Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-61672 State: PUBLISHED Published: 2025-10-08T14:55:06.378Z Last Updated: 2025-10-15T16:11:07.284Z Vendors: element-hq Products: synapse Problem Types: CWE-1287 Description: Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. The issue is patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, t
ugh 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, the maintainers of Synapse recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr - https://github.com/element-hq/synapse/pull/17097 - https://github.com/element-hq/synapse/commit/26aaaf9e48fff80cf67a20c691c75d670034b3c1 - https://github.com/element-hq/synapse/commit/7069636c2d6d1ef2022287addf3ed8b919ef2740 - https://github.com/element-hq/synapse/releases/tag/v1.138.3 - https://github.com/element-hq/synapse/r
df3ed8b919ef2740 - https://github.com/element-hq/synapse/releases/tag/v1.138.3 - https://github.com/element-hq/synapse/releases/tag/v1.139.1
CVE ID: CVE-2025-61673 State: PUBLISHED Published: 2025-10-03T21:12:24.471Z Last Updated: 2025-10-06T13:19:08.624Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: Aiven-Open Products: karapace Problem Types: CWE-306, CWE-288 Description: Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization header, the token validation logic is skipped entirely, allowing an unauthenticated user to read and write to Schema Registry endpoints that should otherwise be protected. T
y, allowing an unauthenticated user to read and write to Schema Registry endpoints that should otherwise be protected. This effectively renders the OAuth authentication mechanism ineffective. This issue is fixed in version 5.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Aiven-Open/karapace/security/advisories/GHSA-vq25-vcrw-gj53 - https://github.com/Aiven-Open/karapace/pull/1143/commits/c4038e9ce9fa504b433d59ac2944e337292922c7 - https://github.com/Aiven-Open/karapace/releases/tag/5.0.2
CVE ID: CVE-2025-61675 State: PUBLISHED Published: 2025-10-14T19:30:27.362Z Last Updated: 2025-10-14T20:34:14.543Z Vendors: FreePBX Products: security-reporting Problem Types: CWE-89 Description: FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration functionality areas. Authentication with a known username is required to exploit these vulnerabilities. Successful exploitation allows authent
uthentication with a known username is required to exploit these vulnerabilities. Successful exploitation allows authenticated users to execute arbitrary SQL queries against the database, potentially enabling access to sensitive data or modification of database contents. This issue has been patched in version 16.0.92 for FreePBX 16 and version 17.0.6 for FreePBX 17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreePBX/security-reporting/security/advisories/GHSA-292p-rj6h-54cp
CVE ID: CVE-2025-61677 State: PUBLISHED Published: 2025-10-03T21:18:39.670Z Last Updated: 2025-10-06T15:41:16.866Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: iterative Products: datachain Problem Types: CWE-502 Description: DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the a
loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads. This issue is fixed in version 0.34.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/iterative/datachain/security/advisories/GHSA-6px8-mr29-cj4r - https://github.com/iterative/datachain/pull/1358 - https://github.com/iterative/datachain/commit/914b95610620d50c8d9bee506ccbfa7d4d57fdc0
CVE ID: CVE-2025-61678 State: PUBLISHED Published: 2025-10-14T19:33:29.934Z Last Updated: 2025-10-18T03:55:45.279Z Vendors: FreePBX Products: security-reporting Problem Types: CWE-434 Description: FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter. The fwbrand parameter allows an attacker to change the file path. Combined, these issues can result in a webshell being uploaded. Authentication with a known username is required to exploit this vulner
issues can result in a webshell being uploaded. Authentication with a known username is required to exploit this vulnerability. Successful exploitation allows authenticated users to upload arbitrary files to attacker-controlled paths on the server, potentially leading to remote code execution. This issue has been patched in version 16.0.92 for FreePBX 16 and version 17.0.6 for FreePBX 17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreePBX/security-reporting/security/advisories/GHSA-7p8x-8m3m-58j9
CVE ID: CVE-2025-61679 State: PUBLISHED Published: 2025-10-03T21:27:35.612Z Last Updated: 2025-10-06T15:42:51.744Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: julien040 Products: anyquery Problem Types: CWE-200, CWE-287 Description: Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. This issue is fixed in version 0.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References
n from the provider. This issue is fixed in version 0.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/julien040/anyquery/security/advisories/GHSA-5f7p-rhmq-hvc7 - https://github.com/julien040/anyquery/commit/43cd8bd3354b9725b245a2354b08e1c9be1cc1d3 - https://github.com/julien040/anyquery/releases/tag/0.4.4
CVE ID: CVE-2025-61680 State: PUBLISHED Published: 2025-10-03T21:37:31.341Z Last Updated: 2025-10-06T15:43:41.340Z Vendors: jaketcooper Products: Minecraft-rcon Problem Types: CWE-256 Description: Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's configuration API which writes to settings.json in plaintext. This issue is fixed in version 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jaketcooper/Minecraft-rcon/security/advisories/GHSA-4m33-hxqw-7j77 - https://github.com/jaketcooper/Minecraft-rcon/commit/31272b541482d095d1578855c2b571268eb9b877 -
