Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-64302 State: PUBLISHED Published: 2025-11-06T22:24:15.401Z Last Updated: 2025-11-07T13:23:28.291Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Advantech Products: DeviceOn/iEdge Problem Types: CWE-79 Description: Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-310-01 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-310-01.json - https://www.advantech.com/emt/contact
CVE ID: CVE-2025-64304 State: PUBLISHED Published: 2025-11-25T04:27:35.869Z Last Updated: 2025-11-25T04:27:35.869Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Fuji Television Network, Inc. Products: "FOD" App for Android, "FOD" App for iOS Problem Types: CWE-321 Description: "FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptographic keys. References: - https://help.fod.fujitv.co.jp/hc/ja/articles/48337068747033 - https://jvn.jp/en/jp/JVN63368617/
CVE ID: CVE-2025-64307 State: PUBLISHED Published: 2025-11-14T23:34:59.659Z Last Updated: 2025-11-17T16:51:31.868Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Brightpick AI Products: Brightpick Mission Control / Internal Logic Control Problem Types: CWE-306 Description: The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to manipulate robot control functions, including initiating or halting runners, assigning jobs, clearing stations, and deploying storage totes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://brightpick.ai/conta
nd deploying storage totes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://brightpick.ai/contact-us/ - https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-04 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-04.json
CVE ID: CVE-2025-64308 State: PUBLISHED Published: 2025-11-14T23:38:48.467Z Last Updated: 2025-11-17T16:58:32.428Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Brightpick AI Products: Brightpick Mission Control / Internal Logic Control Problem Types: CWE-523 Description: The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://brightpick.ai/contact-us/ - https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-04 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-04.json
CVE ID: CVE-2025-64309 State: PUBLISHED Published: 2025-11-14T23:41:18.445Z Last Updated: 2025-11-17T18:54:22.779Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Brightpick AI Products: Brightpick Mission Control / Internal Logic Control Problem Types: CWE-523 Description: Brightpick Mission Control discloses device telemetry, configuration, and credential information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://brightpick.ai/contact-us/ - https://www.cisa.gov/news-
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://brightpick.ai/contact-us/ - https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-04 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-04.json
CVE ID: CVE-2025-64310 State: PUBLISHED Published: 2025-11-21T02:36:35.115Z Last Updated: 2025-11-21T14:58:53.483Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SEIKO EPSON CORPORATION Products: EPSON WebConfig for SEIKO EPSON Projector Products, Epson Web Control for SEIKO EPSON Projector Products Problem Types: CWE-307 Description: EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrative user's password may be identified through a brute force attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.epson.jp/support/misc_t/251120_oshirase.htm
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.epson.jp/support/misc_t/251120_oshirase.htm - https://jvn.jp/en/vu/JVNVU95021911/
CVE ID: CVE-2025-64318 State: PUBLISHED Published: 2025-11-04T18:19:33.473Z Last Updated: 2025-11-11T04:48:57.876Z Vendors: Salesforce Products: Mulesoft Anypoint Code Builder Problem Types: CWE-1427 Description: Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005228032&type=1
CVE ID: CVE-2025-64319 State: PUBLISHED Published: 2025-11-04T18:22:51.106Z Last Updated: 2025-11-11T05:05:19.757Z Vendors: Salesforce Products: Mulesoft Anypoint Code Builder Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005228032&type=1
CVE ID: CVE-2025-64320 State: PUBLISHED Published: 2025-11-04T18:27:32.096Z Last Updated: 2025-11-05T14:32:23.386Z Vendors: Salesforce Products: Agentforce Vibes Extension Problem Types: CWE-1427 Description: Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentforce Vibes Extension: before 3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005228032&type=1
CVE ID: CVE-2025-64321 State: PUBLISHED Published: 2025-11-04T18:30:39.497Z Last Updated: 2025-11-11T05:09:50.301Z Vendors: Salesforce Products: Agentforce Vibes Extension Problem Types: CWE-1427 Description: Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005228032&type=1
CVE ID: CVE-2025-64322 State: PUBLISHED Published: 2025-11-04T18:33:19.118Z Last Updated: 2025-11-11T05:12:06.968Z Vendors: Salesforce Products: Agentforce Vibes Extension Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005228032&type=1
CVE ID: CVE-2025-64323 State: PUBLISHED Published: 2025-11-07T03:18:48.993Z Last Updated: 2025-11-07T17:50:53.540Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: kgateway-dev Products: kgateway Problem Types: CWE-862 Description: kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0. Additional Analyst Notes: - CISA A
