a4168017
CVE ID: CVE-2025-26816 State: PUBLISHED Published: 2025-03-19T00:00:00.000Z Last Updated: 2025-03-25T12:52:20.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Intrexx Portal Server 12.0.2 and earlier which was classified as problematic potentially allows users with particular permissions under certain conditions to see potentially sensitive data from a different user context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.intrexx.com/en/security-advisories/ixsa-20250310-01/
CVE ID: CVE-2025-26817 State: PUBLISHED Published: 2025-04-03T00:00:00.000Z Last Updated: 2025-05-29T13:28:16.752Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwrix Password Secure 9.2.0.32454 allows OS command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.netwrix.com/bundle/PasswordSecure_9.2_ReleaseNotes/resource/Netwrix_PasswordSecure_9.2_BugFixList.pdf - https://security.netwrix.com/advisories/adv-2025-009 - https://www.8com.de/cyber-security-blog/authenticated-remote-code-execution-in-netwrix-password-secure-cve-2025-26817
CVE ID: CVE-2025-26818 State: PUBLISHED Published: 2025-04-03T00:00:00.000Z Last Updated: 2025-04-04T15:26:39.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwrix Password Secure through 9.2 allows command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.netwrix.com/bundle/PasswordSecure_9.2_ReleaseNotes/resource/Netwrix_PasswordSecure_9.2_BugFixList.pdf - https://security.netwrix.com/advisories/adv-2025-009
CVE ID: CVE-2025-26819 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-18T16:29:36.927Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: getmonero Products: Monero Problem Types: CWE-770 Description: Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/monero-project/monero/commit/ec74ff4a3d3ca38b7912af680209a45fd1701c3d