Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48051 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-15T19:10:00.247Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Lichess Products: Lila Problem Types: CWE-79 Description: powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as HTML. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lichess-org/lila/security/advisories/GHSA-9xhx-p3c5-p4v6 - https://github.com/lichess-org/lila/commit/ab0beaf0ad671761705d9274663c5dc450608527 - https://github.com/lichess-or
v6 - https://github.com/lichess-org/lila/commit/ab0beaf0ad671761705d9274663c5dc450608527 - https://github.com/lichess-org/lila/blob/7b82f35d15f9113ac8a0a9271d34bef4f6119e9f/ui/site/src/powertip.ts#L60
CVE ID: CVE-2025-48053 State: PUBLISHED Published: 2025-06-09T12:30:33.626Z Last Updated: 2025-06-09T13:01:18.409Z Vendors: discourse Products: discourse Problem Types: CWE-400, CWE-770 Description: Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, sending a malicious URL in a PM to a bot user can cause a reduced the availability of a Discourse instance. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. No known workarounds are available
beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-3q5q-qmrm-rvwx
CVE ID: CVE-2025-48054 State: PUBLISHED Published: 2025-05-27T04:04:13.029Z Last Updated: 2025-05-27T20:01:01.623Z Vendors: radashi-org Products: radashi Problem Types: CWE-1321 Description: Radashi is a TypeScript utility toolkit. Prior to version 12.5.1, the set function within the Radashi library is vulnerable to prototype pollution. If an attacker can control parts of the path argument to the set function, they could potentially modify the prototype of all objects in the JavaScript runtime, leading to unexpected behavior, denial of service, or even remote code execution in some specific scenarios. This issue has been patched in version 12.5.1. A workaround for this issue involves sanitiz
in some specific scenarios. This issue has been patched in version 12.5.1. A workaround for this issue involves sanitizing the path argument provided to the set function to ensure that no part of the path string is __proto__, prototype, or constructor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/radashi-org/radashi/security/advisories/GHSA-2xv9-ghh9-xc69 - https://github.com/radashi-org/radashi/commit/8147abc8cfc3cfe9b9a17cd389076a5d97235a66
CVE ID: CVE-2025-48055 State: PUBLISHED Published: 2025-11-10T20:33:48.310Z Last Updated: 2025-11-10T20:45:35.253Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-684h-f39j-5gq8
CVE ID: CVE-2025-48056 State: PUBLISHED Published: 2025-05-20T19:55:58.193Z Last Updated: 2025-05-20T20:15:17.170Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: cilium Products: hubble Problem Types: CWE-74 Description: Hubble is a fully distributed networking and security observability platform for cloud native workloads. Prior to version 1.17.2, a network attacker could inject malicious control characters into Hubble CLI terminal output, potentially leading to loss of integrity and manipulation of the output. This could be leveraged to conceal log entries, rewrite output, or even make the terminal temporarily unusable. Exploitation of this attack would r
conceal log entries, rewrite output, or even make the terminal temporarily unusable. Exploitation of this attack would require the victim to be monitoring Kafka traffic using Layer 7 Protocol Visibility at the time of the attack. The issue is patched in Hubble CLI v1.17.2. Hubble CLI users who are unable to upgrade can direct their Hubble flows to a log file and inspect the output within a text editor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cilium/hubble/security/advisories/GHSA-274q-79q9-52j7 - https://github.com/cilium/cilium/pull/37401
CVE ID: CVE-2025-48057 State: PUBLISHED Published: 2025-05-27T16:32:29.931Z Last Updated: 2025-05-27T18:27:57.002Z Vendors: Icinga Products: icinga2 Problem Types: CWE-296 Description: Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into incorrectly treating certificates as valid. This allows an attacker to send a malicious certificate request that is then treated as a renewal of an already existing certificate, resulting in the attacker obtaining a valid certificate that can be used to imp
ewal of an already existing certificate, resulting in the attacker obtaining a valid certificate that can be used to impersonate trusted nodes. This only occurs when Icinga 2 is built with OpenSSL older than version 1.1.0. This issue has been patched in versions 2.12.12, 2.13.12, and 2.14.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Icinga/icinga2/security/advisories/GHSA-7vcf-f5v9-3wr6 - https://github.com/Icinga/icinga2/commit/34c93a2542bbe4e9886d15bc17ec929ead1aa152 - https://github.com/Icinga/icinga2/commit/4023128be42b18a011dda71ddee9ca79955b89cb - https://github.com/Icinga/icinga2/commit/60f75f4a3d5cbb234eb3694ba7e9076a1a5b8776 - https://github