outing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r - https://github.com/kgateway-dev/kgateway/issues/10651 - https://github.com/kgateway-dev/kgateway/pull/12471 - https://github.com/kgateway-dev/kgateway/pull/12535
CVE ID: CVE-2025-64324 State: PUBLISHED Published: 2025-11-18T22:10:19.661Z Last Updated: 2025-11-20T04:55:23.328Z Vendors: kubevirt Products: kubevirt Problem Types: CWE-200, CWE-732 Description: KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn't exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fi
ttacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubevirt/kubevirt/security/advisories/GHSA-46xp-26xh-hpqh - https://github.com/kubevirt/kubevirt/pull/15037 - https://github.com/kubevirt/kubevirt/commit/00d03e43e3bf03e563136695a4732b65ed42d764 - https://github.com/kubevirt/kubevirt/commit/ff3b69b08b6b9c8d08d23735ca8d82455f790a69
CVE ID: CVE-2025-64325 State: PUBLISHED Published: 2025-11-18T22:32:06.902Z Last Updated: 2025-11-19T16:44:25.026Z Vendors: EmbySupport Products: Emby.Security Problem Types: CWE-79, CWE-116 Description: Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has been patched in version 4.8.1.0 and Beta version 4.9.0.0-beta. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/EmbySupport/Emby.Security/security/advisories/GHSA-2
st Notes: - CISA ADP Vulnrichment: References: - https://github.com/EmbySupport/Emby.Security/security/advisories/GHSA-2gwc-988r-2r7x
CVE ID: CVE-2025-64326 State: PUBLISHED Published: 2025-11-06T20:55:17.594Z Last Updated: 2025-11-06T21:18:02.834Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: WeblateOrg Products: weblate Problem Types: CWE-212 Description: Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed in version 5.14.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WeblateOrg/weblate/security/advisories/GHS
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gr35-vpx2-qxhc - https://github.com/WeblateOrg/weblate/pull/16781
CVE ID: CVE-2025-64327 State: PUBLISHED Published: 2025-11-06T21:07:17.672Z Last Updated: 2025-11-06T21:29:15.660Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: MatiasDesuu Products: ThinkDashboard Problem Types: CWE-918 Description: ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. Versions 0.6.7 and below contain a Blind Server-Side Request Forgery (SSRF) vulnerability, in its `/api/ping?url= endpoint`. This allows an attacker to make arbitrary requests to internal or external hosts. This can include discovering ports open on the local machine, hosts on the local network, and ports open on the hosts on the internal
de discovering ports open on the local machine, hosts on the local network, and ports open on the hosts on the internal network. This issue is fixed in version 0.6.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-p52r-qq3j-8p78 - https://github.com/MatiasDesuu/ThinkDashboard/commit/16976263b22a4b0526b2c7c30294cc099258edae - https://github.com/MatiasDesuu/ThinkDashboard/releases/tag/0.6.8
CVE ID: CVE-2025-64328 State: PUBLISHED Published: 2025-11-07T03:32:20.670Z Last Updated: 2025-11-07T17:45:23.284Z Vendors: FreePBX Products: security-reporting Problem Types: CWE-78 Description: FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3. Additional Analyst Notes
obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw - https://github.com/FreePBX/filestore/blob/f0e3983059271efd80b483ec823310ef19a59013/drivers/SSH/testconnection.php#L2 - https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80
CVE ID: CVE-2025-64329 State: PUBLISHED Published: 2025-11-07T04:15:09.381Z Last Updated: 2025-11-07T17:42:07.929Z Vendors: containerd Products: containerd Problem Types: CWE-401 Description: containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources. Additional Analyst Notes: - CISA ADP Vuln
n set up an admission controller to control accesses to pods/attach resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2 - https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df
CVE ID: CVE-2025-64336 State: PUBLISHED Published: 2025-11-07T04:32:10.401Z Last Updated: 2025-11-07T17:38:36.524Z Vendors: MacWarrior Products: clipbucket-v5 Problem Types: CWE-79, CWE-269 Description: ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scripting (XSS). An authenticated regular user can upload a photo with a malicious Photo Title containing HTML/JavaScript code. While the payload does not execute in the user-facing photo gallery or detail pages, it is rendered unsafely in the Admin → Manage Photos section, resulting in JavaScript execution in the administrator’s browser. This
d unsafely in the Admin → Manage Photos section, resulting in JavaScript execution in the administrator’s browser. This issue is fixed in version 5.5.2-#147. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-hjc2-5329-j49w - https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc - https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23147
CVE ID: CVE-2025-64338 State: REJECTED Published: N/A Last Updated: 2025-11-07T04:47:32.424Z Description: No description available.
