Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-55248 State: PUBLISHED Published: 2025-10-14T17:00:59.059Z Last Updated: 2025-11-22T04:09:05.533Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: .NET 8.0, .NET 9.0, Microsoft Visual Studio 2022 version 17.12, Microsoft Visual Studio 2022 version 17.10, Microsoft Visual Studio 2022 version 17.14, Microsoft .NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.6.2, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2,
icrosoft .NET Framework 4.6.2, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1 Problem Types: CWE-326 Description: Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55248
CVE ID: CVE-2025-55278 State: PUBLISHED Published: 2025-11-05T22:44:17.256Z Last Updated: 2025-11-06T21:20:55.355Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: HCL Software Products: DevOps Loop Problem Types: CWE-613, CWE-347 Description: Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or tampered tokens to gain unauthorized access to sensitive resources and perform actions with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
ensitive resources and perform actions with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124203
CVE ID: CVE-2025-55279 State: PUBLISHED Published: 2025-08-13T11:23:53.500Z Last Updated: 2025-08-13T13:01:28.876Z Vendors: ZKTeco Co Products: WL20 Biometric Attendance System Problem Types: CWE-798 Description: This vulnerability exists in ZKTeco WL20 due to hard-coded private key stored in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the binary data to retrieve private key stored in the firmware of the targeted device. Successful exploitation of this vulnerability could allow the attacker to perform unauthorized decryption of sensitive data and Man-in-the-Middle (MitM) attacks on the target
low the attacker to perform unauthorized decryption of sensitive data and Man-in-the-Middle (MitM) attacks on the targeted device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0172
CVE ID: CVE-2025-55280 State: PUBLISHED Published: 2025-08-13T11:38:35.843Z Last Updated: 2025-08-13T12:59:31.423Z Vendors: ZKTeco Co Products: WL20 Biometric Attendance System Problem Types: CWE-312 Description: This vulnerability exists in ZKTeco WL20 due to storage of Wi-Fi credentials, configuration data and system data in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the plaintext sensitive data stored in the targeted device. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized network access, retrieve and manipulate d
ploitation of this vulnerability could allow the attacker to gain unauthorized network access, retrieve and manipulate data on the targeted device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0172
CVE ID: CVE-2025-55282 State: PUBLISHED Published: 2025-08-18T16:44:02.944Z Last Updated: 2025-08-18T19:49:56.981Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: aiven Products: aiven-db-migrate Problem Types: CWE-22 Description: aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows a user to elevate to superuser inside PostgreSQL databases during a migration from an untrusted source server. By exploiting a lack of search_path restriction, an attacker can override pg_catalog and execute untrusted operators as a superuser. This vulnerability is fixed in 1.0.7. Additional Analyst Note
pg_catalog and execute untrusted operators as a superuser. This vulnerability is fixed in 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aiven/aiven-db-migrate/security/advisories/GHSA-hmvf-93r4-36f9 - https://github.com/aiven/aiven-db-migrate/commit/39517dc55720055d93262033b142a365f5bf92c5
CVE ID: CVE-2025-55283 State: PUBLISHED Published: 2025-08-18T16:46:58.839Z Last Updated: 2025-08-18T19:50:54.911Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: aiven Products: aiven-db-migrate Problem Types: CWE-77 Description: aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows elevation to superuser inside PostgreSQL databases during a migration from an untrusted source server. The vulnerability stems from psql executing commands embedded in a dump from the source server. This vulnerability is fixed in 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
ource server. This vulnerability is fixed in 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aiven/aiven-db-migrate/security/advisories/GHSA-wqhc-grmj-fjvg - https://github.com/aiven/aiven-db-migrate/commit/36f6c7f7d06216975f625da0a1cb514253c4b3df
CVE ID: CVE-2025-55284 State: PUBLISHED Published: 2025-08-16T01:27:29.134Z Last Updated: 2025-08-18T14:00:40.976Z Vendors: anthropics Products: claude-code Problem Types: CWE-78 Description: Claude Code is an agentic coding tool. Prior to version 1.0.4, it's possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation due to an overly broad allowlist of safe commands. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update received this fix automatically after release. Current users of Claude Code are unaffected, as vers