es/GHSA-4m33-hxqw-7j77 - https://github.com/jaketcooper/Minecraft-rcon/commit/31272b541482d095d1578855c2b571268eb9b877 - https://github.com/jaketcooper/Minecraft-rcon/releases/tag/2.1.0
CVE ID: CVE-2025-61681 State: PUBLISHED Published: 2025-10-03T21:46:59.313Z Last Updated: 2025-10-06T15:45:27.050Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: xuemian168 Products: kuno Problem Types: CWE-79, CWE-434 Description: KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exploited for stored XSS. The upload endpoint only validates file types based on Content-Type headers, lacks file content analysis and extension whitelist restrictions, allowing attackers to upload SVG files containing malicious scripts (disguised as images). When users access
strictions, allowing attackers to upload SVG files containing malicious scripts (disguised as images). When users access the uploaded resource pages, arbitrary JavaScript executes in their browsers. This issue is fixed in version 1.3.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xuemian168/kuno/security/advisories/GHSA-q3w2-2vqp-gx3r - https://github.com/xuemian168/kuno/commit/fc486b5c9091b607f82bf7b354d18f25204f7dc6 - https://github.com/xuemian168/kuno/releases/tag/v1.3.14
CVE ID: CVE-2025-61685 State: PUBLISHED Published: 2025-10-03T22:37:09.027Z Last Updated: 2025-10-06T15:52:03.828Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: mastra-ai Products: mastra Problem Types: CWE-548 Description: Mastra is a Typescript framework for building AI agents and assistants. Versions 0.13.8 through 0.13.20-alpha.0 are vulnerable to a Directory Traversal attack that results in the disclosure of directory listings. The code contains a security check to prevent path traversal for reading file contents, but this check is effectively bypassed by subsequent logic that attempts to find directory suggestions. An attacker can leverage this flaw
ffectively bypassed by subsequent logic that attempts to find directory suggestions. An attacker can leverage this flaw to list the contents of arbitrary directories on the user's filesystem, including the user's home directory, exposing sensitive information about the file system's structure. This issue is fixed in version 0.13.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mastra-ai/mastra/security/advisories/GHSA-xh92-rqrq-227v - https://github.com/mastra-ai/mastra/commit/7f2b528ba82db512d68832d2f8ad6cbc8bb46cd4
CVE ID: CVE-2025-61687 State: PUBLISHED Published: 2025-10-06T15:54:56.166Z Last Updated: 2025-10-06T16:04:25.632Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: FlowiseAI Products: Flowise Problem Types: CWE-434 Description: Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE). The system fails to validate file extensions, MIME types, or file content
tially leading to Remote Code Execution (RCE). The system fails to validate file extensions, MIME types, or file content during uploads. As a result, malicious scripts such as Node.js-based web shells can be uploaded and stored persistently on the server. These shells expose HTTP endpoints capable of executing arbitrary commands if triggered. The uploaded shell does not automatically execute, but its presence allows future exploitation via administrator error or chained vulnerabilities. This presents a high-severity threat to system integrity and confidentiality. As of time of publication, no known patched versions are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
of publication, no known patched versions are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-35g6-rrw3-v6xc - https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/components/src/storageUtils.ts#L1104-L1111 - https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/components/src/storageUtils.ts#L170-L175 - https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/components/src/storageUtils.ts#L533-L541 - https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages
/storageUtils.ts#L533-L541 - https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/controllers/attachments/index.ts#L4-L11 - https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/routes/attachments/index.ts#L8 - https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/services/attachments/index.ts#L7-L16 - https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/utils/createAttachment.ts#L118-L126 - https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/util
#L118-L126 - https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/utils/index.ts#L1950-L1954
CVE ID: CVE-2025-61688 State: PUBLISHED Published: 2025-10-13T20:46:54.907Z Last Updated: 2025-10-14T14:14:06.042Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: siderolabs Products: omni Problem Types: CWE-200 Description: Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/siderolabs/omni/security/advisories/GHSA-77r9-w39m-9xh5
CVE ID: CVE-2025-61689 State: PUBLISHED Published: 2025-10-10T16:48:41.951Z Last Updated: 2025-10-10T19:12:55.936Z Vendors: JuliaWeb Products: HTTP.jl Problem Types: CWE-113 Description: HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. This enables HTTP response splitting and header injection, leading to cache poisoning, XSS, session fixation, and more. This issue is fixed in HTTP.jl `v1.10.19`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JuliaWeb/HTTP.jl/securi
`v1.10.19`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JuliaWeb/HTTP.jl/security/advisories/GHSA-h3x8-ppwj-6vcj - https://github.com/JuliaWeb/HTTP.jl/releases/tag/v1.10.19