CVE ID: CVE-2025-64339 State: PUBLISHED Published: 2025-11-07T05:12:37.704Z Last Updated: 2025-11-07T17:33:46.877Z Vendors: MacWarrior Products: clipbucket-v5 Problem Types: CWE-79 Description: ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Playlists feature is vulnerable to stored Cross-site Scripting (XSS),specifically in the Playlist Name field. An authenticated low-privileged user can create a playlist with a malicious name containing HTML/JavaScript code, which is rendered unescaped on playlist detail and listing pages. This results in arbitrary JavaScript execution in every viewer’s browser, including administrators. This issue is f
ges. This results in arbitrary JavaScript execution in every viewer’s browser, including administrators. This issue is fixed in version 5.5.2-#147. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-c695-m4g4-v3fv - https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc
CVE ID: CVE-2025-64342 State: PUBLISHED Published: 2025-11-17T17:21:01.773Z Last Updated: 2025-11-17T21:04:07.698Z Vendors: espressif Products: esp-idf Problem Types: CWE-754 Description: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. When the ESP32 is in advertising mode, if it receives a connection request containing an invalid Access Address (AA) of 0x00000000 or 0xFFFFFFFF, advertising may stop unexpectedly. In this case, the controller may incorrectly report a connection event to the host, which can cause the application layer to assume that the device has successfully established a connection. This issue has been fixed in versions 5.5.2, 5.4.3, 5.3.5, 5.2.6, a
he device has successfully established a connection. This issue has been fixed in versions 5.5.2, 5.4.3, 5.3.5, 5.2.6, and 5.1.7. At time of publication versions 5.5.2, 5.3.5, and 5.1.7 have not been released but are fixed respectively in commits 3b95b50, e3d7042, and 75967b5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espressif/esp-idf/security/advisories/GHSA-8mg7-9qpg-p92v - https://github.com/espressif/esp-idf/commit/309f031dd6b04de30c926a256508c65b0df95dfa - https://github.com/espressif/esp-idf/commit/3b95b50703cd3301a370cffaa1cc299b1941fe2a - https://github.com/espressif/esp-idf/commit/75967b578563ea7876dc215251cbb6d64bc9d768 - https://github.co
c299b1941fe2a - https://github.com/espressif/esp-idf/commit/75967b578563ea7876dc215251cbb6d64bc9d768 - https://github.com/espressif/esp-idf/commit/8ec541023684d33b498fa21c5b4724bce748aa7b - https://github.com/espressif/esp-idf/commit/bf66761962579f73aea682d1154b9c99b9d3d7dc - https://github.com/espressif/esp-idf/commit/e3d70429566ece1ef593d36aa4ebd320e0c95925
CVE ID: CVE-2025-64343 State: PUBLISHED Published: 2025-11-07T05:20:38.659Z Last Updated: 2025-11-07T17:24:38.228Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: conda Products: constructor Problem Types: CWE-289 Description: (conda) Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the installation directory inherits permissions from its parent directory. Outside of restricted directories, the permissions are very permissive and often allow write access by authenticated users. Any logged in user can make modifications during the installation for both single-user and all-user installatio
d users. Any logged in user can make modifications during the installation for both single-user and all-user installations. This constitutes a local attack vector if the installation is in a directory local users have access to. For single-user installations in a shared directory, these permissions persist after the installation. This issue is fixed in version 3.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/conda/constructor/security/advisories/GHSA-vvpr-2qg4-2mrq - https://github.com/conda/constructor/commit/c368383710a7c2b81ad1b0ecb9724b38d3577447 - https://github.com/conda/constructor/releases/tag/3.13.0
CVE ID: CVE-2025-64345 State: PUBLISHED Published: 2025-11-12T21:25:50.832Z Last Updated: 2025-11-12T21:40:37.909Z Severity: LOW (CVSS 1.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: bytecodealliance Products: wasmtime Problem Types: CWE-362 Description: Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host.
t sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default. Addit
e that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q - https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10 - https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new - https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new - https://docs.wasmtime.dev/stability-release.html - https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4
CVE ID: CVE-2025-64346 State: PUBLISHED Published: 2025-11-07T05:32:09.605Z Last Updated: 2025-11-07T13:19:52.595Z Vendors: jaredallard Products: archives Problem Types: CWE-22 Description: archives is a Go library for extracting archives (tar, zip, etc.). Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the program that imports it. Severity depends on user permissions, environment and how arbitrary archives are passed. This issue is fixed in version 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
y archives are passed. This issue is fixed in version 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jaredallard/archives/security/advisories/GHSA-j95m-rcjp-q69h - https://github.com/jaredallard/archives/commit/3bddec7bd3f38afbe97ae61d1c8a8487e9ea4ef1
CVE ID: CVE-2025-64347 State: PUBLISHED Published: 2025-11-07T17:47:28.360Z Last Updated: 2025-11-07T18:25:59.775Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: apollographql Products: router Problem Types: CWE-284 Description: Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields