Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-12672 State: PUBLISHED Published: 2025-11-11T03:30:40.036Z Last Updated: 2025-11-12T20:06:50.236Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nuvuscripts Products: Flickr Show Problem Types: CWE-79 Description: The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b792892-25dc-4df0-883d-afd0b47292e0?source=cve - https://wordpress.org/plugins/wp-flickrshow/ - https://plugins.trac.wordpress.org/browser/wp-flickrshow/tags/1.5/flickrshow.php#L230
CVE ID: CVE-2025-12674 State: PUBLISHED Published: 2025-11-05T07:27:56.065Z Last Updated: 2025-11-05T14:21:06.844Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mykiot Products: KiotViet Sync Problem Types: CWE-434 Description: The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.
remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7fdd670f-2a71-4c1d-af46-f0fd05352f7e?source=cve - https://wordpress.org/plugins/kiotvietsync/
CVE ID: CVE-2025-12675 State: PUBLISHED Published: 2025-11-05T07:27:56.886Z Last Updated: 2025-11-05T14:13:37.640Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: mykiot Products: KiotViet Sync Problem Types: CWE-862 Description: The KiotViet Sync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveConfig() function in all versions up to, and including, 1.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's config. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabili
fig. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e67c6c3f-0b2a-424f-b8f2-2771449c82b4?source=cve - https://wordpress.org/plugins/kiotvietsync/
CVE ID: CVE-2025-12676 State: PUBLISHED Published: 2025-11-05T07:27:56.492Z Last Updated: 2025-11-05T14:20:41.378Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: mykiot Products: KiotViet Sync Problem Types: CWE-259 Description: The KiotViet Sync plugin for WordPress is vulnerable to authorizarion bypass in all versions up to, and including, 1.8.5. This is due to the plugin using a hardcoded password for authentication in the QueryControllerAdmin::authenticated function. This makes it possible for unauthenticated attackers to create and sync products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vul
nc products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d7165b-1290-4032-8fbc-75ec1ab34a08?source=cve - https://wordpress.org/plugins/kiotvietsync/
CVE ID: CVE-2025-12677 State: PUBLISHED Published: 2025-11-05T07:27:55.399Z Last Updated: 2025-11-05T14:21:40.476Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: mykiot Products: KiotViet Sync Problem Types: CWE-200 Description: The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route() function in kiotvietsync/includes/public_actions/WebHookAction.php. This makes it possible for unauthenticated attackers to extract the webhook token value when configured. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel
when configured. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1114a84e-3425-402f-bcdc-a2ee05b2dbc9?source=cve - https://wordpress.org/plugins/kiotvietsync/
CVE ID: CVE-2025-12678 State: REJECTED Published: N/A Last Updated: 2025-11-21T22:19:03.194Z Description: No description available.
CVE ID: CVE-2025-12681 State: PUBLISHED Published: 2025-11-13T07:27:53.227Z Last Updated: 2025-11-14T16:48:37.608Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ronalfy Products: Comment Edit Core – Simple Comment Editing Problem Types: CWE-200 Description: The Comment Edit Core – Simple Comment Editing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.0 via the 'ajax_get_comment' function. This makes it possible for unauthenticated attackers to extract sensitive data including user IDs, IP addresses, and email addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ww
user IDs, IP addresses, and email addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4f954b02-b636-438b-a4b1-9b74df153c47?source=cve - https://plugins.trac.wordpress.org/browser/simple-comment-editing/trunk/includes/Ajax.php#L230 - https://plugins.trac.wordpress.org/changeset/3392054/
CVE ID: CVE-2025-12682 State: PUBLISHED Published: 2025-11-04T13:47:35.380Z Last Updated: 2025-11-04T14:16:38.630Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: fahadmahmood Products: Easy Upload Files During Checkout Problem Types: CWE-434 Description: The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_during_checkout' function in all versions up to, and including, 2.9.8. This makes it possible for unauthenticated attackers to upload arbitrary JavaScript files on the affected site's server which may make remote code execution possible. Additional
