Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-62055 State: PUBLISHED Published: 2025-11-06T15:55:49.844Z Last Updated: 2025-11-13T10:33:47.059Z Vendors: Elated-Themes Products: Academist Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist academist.This issue affects Academist: from n/a through < 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/academist/vulnerability/wordpress-academist-theme-1-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-62057 State: PUBLISHED Published: 2025-11-06T15:55:50.427Z Last Updated: 2025-11-13T10:33:47.137Z Vendors: favethemes Products: Houzez Theme - Functionality Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/houzez-theme-functionality/vulnerability/wordpress-houzez-theme-functionality-plugin-4-2-0-cross-site-scripting-xss-vulnerability
eme-functionality/vulnerability/wordpress-houzez-theme-functionality-plugin-4-2-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-62058 State: PUBLISHED Published: 2025-10-22T14:32:52.269Z Last Updated: 2025-11-13T10:33:47.037Z Vendors: favethemes Products: Houzez Theme - Functionality Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/houzez-theme-functionality/vulnerability/wordpress-houzez-theme-functionality-plugin-4-2-0-cross-site-scripting-xss-vulnerability
eme-functionality/vulnerability/wordpress-houzez-theme-functionality-plugin-4-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62059 State: PUBLISHED Published: 2025-11-06T15:55:51.134Z Last Updated: 2025-11-13T10:33:47.277Z Vendors: Brainstorm Force Products: SureRank Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank.This issue affects SureRank: from n/a through <= 1.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/surerank/vulnerability/wordpress-surerank-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62060 State: PUBLISHED Published: 2025-10-22T14:32:52.503Z Last Updated: 2025-11-13T10:33:47.108Z Vendors: Themepoints Products: Tab Ultimate Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Tab Ultimate tabs-pro.This issue affects Tab Ultimate: from n/a through <= 1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/tabs-pro/vulnerability/wordpress-tab-ultimate-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62061 State: PUBLISHED Published: 2025-10-22T14:32:52.854Z Last Updated: 2025-11-13T10:33:47.095Z Vendors: impleCode Products: Product Catalog Simple Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in impleCode Product Catalog Simple post-type-x.This issue affects Product Catalog Simple: from n/a through <= 1.8.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/post-type-x/vulnerability/wordpress-product-catalog-simple-plugin-1-8-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-62062 State: PUBLISHED Published: 2025-10-22T14:32:53.065Z Last Updated: 2025-11-13T10:33:47.256Z Vendors: ThemeRuby Products: Easy Post Submission Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Retrieve Embedded Sensitive Data.This issue affects Easy Post Submission: from n/a through <= 1.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/easy-post-submission/vulnerability/wordpress-easy-post-submission-plugin-1-7-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-62063 State: PUBLISHED Published: 2025-10-22T14:32:53.303Z Last Updated: 2025-11-13T10:33:47.244Z Vendors: WP Travel Products: WP Travel Gutenberg Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks.This issue affects WP Travel Gutenberg Blocks: from n/a through <= 3.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-travel-blocks/vulnerability/wordpress-wp-travel-gutenberg-blocks-plugin-3-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62064 State: PUBLISHED Published: 2025-11-06T15:55:51.676Z Last Updated: 2025-11-13T10:33:47.195Z Vendors: Elated-Themes Products: Search & Go Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This issue affects Search & Go: from n/a through <= 2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/search-and-go/vulnerability/wordpress-search-go-theme-2-7-broken-authentication-vulnerability?_s_id=cve
CVE ID: CVE-2025-62065 State: PUBLISHED Published: 2025-11-06T15:55:53.302Z Last Updated: 2025-11-13T10:33:47.077Z Vendors: Rometheme Products: RTMKit Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.6.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/rometheme-for-elementor/vulnerability/wordpress-rtmkit-plugin-1-6-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-62066 State: PUBLISHED Published: 2025-11-06T15:55:54.429Z Last Updated: 2025-11-13T10:33:47.269Z Vendors: fuelthemes Products: Revolution Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes Revolution revolution.This issue affects Revolution: from n/a through < 2.5.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/revolution/vulnerability/wordpress-revolution-theme-2-5-8-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-62067 State: PUBLISHED Published: 2025-11-06T15:55:55.213Z Last Updated: 2025-11-13T10:33:47.147Z Vendors: Elated-Themes Products: Savory Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Savory savory.This issue affects Savory: from n/a through <= 2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/savory/vulnerability/wordpress-savory-theme-2-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-62068 State: PUBLISHED Published: 2025-10-22T14:32:53.513Z Last Updated: 2025-11-13T10:33:47.278Z Vendors: E2Pdf Products: e2pdf Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.28.09. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/e2pdf/vulnerability/wordpress-e2pdf-plugin-1-28-09-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62069 State: PUBLISHED Published: 2025-10-22T14:32:53.749Z Last Updated: 2025-11-13T10:33:47.173Z Vendors: RealMag777 Products: MDTF Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter.This issue affects MDTF: from n/a through <= 1.3.