ude Code auto-update received this fix automatically after release. Current users of Claude Code are unaffected, as versions prior to 1.0.24 are deprecated and have been forced to update. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/anthropics/claude-code/security/advisories/GHSA-x5gv-jw7f-j6xj
CVE ID: CVE-2025-55285 State: PUBLISHED Published: 2025-08-15T17:10:26.735Z Last Updated: 2025-08-15T17:49:24.677Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N) Vendors: backstage Products: backstage Problem Types: CWE-532 Description: @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If ${{ secrets.x }} is not passed through to fetch:template there is no impact. This issue has been resolved in 2.1.1 of the scaffolder-backend plugin. A workaround for this
plate there is no impact. This issue has been resolved in 2.1.1 of the scaffolder-backend plugin. A workaround for this issue involves Template Authors removing the use of ${{ secrets }} being used as an argument to fetch:template. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/backstage/backstage/security/advisories/GHSA-3x3q-ghcp-whf7 - https://github.com/backstage/backstage/commit/c371f6fe12371de31dca537510e6653e287cdc2e
CVE ID: CVE-2025-55286 State: PUBLISHED Published: 2025-08-16T01:02:44.627Z Last Updated: 2025-08-18T14:01:27.387Z Vendors: vancluever Products: z2d Problem Types: CWE-119, CWE-122 Description: z2d is a pure Zig 2D graphics library. z2d v0.7.0 released with a new multi-sample anti-aliasing (MSAA) method, which uses a new buffering mechanism for storing coverage data. This differs from the standard alpha mask surface used for the previous super-sample anti-aliasing (SSAA) method. Under certain circumstances where the path being drawn existed in whole or partly outside of the rendering surface, incorrect bounding could cause out-of-bounds access within the coverage buffer. This affects the hig
rendering surface, incorrect bounding could cause out-of-bounds access within the coverage buffer. This affects the higher-level drawing operations, such as Context.fill, Context.stroke, painter.fill, and painter.stroke, when either the .default or .multisample_4x anti-aliasing modes were used. .supersample_4x was not affected, nor was drawing without anti-aliasing. In non-safe optimization modes (consumers compiling with ReleaseFast or ReleaseSmall), this could potentially lead to invalid memory accesses or corruption. z2d v0.7.1 fixes this issue, and it's recommended to upgrade to v0.7.1, or, given the small period of time v0.7.0 has been released, use v0.7.1 immediately, skipping v0.7.0.
upgrade to v0.7.1, or, given the small period of time v0.7.0 has been released, use v0.7.1 immediately, skipping v0.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vancluever/z2d/security/advisories/GHSA-2vq8-cp8r-vcf3 - https://github.com/vancluever/z2d/pull/137 - https://github.com/vancluever/z2d/commit/93e45d36af53cda0d7f454ed8440713b7ac155b6
CVE ID: CVE-2025-55287 State: PUBLISHED Published: 2025-08-18T16:54:17.706Z Last Updated: 2025-08-18T19:54:08.186Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: MGeurts Products: genealogy Problem Types: CWE-79 Description: Genealogy is a family tree PHP application. Prior to 4.4.0, Authenticated Stored Cross-Site Scripting (XSS) vulnerability was identified in the Genealogy application. Authenticated attackers could run arbitrary JavaScript in another user’s session, leading to session hijacking, data theft, and UI manipulation. This vulnerability is fixed in 4.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MGeurts/ge
bility is fixed in 4.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MGeurts/genealogy/security/advisories/GHSA-j457-9m86-6q5r - https://github.com/MGeurts/genealogy/commit/1683b3cbea5e52c99291fa231b7bc8c33f33c33f
CVE ID: CVE-2025-55288 State: PUBLISHED Published: 2025-08-18T16:57:22.950Z Last Updated: 2025-08-18T19:55:42.028Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: MGeurts Products: genealogy Problem Types: CWE-79 Description: Genealogy is a family tree PHP application. Prior to 4.4.0, Authenticated Reflected Cross-Site Scripting (XSS) vulnerability was identified in the Genealogy application. Authenticated attackers could run arbitrary JavaScript in another user’s session, leading to session hijacking, data theft, and UI manipulation. This vulnerability is fixed in 4.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MGe
vulnerability is fixed in 4.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MGeurts/genealogy/security/advisories/GHSA-3h8x-g9xj-rhwg - https://github.com/MGeurts/genealogy/commit/1683b3cbea5e52c99291fa231b7bc8c33f33c33f