71ddee9ca79955b89cb - https://github.com/Icinga/icinga2/commit/60f75f4a3d5cbb234eb3694ba7e9076a1a5b8776 - https://github.com/Icinga/icinga2/commit/9ad5683aab9eb392c6737ff46c830a945c9e240f - https://github.com/Icinga/icinga2/commit/9b2c05d0cc09210bdeade77cf9a73859250fc48d
CVE ID: CVE-2025-48058 State: PUBLISHED Published: 2025-06-20T00:39:06.725Z Last Updated: 2025-06-20T13:28:27.265Z Vendors: powsybl Products: powsybl-core Problem Types: CWE-1333 Description: PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, there is a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the PowSyBl's DataSource mechanism. If successfully exploited, a malicious actor can cause significant CPU consumption due to regex backtracking — even with polynomial patterns. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
ssue has been patched in com.powsybl:powsybl-commons: 6.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/powsybl/powsybl-core/security/advisories/GHSA-rqpx-f6rc-7hm5 - https://github.com/powsybl/powsybl-core/commit/72f79dec6d4292f892fbddd68a19c67935c7d81f - https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2
CVE ID: CVE-2025-48059 State: PUBLISHED Published: 2025-06-20T16:50:35.974Z Last Updated: 2025-06-20T17:37:30.252Z Vendors: powsybl Products: powsybl-core Problem Types: CWE-1333 Description: PowSyBl (Power System Blocks) is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criteria versions 6.3.0 to before 6.7.2 and com.powsybl:powsybl-contingency-api versions 5.0.0 to before 6.3.0, there is a a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the RegexCriterion class. This class compiles and evaluates an unvalidated, user-supplied regular expression against the identifier of an Identifiable object via Pattern.compile(regex).m
alidated, user-supplied regular expression against the identifier of an Identifiable object via Pattern.compile(regex).matcher(id).find(). If successfully exploited, a malicious actor can cause significant CPU exhaustion through repeated or recursive filter(...) calls — especially if performed over large network models or filtering operations. This issue has been patched in com.powsybl:powsybl-iidm-criteria 6.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/powsybl/powsybl-core/security/advisories/GHSA-8qjw-9xgm-c9ff - https://github.com/powsybl/powsybl-core/commit/d8398f689a5ccd505bd62eee2bd6670a29133110 - https://github.com/powsybl/powsybl-core/relea
com/powsybl/powsybl-core/commit/d8398f689a5ccd505bd62eee2bd6670a29133110 - https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2
CVE ID: CVE-2025-48060 State: PUBLISHED Published: 2025-05-21T17:32:43.602Z Last Updated: 2025-11-03T18:12:58.490Z Vendors: jqlang Products: jq Problem Types: CWE-121 Description: jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jqlang/jq/security/advisories/GHSA-p7rr-28xf-3m5w
CVE ID: CVE-2025-48061 State: PUBLISHED Published: 2025-05-22T17:04:42.918Z Last Updated: 2025-05-22T17:32:16.333Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: wireapp Products: wire-webapp Problem Types: CWE-613 Description: wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does not happen when the user is logged in as a temporary user by selecting "This is a public computer" during login or the user selects "Delete al
er is logged in as a temporary user by selecting "This is a public computer" during login or the user selects "Delete all your personal information and conversations on this device" upon logout. The underlying issue has been fixed with wire-webapp version 2025-05-20-production.0. As a workaround, this behavior can be prevented by either deleting all information upon logout as well as logging in as a temporary client. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wireapp/wire-webapp/security/advisories/GHSA-7r6m-qjwm-w44q
CVE ID: CVE-2025-48062 State: PUBLISHED Published: 2025-06-09T12:33:57.870Z Last Updated: 2025-06-09T13:00:15.272Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: discourse Products: discourse Problem Types: CWE-116, CWE-79 Description: Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML. This includes inviting someone (without an account) to a PM and inviting someone (without an account) to a topic with a custom m
ludes inviting someone (without an account) to a PM and inviting someone (without an account) to a topic with a custom message. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. This can be worked around if the relevant templates are overridden without `{topic_title}`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-x8mp-chx3-6x2p
