Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-32890 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T18:49:46.775Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:H/AV:A/A:N/C:N/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. It uses a custom implementation of encryption without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gotenna.com - https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities
CVE ID: CVE-2025-32896 State: PUBLISHED Published: 2025-06-19T10:38:37.159Z Last Updated: 2025-06-20T13:53:28.835Z Vendors: Apache Software Foundation Products: Apache SeaTunnel Problem Types: CWE-306 Description: # Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack. This issue affects Apache SeaTunnel: <=2.3.10 # Fixed Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication
Fixed Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/qvh3zyt1jr25rgvw955rb8qjrnbxfro9 - https://github.com/apache/seatunnel/pull/9010
CVE ID: CVE-2025-32897 State: PUBLISHED Published: 2025-06-28T18:25:18.312Z Last Updated: 2025-06-30T14:55:56.385Z Vendors: Apache Software Foundation Products: Apache Seata (incubating) Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Apache Seata (incubating): from 2.0.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2024-47552 -
sue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2024-47552 - https://lists.apache.org/thread/9fhtf7yvpjpzlwd1m0wfgg6tp2btxpy1
CVE ID: CVE-2025-32906 State: PUBLISHED Published: 2025-04-14T13:58:39.718Z Last Updated: 2025-11-18T08:34:40.834Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Upd
d Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-125 Description: A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP
) function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:21657 - https://access.redhat.com/errata/RHSA-2025:4439 - https://access.redhat.com/errata/RHSA-2025:4440 - https://access.redhat.com/errata/RHSA-2025:4508 - https://access.redhat.com/errata/RHSA-2025:4538 - https://access.redhat.com/errata/RHSA-2025:4560 - https://access.redhat.com/errata/RHSA-2025:4568 - https://access.redhat.com/errata/RHSA-2025:4609 - https://access.redhat.com/errata/RHSA-2025:4624 - https
SA-2025:4568 - https://access.redhat.com/errata/RHSA-2025:4609 - https://access.redhat.com/errata/RHSA-2025:4624 - https://access.redhat.com/errata/RHSA-2025:7436 - https://access.redhat.com/errata/RHSA-2025:7505 - https://access.redhat.com/errata/RHSA-2025:8292 - https://access.redhat.com/errata/RHSA-2025:9179 - https://access.redhat.com/security/cve/CVE-2025-32906 - https://bugzilla.redhat.com/show_bug.cgi?id=2359341
CVE ID: CVE-2025-32907 State: PUBLISHED Published: 2025-04-14T14:00:09.723Z Last Updated: 2025-11-18T08:35:33.088Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-1050 Description: A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows
in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:4439 - https://access.redhat.com/errata/RHSA-2025:4440 - https://access.redhat.com/errata/RHSA-2025:4508 - https://access.redhat.com/errata/RHSA-2025:7436 - https://access.redhat.com/errata/RHSA-2025:8128 - https://access.redhat.com/errata/RHSA-2025:8292 - https://access.redhat.com/securi
ss.redhat.com/errata/RHSA-2025:8128 - https://access.redhat.com/errata/RHSA-2025:8292 - https://access.redhat.com/security/cve/CVE-2025-32907 - https://bugzilla.redhat.com/show_bug.cgi?id=2359342
CVE ID: CVE-2025-32908 State: PUBLISHED Published: 2025-04-14T14:00:30.423Z Last Updated: 2025-11-18T09:06:43.354Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-115 Description: A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:75
ce (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:7505 - https://access.redhat.com/security/cve/CVE-2025-32908 - https://bugzilla.redhat.com/show_bug.cgi?id=2359343
CVE ID: CVE-2025-32909 State: PUBLISHED Published: 2025-04-14T14:42:26.433Z Last Updated: 2025-11-06T23:08:26.901Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 Problem Types: CWE-476 Description: A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniff_mp4 function. The HTTP server may cause the libsoup client to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-202
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:8292 - https://access.redhat.com/security/cve/CVE-2025-32909 - https://bugzilla.redhat.com/show_bug.cgi?id=2359353
CVE ID: CVE-2025-32910 State: PUBLISHED Published: 2025-04-14T14:43:20.175Z Last Updated: 2025-11-06T23:08:29.392Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 Problem Types: CWE-476 Description: A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:8292 - https:/
CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:8292 - https://access.redhat.com/security/cve/CVE-2025-32910 - https://bugzilla.redhat.com/show_bug.cgi?id=2359354
CVE ID: CVE-2025-32911 State: PUBLISHED Published: 2025-04-15T15:39:34.919Z Last Updated: 2025-11-18T08:34:54.179Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterp
Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 Problem Types: CWE-590 Description: A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corru
soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:21657 - https://access.redhat.com/errata/RHSA-2025:4439 - https://access.redhat.com/errata/RHSA-2025:4440 - https://access.redhat.com/errata/RHSA-2025:4508 - https://access.redhat.com/errata/RHSA-2025:4538 - https://access.redhat.com/errata/RHSA-2025:4560 - https://access.redhat.com/errata/RHSA-2025:4568 - https://access.redhat.com/errata/RHSA-2025:4609 - https://access.redhat.com/errata/RHSA-2025:4624 - https://ac
25:4568 - https://access.redhat.com/errata/RHSA-2025:4609 - https://access.redhat.com/errata/RHSA-2025:4624 - https://access.redhat.com/errata/RHSA-2025:7436 - https://access.redhat.com/errata/RHSA-2025:8292 - https://access.redhat.com/errata/RHSA-2025:9179 - https://access.redhat.com/security/cve/CVE-2025-32911 - https://bugzilla.redhat.com/show_bug.cgi?id=2359355
CVE ID: CVE-2025-32912 State: PUBLISHED Published: 2025-04-14T14:44:46.593Z Last Updated: 2025-11-06T23:08:28.223Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-476 Description: A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:7505 - https://access.redh
lnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:7505 - https://access.redhat.com/security/cve/CVE-2025-32912 - https://bugzilla.redhat.com/show_bug.cgi?id=2359356
CVE ID: CVE-2025-32913 State: PUBLISHED Published: 2025-04-14T13:37:36.587Z Last Updated: 2025-11-18T08:35:03.846Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterpri
vanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 Problem Types: CWE-476 Description: A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to cras
ntent_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:21657 - https://access.redhat.com/errata/RHSA-2025:4439 - https://access.redhat.com/errata/RHSA-2025:4440 - https://access.redhat.com/errata/RHSA-2025:4508 - https://access.redhat.com/errata/RHSA-2025:4538 - https://access.redhat.com/errata/RHSA-2025:4560 - https://access.redhat.com/errata/RHSA-2025:4568 - https://access.redhat.com/errata/RHSA-2025:4609 - https://access.redhat.com/errata/RH
redhat.com/errata/RHSA-2025:4568 - https://access.redhat.com/errata/RHSA-2025:4609 - https://access.redhat.com/errata/RHSA-2025:4624 - https://access.redhat.com/errata/RHSA-2025:7436 - https://access.redhat.com/errata/RHSA-2025:8292 - https://access.redhat.com/errata/RHSA-2025:9179 - https://access.redhat.com/security/cve/CVE-2025-32913 - https://bugzilla.redhat.com/show_bug.cgi?id=2359357
CVE ID: CVE-2025-32914 State: PUBLISHED Published: 2025-04-14T14:45:46.300Z Last Updated: 2025-11-18T08:36:48.023Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Suppor
ice, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-125 Description: A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://a
read out of bounds. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:21657 - https://access.redhat.com/errata/RHSA-2025:7505 - https://access.redhat.com/errata/RHSA-2025:8126 - https://access.redhat.com/errata/RHSA-2025:8132 - https://access.redhat.com/errata/RHSA-2025:8139 - https://access.redhat.com/errata/RHSA-2025:8140 - https://access.redhat.com/errata/RHSA-2025:8252 - https://access.redhat.com/errata/RHSA-2025:8480 - https://access.redhat.com/errata/RHSA-2025:8481 - https://access.redhat.com/errata/RHSA-2025:8482 - https://access.redhat.com/errata/RHSA-2025:8663 - https://access.redhat.com/errata/RHSA-
hat.com/errata/RHSA-2025:8482 - https://access.redhat.com/errata/RHSA-2025:8663 - https://access.redhat.com/errata/RHSA-2025:9179 - https://access.redhat.com/security/cve/CVE-2025-32914 - https://bugzilla.redhat.com/show_bug.cgi?id=2359358
CVE ID: CVE-2025-32915 State: PUBLISHED Published: 2025-05-22T14:16:01.214Z Last Updated: 2025-05-22T14:48:38.894Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-732 Description: Packages downloaded by Checkmk's automatic agent updates on Linux and Solaris have incorrect permissions in Checkmk < 2.4.0p1, < 2.3.0p32, < 2.2.0p42 and <= 2.1.0p49 (EOL). This allows a local attacker to read sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17099