load arbitrary JavaScript files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6a050764-0ba6-49a4-bd71-f79e3129fc4c?source=cve - https://plugins.trac.wordpress.org/changeset/3384711/
CVE ID: CVE-2025-12683 State: PUBLISHED Published: 2025-11-04T04:23:02.884Z Last Updated: 2025-11-04T20:50:21.977Z Vendors: Voidtools Products: Everything Problem Types: CWE-269 Description: The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL and thus provides all users full permission over it; leading to potential Service Denial Of Service or Privilege escalation(only if chained with other elements) for a local low privilege user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.voidtools.com/
CVE ID: CVE-2025-12691 State: PUBLISHED Published: 2025-11-18T09:27:39.902Z Last Updated: 2025-11-18T21:10:54.234Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sayontan Products: Photonic Gallery & Lightbox for Flickr, SmugMug & Others Problem Types: CWE-79 Description: The Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox functionality in all versions up to, and including, 3.21 due to insufficient input sanitization and output escaping on user supplied caption attribute. This makes it possible for authenticated attackers, with contributor-level access and a
user supplied caption attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f21f4a4-4b50-4396-8d94-26d68c0eb3a3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3392284%40photonic&old=3336902%40photonic&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12695 State: PUBLISHED Published: 2025-11-04T13:24:42.358Z Last Updated: 2025-11-04T14:19:33.945Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Problem Types: CWE-653 Description: The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/dspy-sandbox-escape-arbitrary-file-read-jfsa-2025-001495652/
CVE ID: CVE-2025-12703 State: REJECTED Published: N/A Last Updated: 2025-11-12T22:19:16.959Z Description: No description available.
CVE ID: CVE-2025-12710 State: PUBLISHED Published: 2025-11-19T05:45:11.744Z Last Updated: 2025-11-19T20:19:56.878Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kwmanagement Products: Pet-Manager – Petfinder Problem Types: CWE-79 Description: The Pet-Manager – Petfinder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kwm-petfinder shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
tackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/35b0d959-2adb-4de4-b51b-1bfead49bc7d?source=cve - https://plugins.trac.wordpress.org/browser/tier-management-petfinder/tags/3.6.1/kwm-petfinder.php#L133 - https://plugins.trac.wordpress.org/browser/tier-management-petfinder/tags/3.6.1/kwm-petfinder.php#L163 - https://plugins.trac.wordpress.org/browser/tier-management-petfinder/tags/3.6.1/kwm-petfinder.php#L164 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph
er-management-petfinder/tags/3.6.1/kwm-petfinder.php#L164 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3396792%40tier-management-petfinder&new=3396792%40tier-management-petfinder&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12711 State: PUBLISHED Published: 2025-11-11T03:30:43.813Z Last Updated: 2025-11-14T15:31:11.868Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pritenhshah Products: Share to Google Classroom Problem Types: CWE-79 Description: The Share to Google Classroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the share_to_google shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/87cc821c-21d5-49b7-9b72-030ca016efd8?source=cve - https://plugins.trac.wordpress.org/browser/share-to-google-classroom/tags/1.0/share_to_google_classroom.php#L59
CVE ID: CVE-2025-12725 State: PUBLISHED Published: 2025-11-10T20:00:54.893Z Last Updated: 2025-11-21T05:02:07.085Z Vendors: Google Products: Chrome Problem Types: CWE-125 Description: Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/443906252
CVE ID: CVE-2025-12726 State: PUBLISHED Published: 2025-11-10T20:00:55.285Z Last Updated: 2025-11-11T04:55:40.665Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Views in Google Chrome on Windows prior to 142.0.7444.137 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/447172715
CVE ID: CVE-2025-12727 State: PUBLISHED Published: 2025-11-10T20:00:55.682Z Last Updated: 2025-11-12T17:09:17.181Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/454485895
CVE ID: CVE-2025-12728 State: PUBLISHED Published: 2025-11-10T20:00:56.221Z Last Updated: 2025-11-10T21:28:13.388Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/452392032
CVE ID: CVE-2025-12729 State: PUBLISHED Published: 2025-11-10T20:00:56.626Z Last Updated: 2025-11-10T20:11:58.196Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/454354281
