Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s or nodes from the scheduler. In the Kubernetes security model, node isolation is a security boundary, and as such an attacker is able to cross that boundary in Volcano's case if they have compromised either the vulnerable services or the pod/node in which they are deployed. The scheduler will become unavailable to other users and workloads in the cluster. The scheduler will either crash with an unrecoverable OOM panic or freeze while consuming excessive amounts of memory. This issue has been patched in versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/volcano-sh/volcano/
1.12.0-alpha.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/volcano-sh/volcano/security/advisories/GHSA-hg79-fw4p-25p8 - https://github.com/volcano-sh/volcano/releases/tag/v1.10.2 - https://github.com/volcano-sh/volcano/releases/tag/v1.11.0-network-topology-preview.3 - https://github.com/volcano-sh/volcano/releases/tag/v1.11.2 - https://github.com/volcano-sh/volcano/releases/tag/v1.12.0-alpha.2 - https://github.com/volcano-sh/volcano/releases/tag/v1.9.1
CVE ID: CVE-2025-32778 State: PUBLISHED Published: 2025-04-15T20:19:58.458Z Last Updated: 2025-04-15T20:31:34.236Z Vendors: Lissy93 Products: web-check Problem Types: CWE-78 Description: Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project (Lissy93/web-check). The issue stems from user-controlled input (url) being passed unsanitized into a shell command using exec(), allowing attackers to execute arbitrary system commands on the underlying host. This could be exploited by sending crafted url parameters to extract files or even establish remote access. The vulnerability has been patched by repl
ding crafted url parameters to extract files or even establish remote access. The vulnerability has been patched by replacing exec() with execFile(), which avoids using a shell and properly isolates arguments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Lissy93/web-check/security/advisories/GHSA-5qg5-g7c2-pfx8 - https://github.com/Lissy93/web-check/pull/243 - https://github.com/Lissy93/web-check/commit/0e4958aa10b2650d32439a799f6fc83a7cd46cef
CVE ID: CVE-2025-32779 State: PUBLISHED Published: 2025-04-15T16:32:31.992Z Last Updated: 2025-10-27T14:27:19.953Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: labsai Products: EDDI Problem Types: CWE-22 Description: E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. In versions before 5.5.0, an attacker with access to the `/backup/import` API endpoint can write arbitrary files to locations outside the intended extraction directory due to a Zip Slip vulnerability. Although the application runs as a non-root user (`185`), limiting direct impact on system-level files, this vulnerability can still be exploited to o
as a non-root user (`185`), limiting direct impact on system-level files, this vulnerability can still be exploited to overwrite application files (e.g., JAR libraries) owned by the application user. This overwrite can potentially lead to Remote Code Execution (RCE) within the application's context. This issue has been patched in version 5.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/labsai/EDDI/security/advisories/GHSA-9v34-frgq-63mv - https://github.com/labsai/EDDI/commit/1e207d0e4f72a5a93920bc0f76cad53ffd8e7065 - https://www.sonarsource.com/blog/code-security-for-conversational-ai-uncovering-a-zip-slip-in-eddi
CVE ID: CVE-2025-32780 State: PUBLISHED Published: 2025-04-15T16:32:55.622Z Last Updated: 2025-04-15T17:30:02.744Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: bleachbit Products: bleachbit Problem Types: CWE-427 Description: BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.6.2 is vulnerable to a DLL Hijacking vulnerability. By placing a malicious DLL with the name uuid.dll in the folder C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\, an attacker can execute arbitrary code every time BleachBit is run. This issue has been patched in version 4.9.0. Additional Analyst Notes: - CISA ADP Vulnrichm
very time BleachBit is run. This issue has been patched in version 4.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bleachbit/bleachbit/security/advisories/GHSA-ghph-v4x4-vr3c - https://github.com/bleachbit/bleachbit/commit/dafeba57dcb14c7ec4a97224ff1408f6b0c2a7f8