CVE ID: CVE-2025-48063 State: PUBLISHED Published: 2025-05-21T17:38:37.096Z Last Updated: 2025-05-21T18:28:01.657Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-285 Description: XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security model of required rights is that a user who doesn't have a right also cannot define that right as required right. That way, users who are editing documents on which required rights are enforced can be sure that they're not giving a right to a script or object that it didn't have before. A bug in the implementation of the enforcement of this rule mean
right to a script or object that it didn't have before. A bug in the implementation of the enforcement of this rule means that in fact, it was possible for any user with edit right on a document to set programming right as required right. If then a user with programming right edited that document, the content of that document would gain programming right, allowing remote code execution. This thereby defeats most of the security benefits of required rights. As XWiki still performs the required rights analysis when a user edits a page even when required rights are enforced, the user with programming right would still be warned about the dangerous content unless the attacker managed to bypass t
he user with programming right would still be warned about the dangerous content unless the attacker managed to bypass this check. Note also that none of the affected versions include a UI for enabling the enforcing of required rights so it seems unlikely that anybody relied on them for security in the affected versions. As this vulnerability provides no additional attack surface unless all documents in the wiki enforce required rights, we consider the impact of this attack to be low even though gaining programming right could have a high impact. This vulnerability has been patched in XWiki 16.10.4 and 17.1.0RC1. No known workarounds are available except for upgrading. Additional Analyst Not
patched in XWiki 16.10.4 and 17.1.0RC1. No known workarounds are available except for upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rhfv-688c-p6hp - https://github.com/xwiki/xwiki-platform/commit/2557813aef3b863988d6cca58de996e207086898 - https://jira.xwiki.org/browse/XWIKI-22859
CVE ID: CVE-2025-48064 State: PUBLISHED Published: 2025-05-21T17:40:57.527Z Last Updated: 2025-05-21T18:18:16.893Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: desktop Products: desktop Problem Types: CWE-200 Description: GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view a file in a commit of their making in the history view can cause information disclosure by means of Git attempting to access a network share. This affects GitHub Desktop users on Windows that view malicious commits in the history view. macOS users are not affected. When viewing a file
ktop users on Windows that view malicious commits in the history view. macOS users are not affected. When viewing a file diff in the history view GitHub Desktop will call `git log` or `git diff` with the object id (SHA) of the commit, the name of the file, and the old name of the file if the file has been renamed. As a security precaution Git will attempt to fully resolve the old and new path via `realpath`, traversing symlinks, to ensure that the resolved paths reside within the repository working directory. This can lead to Git attempting to access a path that resides on a network share (UNC path) and in doing so Windows will attempt to perform NTLM authentication which passes information
a network share (UNC path) and in doing so Windows will attempt to perform NTLM authentication which passes information such as the computer name, the currently signed in (Windows) user name, and an NTLM hash. GitHub Desktop 3.4.20 and later fix this vulnerability. The beta channel includes the fix in 3.4.20-beta3. As a workaround to use until upgrading is possible, only browse commits in the history view that comes from trusted sources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/desktop/desktop/security/advisories/GHSA-f234-7hj3-vr8j
CVE ID: CVE-2025-48065 State: PUBLISHED Published: 2025-11-10T20:35:34.054Z Last Updated: 2025-11-10T20:58:59.754Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error contains malicious content. Versions 2.7.13 and 3.2.2 protect rendered HTML content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-292c-hgcf-2g22