CVE ID: CVE-2025-12732 State: PUBLISHED Published: 2025-11-12T08:28:04.060Z Last Updated: 2025-11-12T14:40:54.845Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: smackcoders Products: WP Import – Ultimate CSV XML Importer for WordPress Problem Types: CWE-200 Description: The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting() function in all versions up to, and including, 7.33. This makes it possible for authenticated attackers, with Author-level access or higher, to extract sensitive information including OpenAI API k
for authenticated attackers, with Author-level access or higher, to extract sensitive information including OpenAI API keys configured through the plugin's admin interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25687ee6-a899-4089-966b-69578afd3fb6?source=cve - https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/trunk/controllers/SendPassword.php#L42 - https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/trunk/controllers/SendPassword.php#L72 - https://plugins.trac.wordpress.org/changeset/3390161/wp-ultimate-csv-importer/trunk/controllers/SendPassword.php
CVE ID: CVE-2025-12733 State: PUBLISHED Published: 2025-11-13T03:27:38.629Z Last Updated: 2025-11-13T14:34:18.306Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpallimport Products: Import any XML, CSV or Excel File to WordPress Problem Types: CWE-94 Description: The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to
nctions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to inject and execute arbitrary PHP code on the server via crafted import templates. This can lead to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8475dd90-b47a-42b4-8e4e-44e8512e4fca?source=cve - https://plugins.trac.wordpress.org/browser/wp-all-import/tags/3.9.6/helpers/functions.php#L79 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3393968%40wp-all-import&new=3393968%40wp-all-import&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12735 State: PUBLISHED Published: 2025-11-05T00:22:55.297Z Last Updated: 2025-11-22T23:45:45.512Z Vendors: silentmatt, expr-eval-fork Products: expr-eval, expr-eval-fork Problem Types: CWE-94: Improper Control of Generation of Code (‘Code Injection’), CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) Description: The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trig
an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/silentmatt/expr-eval - https://github.com/jorenbroekema/expr-eval - https://www.npmjs.com/package/expr-eval-fork - https://www.npmjs.com/package/expr-eval - https://github.com/silentmatt/expr-eval/pull/288 - https://github.com/advisories/GHSA-jc85-fpwf-qm7x - https://kb.cert.org/vuls/id/263614
CVE ID: CVE-2025-12739 State: PUBLISHED Published: 2025-11-24T09:11:38.396Z Last Updated: 2025-11-24T13:43:54.837Z Vendors: Google Cloud Products: Looker Problem Types: CWE-79 Description: An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supplied script. Exploitation required at least one Looker extension installed on the instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported v
hese. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.18.201+ * 25.0.79+ * 25.6.66+ * 25.12.7+ * 25.16.0+ * 25.18.0+ * 25.20.0+ Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins#gcp-2025-068
CVE ID: CVE-2025-12740 State: PUBLISHED Published: 2025-11-24T11:30:31.958Z Last Updated: 2025-11-24T13:14:36.770Z Vendors: Google Cloud Products: Looker Problem Types: CWE-20 Description: A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command, due to inadequate filtering of the driver's parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of
hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 25.0.93+ * 25.6.84+ * 25.12.42+ * 25.14.50+ * 25.16.44+ Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins#gcp-2025-052
CVE ID: CVE-2025-12741 State: PUBLISHED Published: 2025-11-24T11:35:33.730Z Last Updated: 2025-11-24T13:13:17.641Z Vendors: Google Cloud Products: Looker Problem Types: CWE-20 Description: A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execute a malicious command. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to pr
vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.108+ * 24.18.200+ * 25.0.78+ * 25.6.65+ * 25.8.47+ * 25.12.10+ * 25.14+ Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins#gcp-2025-052
CVE ID: CVE-2025-12742 State: PUBLISHED Published: 2025-11-25T05:38:47.907Z Last Updated: 2025-11-25T05:38:47.907Z Vendors: Google Cloud Products: Looker Problem Types: CWE-78 Description: A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vu
been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.108+ * 24.18.200+ * 25.0.78+ * 25.6.65+ * 25.8.47+ * 25.12.10+ * 25.14+ References: - https://cloud.google.com/support/bulletins#gcp-2025-052