CVE ID: CVE-2025-55291 State: PUBLISHED Published: 2025-08-18T17:06:35.799Z Last Updated: 2025-08-18T19:56:41.600Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: shaarli Products: Shaarli Problem Types: CWE-80, CWE-87, CWE-79 Description: Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allows the </title> tag to be prematurely closed, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability is fixed in 0.15.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shaarli/Shaarli/security/advisories
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shaarli/Shaarli/security/advisories/GHSA-7w7w-pw4j-265h - https://github.com/shaarli/Shaarli/commit/66faa61335a6e72184be64092ff1242ffa4fe5b6
CVE ID: CVE-2025-55293 State: PUBLISHED Published: 2025-08-18T17:24:35.254Z Last Updated: 2025-08-18T17:41:25.082Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: meshtastic Products: firmware Problem Types: CWE-287 Description: Meshtastic is an open source mesh networking solution. Prior to v2.6.3, an attacker can send NodeInfo with a empty publicKey first, then overwrite it with a new key. First sending a empty key bypasses 'if (p.public_key.size > 0) {', clearing the existing publicKey (and resetting the size to 0) for a known node. Then a new key bypasses 'if (info->user.public_key.size > 0) {', and this malicious key is stored in NodeDB. This vulnerab
en a new key bypasses 'if (info->user.public_key.size > 0) {', and this malicious key is stored in NodeDB. This vulnerability is fixed in 2.6.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/meshtastic/firmware/security/advisories/GHSA-95pq-gj5v-4fg2 - https://github.com/meshtastic/firmware/pull/6372 - https://github.com/meshtastic/firmware/commit/cf7f0f9d0895602df3453a4f5cfea843f4e09744
CVE ID: CVE-2025-55294 State: PUBLISHED Published: 2025-08-19T17:34:54.656Z Last Updated: 2025-08-19T20:03:52.409Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: bencevans Products: screenshot-desktop Problem Types: CWE-77 Description: screenshot-desktop allows capturing a screenshot of your local machine. This vulnerability is a command injection issue. When user-controlled input is passed into the format option of the screenshot function, it is interpolated into a shell command without sanitization. This results in arbitrary command execution with the privileges of the calling process. This vulnerability is fixed in 1.15.2. Additional Analyst Notes: - C
ecution with the privileges of the calling process. This vulnerability is fixed in 1.15.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bencevans/screenshot-desktop/security/advisories/GHSA-gjx4-2c7g-fm94 - https://github.com/bencevans/screenshot-desktop/commit/59c87b0c175eec76090e6ccde313f4fc5d569b78
CVE ID: CVE-2025-55295 State: PUBLISHED Published: 2025-08-19T17:46:58.075Z Last Updated: 2025-08-19T20:04:29.341Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: StuffAnThings Products: qbit_manage Problem Types: CWE-22 Description: qBit Manage is a tool that helps manage tedious tasks in qBittorrent and automate them. A path traversal vulnerability exists in qbit_manage's web API that allows authenticated users to read arbitrary files from the server filesystem through the restore_config_from_backup endpoint. The vulnerability allows attackers to bypass directory restrictions and read arbitrary files from the server filesystem by manipulating the backup_id
ckers to bypass directory restrictions and read arbitrary files from the server filesystem by manipulating the backup_id parameter with path traversal sequences (e.g., ../). This vulnerability is fixed in 4.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StuffAnThings/qbit_manage/security/advisories/GHSA-vh56-26wq-vvfv - https://github.com/StuffAnThings/qbit_manage/releases/tag/v4.5.4
CVE ID: CVE-2025-55296 State: PUBLISHED Published: 2025-08-18T17:27:52.662Z Last Updated: 2025-08-18T17:38:16.117Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.6.0) in the Alert Template creation feature. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the template is rendered, potentially compromising other admin accounts. This vulnerability is fixed in 25.8.0. Additional Analyst Notes: - CISA ADP V
ntially compromising other admin accounts. This vulnerability is fixed in 25.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-vxq6-8cwm-wj99 - https://github.com/librenms/librenms/commit/8ade3d827d317f5ac4b336617aafff865f825958
CVE ID: CVE-2025-55297 State: PUBLISHED Published: 2025-08-21T15:05:06.805Z Last Updated: 2025-08-22T11:32:48.470Z Vendors: espressif Products: esp-idf Problem Types: CWE-120, CWE-131 Description: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. The BluFi example bundled in ESP-IDF was vulnerable to memory overflows in two areas: Wi-Fi credential handling and Diffie–Hellman key exchange. This vulnerability is fixed in 5.4.1, 5.3.3, 5.1.6, and 5.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espressif/esp-idf/security/advisories/GHSA-9w88-r2vm-qfc4 - https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364b