CVE ID: CVE-2025-32782 State: PUBLISHED Published: 2025-04-15T22:04:41.667Z Last Updated: 2025-04-16T15:36:23.539Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: team-alembic Products: ash_authentication Problem Types: CWE-306 Description: Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools (e.g., Outlook, virus scanners, and email previewers) may automatically follow these links, unintentionally confirming the account. This allows an attacker to register an account using another user’s emai
links, unintentionally confirming the account. This allows an attacker to register an account using another user’s email and potentially have it auto-confirmed by the victim’s email client. This does not allow attackers to take over or access existing accounts or private data. It is limited to account confirmation of new accounts only. This vulnerability is fixed in 4.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-3988-q8q7-p787 - https://github.com/team-alembic/ash_authentication/commit/99ea38977fd4f421d2aaae0c2fb29f8e5f8f707d
CVE ID: CVE-2025-32783 State: PUBLISHED Published: 2025-04-16T21:38:06.220Z Last Updated: 2025-04-17T13:16:07.340Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-668 Description: XWiki Platform is a generic wiki platform. A vulnerability in versions from 5.0 to 16.7.1 affects users with Message Stream enabled and a wiki configured as closed from selecting "Prevent unregistered users to view pages" in the Administrations Rights. The vulnerability is that any message sent in a subwiki to "everyone" is actually sent to the farm: any visitor of the main wiki will be able to see that message through the Dashboard
ryone" is actually sent to the farm: any visitor of the main wiki will be able to see that message through the Dashboard, even if the subwiki is configured to be private. This issue will not be patched as Message Stream has been deprecated in XWiki 16.8.0RC1 and is not maintained anymore. A workaround for this issue involves keeping Message Stream disabled by default. It's advised to keep it disabled from Administration > Social > Message Stream. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-42fh-pvvh-999x - https://jira.xwiki.org/browse/XWIKI-17154
CVE ID: CVE-2025-32784 State: PUBLISHED Published: 2025-04-15T21:56:27.639Z Last Updated: 2025-04-17T14:25:10.981Z Vendors: conda-forge Products: conda-forge-webservices Problem Types: CWE-367 Description: conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastructure. This vulnerability, categorized as a Time-of-Check to Time-of-Use (TOCTOU) issue, can be exploited to introduce unauthorized modifications to build artifacts stored in the cf-staging Anaconda channel. Exploitation may result in th
e unauthorized modifications to build artifacts stored in the cf-staging Anaconda channel. Exploitation may result in the unauthorized publication of malicious artifacts to the production conda-forge channel. The core vulnerability results from the absence of atomicity between the hash validation and the artifact copy operation. This gap allows an attacker, with access to the cf-staging token, to overwrite the validated artifact with a malicious version immediately after hash verification, but before the copy action is executed. As the cf-staging channel permits artifact overwrites, such an operation can be carried out using the anaconda upload --force command. This vulnerability is fixed in
erwrites, such an operation can be carried out using the anaconda upload --force command. This vulnerability is fixed in 2025.4.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/conda-forge/conda-forge-webservices/security/advisories/GHSA-28cx-74fp-g2g2 - https://github.com/conda-forge/conda-forge-webservices/commit/141ed27617068debd150956341551df3a5a3807d
CVE ID: CVE-2025-32785 State: PUBLISHED Published: 2025-10-27T18:44:15.658Z Last Updated: 2025-10-27T19:40:38.991Z Vendors: pi-hole Products: web Problem Types: CWE-79 Description: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript by adding a payload to the Address field when creating or editing a list entry. The vulnerability is triggered when another user navigates to the Tools section and
n creating or editing a list entry. The vulnerability is triggered when another user navigates to the Tools section and performs a gravity database update. The Address field does not properly sanitize input, allowing special characters and script tags to bypass validation. This has been patched in version 6.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pi-hole/web/security/advisories/GHSA-7w6h-3gwc-qhq5