CVE ID: CVE-2025-32916 State: PUBLISHED Published: 2025-10-09T15:00:58.720Z Last Updated: 2025-10-14T14:16:57.077Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-598 Description: Potential use of sensitive information in GET requests in Checkmk GmbH's Checkmk versions <2.4.0p13, <2.3.0p38, <2.2.0p46, and 2.1.0 (EOL) may cause sensitive form data to be included in URL query parameters, which may be logged in various places such as browser history or web server logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17105
CVE ID: CVE-2025-32917 State: PUBLISHED Published: 2025-05-13T10:45:31.406Z Last Updated: 2025-05-13T13:05:57.675Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-427 Description: Privilege escalation in jar_signature agent plugin in Checkmk versions <2.4.0b7 (beta), <2.3.0p32, <2.2.0p42, and 2.1.0p49 (EOL) allow user with write access to JAVA_HOME/bin directory to escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17985
CVE ID: CVE-2025-32918 State: PUBLISHED Published: 2025-07-04T08:12:21.950Z Last Updated: 2025-07-08T14:20:25.426Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-140 Description: Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2.1.0 (EOL) allows an authenticated user to inject arbitrary Livestatus commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17987
CVE ID: CVE-2025-32919 State: PUBLISHED Published: 2025-10-09T15:01:42.606Z Last Updated: 2025-11-03T17:32:30.502Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-427 Description: Use of an insecure temporary directory in the Windows License plugin for the Checkmk Windows Agent allows Privilege Escalation. This issue affects Checkmk: from 2.4.0 before 2.4.0p13, from 2.3.0 before 2.3.0p38, from 2.2.0 before 2.2.0p46, and all versions of 2.1.0 (EOL). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://checkmk.com/werk/18207 - https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250724-01_Checkmk_Agent_Privilege_Escalation
8207 - https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250724-01_Checkmk_Agent_Privilege_Escalation_via_Insecure_Temporary_Files
CVE ID: CVE-2025-32920 State: PUBLISHED Published: 2025-05-19T16:05:49.475Z Last Updated: 2025-06-17T09:15:11.584Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: TemplateInvaders Products: TI WooCommerce Wishlist Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ti-woocommerce-wishlist/vulnerability/wordpress-ti-woocommerce-wishlist-p
tps://patchstack.com/database/wordpress/plugin/ti-woocommerce-wishlist/vulnerability/wordpress-ti-woocommerce-wishlist-plugin-2-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-32921 State: PUBLISHED Published: 2025-04-24T16:08:41.481Z Last Updated: 2025-04-25T13:55:08.613Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: WPoperation Products: Arrival Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPoperation Arrival allows PHP Local File Inclusion. This issue affects Arrival: from n/a through 1.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/arrival/vulnerability/wordpress-arrival-theme-1-4-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-32922 State: PUBLISHED Published: 2025-05-15T18:11:54.301Z Last Updated: 2025-05-15T18:29:26.071Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Tobias Products: WP2LEADS Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Tobias WP2LEADS allows Stored XSS.This issue affects WP2LEADS: from n/a through 3.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-32923 State: PUBLISHED Published: 2025-04-15T21:53:58.229Z Last Updated: 2025-04-16T14:39:55.056Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Tourmaster Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Tourmaster allows Reflected XSS. This issue affects Tourmaster: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tourmaster/vulnerability/wordpress-tourmaster-plugin-5-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-32924 State: PUBLISHED Published: 2025-05-19T19:57:42.192Z Last Updated: 2025-05-19T21:18:41.147Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: roninwp Products: Revy Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy allows SQL Injection.This issue affects Revy: from n/a through 2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/revy/vulnerability/wordpress-revy-plugin-2-1-sql-injection-vulnerability?_s_id=cve