CVE ID: CVE-2025-48066 State: PUBLISHED Published: 2025-05-22T17:20:26.910Z Last Updated: 2025-05-22T17:59:44.874Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: wireapp Products: wire-webapp Problem Types: CWE-226 Description: wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function to delete local data. Instructing the client to delete its local database on user logout does not result in deletion. This is the case for both temporary clients (marking the device as a public computer on login) and regular clients instructing the deletion of all personal information and conversat
ce as a public computer on login) and regular clients instructing the deletion of all personal information and conversations upon logout. Access to the machine is required to access the data. If encryption-at-rest is used, cryptographic material can't be exported. The underlying issue has been fixed with wire-webapp version 2025-05-14-production.0. In order to mitigate potential impact, the database must be manually deleted on devices where the option "This is a public computer" was used prior to log in or a log out with the request to delete local data with the affected versions has happened before. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wireapp/
rsions has happened before. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wireapp/wire-webapp/security/advisories/GHSA-qc6c-2hh8-qfh8 - https://github.com/wireapp/wire-webapp/commit/4c0ed5f1e9e0fcfceedf3c29034defce6e1fea77
CVE ID: CVE-2025-48067 State: PUBLISHED Published: 2025-06-10T15:19:44.186Z Last Updated: 2025-06-10T15:36:39.800Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L) Vendors: OctoPrint Products: OctoPrint Problem Types: CWE-73 Description: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows an attacker with the FILE_UPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability is fixed in 1.11.2. Additional Analyst Notes: - CISA ADP Vulnrichment:
y then can be downloaded from. This vulnerability is fixed in 1.11.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-m9jh-jf9h-x3h2 - https://github.com/OctoPrint/OctoPrint/commit/9984b20773f5895a432f965b759999b16c57f7d8
CVE ID: CVE-2025-48068 State: PUBLISHED Published: 2025-05-30T03:37:44.849Z Last Updated: 2025-06-13T14:47:20.267Z Vendors: vercel Products: next.js Problem Types: CWE-1385 Description: Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2. Additional Analyst Notes: - CISA ADP Vulnrichmen
is active. This issue has been patched in versions 14.2.30 and 15.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vercel/next.js/security/advisories/GHSA-3h52-269p-cp9r - https://vercel.com/changelog/cve-2025-48068
CVE ID: CVE-2025-48069 State: PUBLISHED Published: 2025-05-21T17:43:43.680Z Last Updated: 2025-05-21T18:17:21.237Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Shopify Products: ejson2env Problem Types: CWE-78 Description: ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a vulnerability related to how it writes to `stdout`. Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, res
dequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to `stdout`. If this output is improperly utilized in further command execution, it could lead to command injection, allowing an attacker to execute arbitrary commands on the host system. Version 2.0.8 sanitizes output during decryption. Other mitigations involve avoiding use of `ejson2env` to decrypt untrusted user secrets and/or avoiding evaluating or executing the direct output from `ejson2env` without removing nonprintable characters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com
ut removing nonprintable characters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Shopify/ejson2env/security/advisories/GHSA-2c47-m757-32g6 - https://github.com/Shopify/ejson2env/commit/592b3ceea967fee8b064e70983e8cec087b6d840
CVE ID: CVE-2025-48070 State: PUBLISHED Published: 2025-05-21T22:11:06.177Z Last Updated: 2025-05-22T15:52:48.689Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: makeplane Products: plane Problem Types: CWE-276 Description: Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site scripting (XSS). Version 0.23 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/makeplane/plane/secur
xes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/makeplane/plane/security/advisories/GHSA-cjh4-q763-cc48 - https://github.com/makeplane/plane/commit/0a8cc24da505fd519fcc3c9d6b5e15bc7ce21b29
CVE ID: CVE-2025-48071 State: PUBLISHED Published: 2025-07-31T20:13:14.436Z Last Updated: 2025-07-31T20:22:23.603Z Vendors: AcademySoftwareFoundation Products: openexr Problem Types: CWE-122 Description: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.2 through 3.3.0, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forged chunk header. This is fixed in version 3.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/openexr/security/