CVE ID: CVE-2025-32786 State: PUBLISHED Published: 2025-11-04T20:18:43.581Z Last Updated: 2025-11-05T18:48:29.572Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi-inventory-plugin Problem Types: CWE-89 Description: The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerable to SQL Injection. This issue is fixed in version 1.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-w2cp-r675-6xpq - https://github.com/glpi-project/glpi-inventory
i-project/glpi-inventory-plugin/security/advisories/GHSA-w2cp-r675-6xpq - https://github.com/glpi-project/glpi-inventory-plugin/blob/1.5.1/CHANGELOG.md - https://github.com/glpi-project/glpi-inventory-plugin/releases/tag/1.5.1
CVE ID: CVE-2025-32787 State: PUBLISHED Published: 2025-04-16T21:41:15.966Z Last Updated: 2025-04-17T13:15:18.899Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: SoftEtherVPN Products: SoftEtherVPN Problem Types: CWE-476 Description: SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in `DeleteIPv6DefaultRouterInRA` called by `StorePacket`. Before dereferencing, `DeleteIPv6DefaultRouterInRA` does not account for `ParsePacket` returning NULL, resulting in the program crashing. A patched version does not exist at this time. Additional Analyst Notes: - CISA ADP Vulnrichmen
in the program crashing. A patched version does not exist at this time. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SoftEtherVPN/SoftEtherVPN/security/advisories/GHSA-xw53-587j-mqh6 - https://github.com/SoftEtherVPN/SoftEtherVPN/blob/7006539732c0231d7723623cc8732f94ba2b8c54/src/Cedar/Hub.c#L5112C1-L5116C29 - https://github.com/SoftEtherVPN/SoftEtherVPN/blob/master/src/Mayaqua/TcpIp.c#L1633
CVE ID: CVE-2025-32788 State: PUBLISHED Published: 2025-04-22T17:14:39.690Z Last Updated: 2025-04-25T16:03:30.506Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: OctoPrint Products: OctoPrint Problem Types: CWE-290 Description: OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. The primary risk lies in potential future modifications to the codebase that might incorrectly rely on the vulnerable internal functions for authentication checks, leading to s
to the codebase that might incorrectly rely on the vulnerable internal functions for authentication checks, leading to security vulnerabilities. This issue has been patched in version 1.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-qw93-h6pf-226x - https://github.com/OctoPrint/OctoPrint/commit/41ff431014edfa18ca1a01897b10463934dc7fc2
CVE ID: CVE-2025-32789 State: PUBLISHED Published: 2025-04-16T21:45:21.625Z Last Updated: 2025-04-17T13:14:36.548Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: espocrm Products: espocrm Problem Types: CWE-200, CWE-203 Description: EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the user table, based on the results of the sorted list of users. Although unlikely, if an attacker knows the hash value of their password, they can change the password and repeat
users. Although unlikely, if an attacker knows the hash value of their password, they can change the password and repeat the sorting until the other user's password hash is fully revealed. This issue is patched in version 9.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espocrm/espocrm/security/advisories/GHSA-3ph3-jcfx-fq53 - https://github.com/espocrm/espocrm/commit/91740192d2e2c575c6a04534c079baf9f3af0a7f - https://github.com/espocrm/espocrm/commit/bd900d0b48fe37a98def4c0e094e39e7e385e9ea
CVE ID: CVE-2025-32790 State: PUBLISHED Published: 2025-04-18T12:15:11.487Z Last Updated: 2025-04-18T13:48:27.073Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: langgenius Products: dify Problem Types: CWE-284 Description: Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access c
es updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langgenius/dify/security/advisories/GHSA-jp6m-v4gw-5vgp - https://github.com/langgenius/dify/pull/5841 - https://github.com/langgenius/dify/commit/59ad091e69736bc9dc1a3bace62ec0a232346246
CVE ID: CVE-2025-32791 State: PUBLISHED Published: 2025-04-16T21:46:23.659Z Last Updated: 2025-04-17T13:11:08.152Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: backstage Products: backstage Problem Types: CWE-213 Description: The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission backend. If the permission system is not in use or if the installed permission policy does not use conditional decisions, there is no impact.