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-plugin-1-3-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62070 State: PUBLISHED Published: 2025-10-22T14:32:53.947Z Last Updated: 2025-11-13T10:33:47.272Z Vendors: WPXPO Products: WowRevenue Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPXPO WowRevenue revenue.This issue affects WowRevenue: from n/a through <= 1.2.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/revenue/vulnerability/wordpress-wowrevenue-plugin-1-2-13-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62071 State: PUBLISHED Published: 2025-10-22T14:32:54.166Z Last Updated: 2025-11-13T10:33:47.119Z Vendors: Repuso Products: Social proof testimonials and reviews by Repuso Problem Types: CWE-862 Description: Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.29. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/social-testimonials-and-reviews-widget/vulnerability/wordpress-social-proof-testimonials-and-reviews-by-repuso-plugin-5-29-broken-
timonials-and-reviews-widget/vulnerability/wordpress-social-proof-testimonials-and-reviews-by-repuso-plugin-5-29-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62072 State: PUBLISHED Published: 2025-10-22T14:32:54.422Z Last Updated: 2025-11-13T10:33:47.176Z Vendors: Rustaurius Products: Front End Users Problem Types: CWE-862 Description: Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through <= 3.2.33. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/front-end-only-users/vulnerability/wordpress-front-end-users-plugin-3-2-33-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62073 State: PUBLISHED Published: 2025-10-22T14:32:54.713Z Last Updated: 2025-11-13T10:33:47.197Z Vendors: Sovlix Products: MeetingHub Problem Types: CWE-862 Description: Missing Authorization vulnerability in Sovlix MeetingHub meetinghub.This issue affects MeetingHub: from n/a through <= 1.23.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/meetinghub/vulnerability/wordpress-meetinghub-plugin-1-23-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62074 State: PUBLISHED Published: 2025-11-06T15:55:56.024Z Last Updated: 2025-11-13T10:33:47.106Z Vendors: Amauri Products: WPMobile.App Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.71. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wpappninja/vulnerability/wordpress-wpmobile-app-plugin-11-71-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62075 State: PUBLISHED Published: 2025-11-06T15:55:57.636Z Last Updated: 2025-11-13T10:33:47.340Z Vendors: Ido Kobelkowsky Products: Simple Payment Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue affects Simple Payment: from n/a through <= 2.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/simple-payment/vulnerability/wordpress-simple-payment-plugin-2-4-6-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-62076 State: PUBLISHED Published: 2025-11-06T15:55:59.012Z Last Updated: 2025-11-13T10:33:47.364Z Vendors: Ido Kobelkowsky Products: Simple Payment Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue affects Simple Payment: from n/a through <= 2.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/simple-payment/vulnerability/wordpress-simple-payment-plugin-2-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62155 State: PUBLISHED Published: 2025-11-24T23:56:52.293Z Last Updated: 2025-11-24T23:56:52.293Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: QuantumNous Products: new-api Problem Types: CWE-918 Description: New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.9.6, a recently patched SSRF vulnerability contains a bypass method that can bypass the existing security fix and still allow SSRF to occur. Because the existing fix only applies security restrictions to the first URL request, a 302 redirect can bypass existing security measures and successfully access the intrane
tions to the first URL request, a 302 redirect can bypass existing security measures and successfully access the intranet. This issue has been patched in version 0.9.6. References: - https://github.com/QuantumNous/new-api/security/advisories/GHSA-9f46-w24h-69w4
CVE ID: CVE-2025-62156 State: PUBLISHED Published: 2025-10-14T14:52:44.502Z Last Updated: 2025-10-14T16:04:24.519Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: argoproj Products: argo-workflows Problem Types: CWE-22 Description: Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic (workflow/executor/executor.go) uses filepath.Join(dest, filepath.Clean(header.Name)) without validating that header.Name stays within the inte
utor.go) uses filepath.Join(dest, filepath.Clean(header.Name)) without validating that header.Name stays within the intended extraction directory. A malicious archive entry can supply a traversal or absolute path that, after cleaning, overrides the destination directory and causes files to be written outside the /work/tmp extraction path and into system directories such as /etc inside the container. The vulnerability enables arbitrary file creation or overwrite in system configuration locations (for example /etc/passwd, /etc/hosts, /etc/crontab), which can lead to privilege escalation or persistence within the affected container. Update to 3.6.12 or 3.7.3 to remediate the issue. Additional A
escalation or persistence within the affected container. Update to 3.6.12 or 3.7.3 to remediate the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-workflows/security/advisories/GHSA-p84v-gxvw-73pf - https://github.com/argoproj/argo-workflows/commit/5659ad9b641fcf52c04ed594cd6493f9170f6011 - https://github.com/argoproj/argo-workflows/commit/9f6bc5d236cd1b24d607943384511d71ad17a4c3 - https://github.com/argoproj/argo-workflows/blob/946a2d6b9ac3309371fe47f49ae94c33ca7d488d/workflow/executor/executor.go#L993