security/advisories/GHSA-9w88-r2vm-qfc4 - https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364bf7e345 - https://github.com/espressif/esp-idf/commit/3fc6c93936077cb1659e1f0e0268e62cf6423e9d - https://github.com/espressif/esp-idf/commit/5f93ec3b11b6115475c34de57093b3672d594e8f - https://github.com/espressif/esp-idf/commit/9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa - https://github.com/espressif/esp-idf/commit/abc18e93eb3500dbec74c3e589671ef82c8b3919 - https://github.com/espressif/esp-idf/commit/b1657d9dd4d0e48ed25e02cb8fe8413f479a2a84 - https://github.com/espressif/esp-idf/commit/bf50c0c197af30990026c8f8286298d2aa5a3c99 - https://github.com/espressif/esp-idf/commit/cb692
om/espressif/esp-idf/commit/bf50c0c197af30990026c8f8286298d2aa5a3c99 - https://github.com/espressif/esp-idf/commit/cb6929a2e6f2ff130b742332dc15eb23006c7cc9 - https://github.com/espressif/esp-idf/commit/cc00e9f2fc4f7e8fbaff27851b4a8b45fa483501 - https://github.com/espressif/esp-idf/commit/e65cf7ea2a2be52219ec9d4efc44aed5e490e91c - https://github.com/espressif/esp-idf/commit/f40aa9c587a8e570dfde2e6330382dcd170d5a5d - https://github.com/espressif/esp-idf/commit/f77da0d5b5382635c99e6708551b73802ad1213d
CVE ID: CVE-2025-55298 State: PUBLISHED Published: 2025-08-26T17:20:17.112Z Last Updated: 2025-11-03T18:13:41.989Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ImageMagick Products: ImageMagick Problem Types: CWE-123, CWE-134 Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote c
ion. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645 - https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5 - https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1
CVE ID: CVE-2025-55299 State: PUBLISHED Published: 2025-08-18T17:36:28.462Z Last Updated: 2025-08-18T17:54:17.654Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: 7ritn Products: VaulTLS Problem Types: CWE-521 Description: VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that fact, that previously disabling the password based login only effected the frontend, but still allowed login via the API. This vulnerability is fixed in 0.9.1. Additional Analyst No
effected the frontend, but still allowed login via the API. This vulnerability is fixed in 0.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/7ritn/VaulTLS/security/advisories/GHSA-pjfr-pj3h-cw8m - https://github.com/7ritn/VaulTLS/commit/6ac0a43a768f1753f6889ba43f914e773a4b45c0
CVE ID: CVE-2025-55300 State: PUBLISHED Published: 2025-08-18T17:41:37.372Z Last Updated: 2025-08-18T17:52:19.481Z Vendors: komari-monitor Products: komari Problem Types: CWE-79 Description: Komari is a lightweight, self-hosted server monitoring tool designed to provide a simple and efficient solution for monitoring server performance. Prior to 1.0.4-fix1, WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks against authenticated users. Any third party website can send requests to the terminal websocket endpoint with browser's cookies, resulting in remote code execution. This vulnerability is fixed in 1.0.4-fix1. Additional Analyst Notes: -
er's cookies, resulting in remote code execution. This vulnerability is fixed in 1.0.4-fix1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/komari-monitor/komari/security/advisories/GHSA-q355-h244-969h - https://github.com/komari-monitor/komari/commit/d31d12e59febce100ab0285b93338f09aa5d6cb1
CVE ID: CVE-2025-55301 State: PUBLISHED Published: 2025-08-25T15:38:34.391Z Last Updated: 2025-08-25T16:03:22.618Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: The-Scratch-Channel Products: the-scratch-channel.github.io Problem Types: CWE-20 Description: The Scratch Channel is a news website. In version 1, it is possible to go to application in devtools and click local storage to edit the account's username locally. This issue has been patched in version 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/The-Scratch-Channel/tsc-web-client/security/advisories/GHSA-9q4f-4vjm-7gp2 - https://github.com/The-Scratch-Channel
.com/The-Scratch-Channel/tsc-web-client/security/advisories/GHSA-9q4f-4vjm-7gp2 - https://github.com/The-Scratch-Channel/tsc-web-client/discussions/77 - https://github.com/The-Scratch-Channel/tsc-web-client/releases/tag/v1.1
CVE ID: CVE-2025-55303 State: PUBLISHED Published: 2025-08-19T18:08:00.244Z Last Updated: 2025-08-19T20:50:34.071Z Vendors: withastro Products: astro Problem Types: CWE-79, CWE-115 Description: Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include an /_image endpoint which returns optimized versions of images. A bug in impacted versions of astro allows an attacker to bypass the third-party domain restrictions by using a protocol-relative URL as the image