CVE ID: CVE-2025-61690 State: PUBLISHED Published: 2025-10-02T05:51:41.355Z Last Updated: 2025-10-02T17:32:42.278Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: KEYENCE CORPORATION Products: KV STUDIO Problem Types: CWE-124 Description: KV STUDIO versions 12.23 and prior contain a buffer underflow vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.keyence.com/kv_vulnerability2509302 - https://jvn.jp/en/vu/JVNVU97069449/
CVE ID: CVE-2025-61691 State: PUBLISHED Published: 2025-10-02T05:51:13.591Z Last Updated: 2025-10-02T17:57:21.788Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: KEYENCE CORPORATION Products: VT STUDIO Problem Types: CWE-125 Description: VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.keyence.com/vt_vulnerability250930 - https://jvn.jp/en/vu/JVNVU97069449/
CVE ID: CVE-2025-61692 State: PUBLISHED Published: 2025-10-02T05:51:26.096Z Last Updated: 2025-10-02T17:33:11.276Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: KEYENCE CORPORATION Products: VT STUDIO Problem Types: CWE-416 Description: VT STUDIO versions 8.53 and prior contain a use after free vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.keyence.com/vt_vulnerability250930 - https://jvn.jp/en/vu/JVNVU97069449/
CVE ID: CVE-2025-61713 State: PUBLISHED Published: 2025-11-18T17:01:18.529Z Last Updated: 2025-11-18T19:10:33.592Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiPAM Problem Types: CWE-316 Description: A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an authenticated attacker with read-write admin privileges to the CLI to obtain other administrators' credentials via diagnose commands. Additional An
read-write admin privileges to the CLI to obtain other administrators' credentials via diagnose commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-789
CVE ID: CVE-2025-61714 State: REJECTED Published: N/A Last Updated: 2025-10-01T02:55:09.480Z Description: No description available.
CVE ID: CVE-2025-61715 State: REJECTED Published: N/A Last Updated: 2025-10-01T02:55:09.021Z Description: No description available.
CVE ID: CVE-2025-61716 State: REJECTED Published: N/A Last Updated: 2025-10-01T02:55:08.555Z Description: No description available.
CVE ID: CVE-2025-61717 State: REJECTED Published: N/A Last Updated: 2025-10-01T02:55:07.994Z Description: No description available.
CVE ID: CVE-2025-61718 State: REJECTED Published: N/A Last Updated: 2025-10-01T02:55:07.537Z Description: No description available.
CVE ID: CVE-2025-61719 State: REJECTED Published: N/A Last Updated: 2025-10-01T02:55:07.012Z Description: No description available.
CVE ID: CVE-2025-61720 State: REJECTED Published: N/A Last Updated: 2025-10-01T02:55:06.456Z Description: No description available.
CVE ID: CVE-2025-61721 State: REJECTED Published: N/A Last Updated: 2025-10-01T02:55:05.981Z Description: No description available.
CVE ID: CVE-2025-61722 State: REJECTED Published: N/A Last Updated: 2025-10-01T02:55:05.385Z Description: No description available.
CVE ID: CVE-2025-61723 State: PUBLISHED Published: 2025-10-29T22:10:13.220Z Last Updated: 2025-11-04T21:14:02.531Z Vendors: Go standard library Products: encoding/pem Problem Types: CWE-407: Inefficient Algorithmic Complexity Description: The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/issue/75676 - https://go.dev/cl/709858 - https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI - https://pkg.go.dev/vuln/GO-2025-4009
CVE ID: CVE-2025-61724 State: PUBLISHED Published: 2025-10-29T22:10:14.609Z Last Updated: 2025-11-04T21:14:03.930Z Vendors: Go standard library Products: net/textproto Problem Types: CWE-407: Inefficient Algorithmic Complexity Description: The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/709859 - https://go.dev/issue/75716 - https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI - https://pkg.go.dev/vuln/GO-2025-4015
CVE ID: CVE-2025-61725 State: PUBLISHED Published: 2025-10-29T22:10:12.255Z Last Updated: 2025-11-04T21:14:05.236Z Vendors: Go standard library Products: net/mail Problem Types: CWE-407: Inefficient Algorithmic Complexity Description: The ParseAddress function constructeds domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/709860 - https://go.dev/issue/75680 - https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI - https://pkg.go.dev/vuln/GO-2025-4006
CVE ID: CVE-2025-61733 State: PUBLISHED Published: 2025-10-02T09:47:39.126Z Last Updated: 2025-11-04T21:14:06.570Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/8wmcffly6gp50nmfw8j4w3hlmv843yo0
CVE ID: CVE-2025-61734 State: PUBLISHED Published: 2025-10-02T09:47:15.317Z Last Updated: 2025-11-04T21:14:07.897Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: CWE-552 Description: Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/z705g7sn3g0bkchlqbo1hz1tyqorn4d2
CVE ID: CVE-2025-61735 State: PUBLISHED Published: 2025-10-02T09:47:49.948Z Last Updated: 2025-11-04T21:14:09.199Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected. Users are recommended to upgrade to version 5.0.3, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh
CVE ID: CVE-2025-61748 State: PUBLISHED Published: 2025-10-21T20:03:08.113Z Last Updated: 2025-10-22T18:23:18.544Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Oracle Corporation Products: Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition Problem Types: Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition acce
pdate, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Description: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unautho