CVE ID: CVE-2025-62157 State: PUBLISHED Published: 2025-10-14T15:06:39.829Z Last Updated: 2025-10-14T16:06:02.367Z Vendors: argoproj Products: argo-workflows Problem Types: CWE-522 Description: Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissions to read pod logs in a namespace running Argo Workflows can read the workflow-controller logs and obtain credentials to the artifact repository. Update to versions 3.6.12 or 3.7.3 to remediate the vulnerabil
r logs and obtain credentials to the artifact repository. Update to versions 3.6.12 or 3.7.3 to remediate the vulnerability. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-workflows/security/advisories/GHSA-c2hv-4pfj-mm2r - https://github.com/argoproj/argo-workflows/commit/18ad5138b6bcb2aba04e00b4ec657bc6b8fad8df - https://github.com/argoproj/argo-workflows/commit/bded09fe4abd37cb98d7fc81b4c14a6f5034e9ab
CVE ID: CVE-2025-62158 State: PUBLISHED Published: 2025-10-10T20:05:38.107Z Last Updated: 2025-10-10T20:44:13.136Z Vendors: frappe Products: lms Problem Types: CWE-200 Description: Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the file URL could access these files without authentication. The issue has been fixed in version 2.38.0 by ensuring all student-uploaded assignment attachments are stored as private files by default. Additional Analyst Notes: -
nsuring all student-uploaded assignment attachments are stored as private files by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/lms/security/advisories/GHSA-h6fh-7f24-f2j5 - https://github.com/frappe/lms/commit/78640561f558a6c7396f8be48874f79a54f03420
CVE ID: CVE-2025-62159 State: PUBLISHED Published: 2025-10-10T22:23:19.071Z Last Updated: 2025-10-14T15:01:12.569Z Vendors: external-secrets Products: external-secrets Problem Types: CWE-284 Description: External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. A vulnerability was discovered in the BeyondTrust provider implementation for External Secrets Operator versions 0.10.1 through 0.19.2. The provider previously retrieved Kubernetes secrets directly, without validating the namespace context or the type of secret store. This allowed unauthorized cross-namespace secret access, violating security boundaries and poten
e type of secret store. This allowed unauthorized cross-namespace secret access, violating security boundaries and potentially exposing sensitive credentials. In version 0.20.0, the provider code was updated to use the `resolvers.SecretKeyRef` utility, which enforces namespace validation and only allows cross-namespace access for `ClusterSecretStore` types. This ensures secrets are only retrieved from the correct namespace, mitigating the risk of unauthorized access. All users should upgrade to the latest version containing this fix. As a workaround, use a policy engine such as Kyverno or OPA to prevent using BeyondTrust provider and/or validate the `(Cluster)SecretStore` and ensure the name
h as Kyverno or OPA to prevent using BeyondTrust provider and/or validate the `(Cluster)SecretStore` and ensure the namespace may only be set when using a `ClusterSecretStore`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/external-secrets/external-secrets/security/advisories/GHSA-vf79-2pjx-phpp
CVE ID: CVE-2025-62161 State: PUBLISHED Published: 2025-11-05T23:09:09.014Z Last Updated: 2025-11-06T21:20:19.865Z Vendors: youki-dev Products: youki Problem Types: CWE-363, CWE-61 Description: Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixed in version 0.5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8 - https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8 - https://
y/advisories/GHSA-4g74-7cff-xcv8 - https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8 - https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a
CVE ID: CVE-2025-62162 State: PUBLISHED Published: 2025-10-10T22:25:42.027Z Last Updated: 2025-10-14T14:16:20.443Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: cel-rust Products: cel-rust Problem Types: CWE-20 Description: cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS). Version 0.11.4 fixes the issue. Additional Anal
an attacker can send crafted input to trigger a denial of service (DoS). Version 0.11.4 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw - https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4
CVE ID: CVE-2025-62164 State: PUBLISHED Published: 2025-11-21T01:18:38.803Z Last Updated: 2025-11-24T18:12:44.195Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: vllm-project Products: vllm Problem Types: CWE-20, CWE-123, CWE-502, CWE-787 Description: vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead to a crash (denial-of-service) and potentially remote code execution (RCE), exists in the Completions API endpoint. When processing user-supplied prompt embeddings, the endpoint loads serialized tensors using torch.load() without sufficient validation. Due
supplied prompt embeddings, the endpoint loads serialized tensors using torch.load() without sufficient validation. Due to a change introduced in PyTorch 2.8.0, sparse tensor integrity checks are disabled by default. As a result, maliciously crafted tensors can bypass internal bounds checks and trigger an out-of-bounds memory write during the call to to_dense(). This memory corruption can crash vLLM and potentially lead to code execution on the server hosting vLLM. This issue has been patched in version 0.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vllm-project/vllm/security/advisories/GHSA-mrw7-hf4f-83pf - https://github.com/vllm-project/vllm/pu
- https://github.com/vllm-project/vllm/security/advisories/GHSA-mrw7-hf4f-83pf - https://github.com/vllm-project/vllm/pull/27204 - https://github.com/vllm-project/vllm/commit/58fab50d82838d5014f4a14d991fdb9352c9c84b