ssion system is not in use or if the installed permission policy does not use conditional decisions, there is no impact. This issue has been patched in version 0.6.0 of the permissions backend. A workaround includes having administrators of the permission policies ensure that they are crafted in such a way that conditional decisions do not contain any sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/backstage/backstage/security/advisories/GHSA-f8j4-p5cr-p777
CVE ID: CVE-2025-32792 State: PUBLISHED Published: 2025-04-18T16:04:16.778Z Last Updated: 2025-04-21T13:28:59.847Z Vendors: endojs Products: endo Problem Types: CWE-497 Description: SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using `ses` and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used `const`, `let`, and `class` bindings in the top-level scope of a `<script>` tag will have inadvertently revealed these bindings in the lexical scope of third-party code. This issue has been patched
ag will have inadvertently revealed these bindings in the lexical scope of third-party code. This issue has been patched in version 1.12.0. Workarounds for this issue involve either avoiding top-level `let`, `const`, or `class` bindings in `<script>` tags, or change these to `var` bindings to be reflected on `globalThis`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/endojs/endo/security/advisories/GHSA-h9w6-f932-gq62
CVE ID: CVE-2025-32793 State: PUBLISHED Published: 2025-04-21T15:34:14.315Z Last Updated: 2025-04-21T15:48:55.214Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: cilium Products: cilium Problem Types: CWE-319 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16
ncryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-5vxx-c285-pcq4 - https://github.com/cilium/cilium/pull/38592
CVE ID: CVE-2025-32794 State: PUBLISHED Published: 2025-05-23T15:15:32.925Z Last Updated: 2025-05-23T17:00:53.086Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: openemr Products: openemr Problem Types: CWE-79 Description: OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the First and Last Name fields during patient registration. This code is later executed when viewing the patien
loads in the First and Last Name fields during patient registration. This code is later executed when viewing the patient's encounter under Orders → Procedure Orders. Version 7.0.3.4 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openemr/openemr/security/advisories/GHSA-3c27-2m7h-f7rx
CVE ID: CVE-2025-32795 State: PUBLISHED Published: 2025-04-18T16:05:11.644Z Last Updated: 2025-04-18T16:37:49.329Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: langgenius Products: dify Problem Types: CWE-284 Description: Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons. This access control flaw allows non-admin users to modify app details, despite being restricted from viewing apps, which poses a security risk to the integrity of the application. This issue has been patched in version 0.6.
ewing apps, which poses a security risk to the integrity of the application. This issue has been patched in version 0.6.12. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can modify app details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langgenius/dify/security/advisories/GHSA-gg5w-m2vw-vmmj - https://github.com/langgenius/dify/pull/5266
CVE ID: CVE-2025-32796 State: PUBLISHED Published: 2025-04-18T16:06:47.577Z Last Updated: 2025-04-18T16:36:51.064Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: langgenius Products: dify Problem Types: CWE-284 Description: Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disable apps through the API, even though the web UI button for this action is disabled and normal users are not permitted to make such changes. This access control flaw allows non-admin users to make unauthorized changes, which can disrupt the functionality and availability of the APPS
aw allows non-admin users to make unauthorized changes, which can disrupt the functionality and availability of the APPS. This issue has been patched in version 0.6.12. A workaround for this vulnerability involves updating the API access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can send enable or disable requests for apps. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langgenius/dify/security/advisories/GHSA-hqcx-598m-pjq4 - https://github.com/langgenius/dify/pull/5266
CVE ID: CVE-2025-32797 State: PUBLISHED Published: 2025-06-16T18:46:31.227Z Last Updated: 2025-06-17T13:57:44.968Z Vendors: conda Products: conda-build Problem Types: CWE-277 Description: Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the write_build_scripts function in conda-build creates the temporary build script conda_build.sh with overly permissive file permissions (0o766), allowing write access to all users. Attackers with filesystem access can exploit a race condition to overwrite the script before execution, enabling arbitrary code execution under the victim's privileges. This risk is significant in shared environments, potentially leading t