Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
pands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg - https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e
CVE ID: CVE-2025-57808 State: PUBLISHED Published: 2025-09-02T00:26:09.017Z Last Updated: 2025-09-02T14:03:58.777Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: esphome Products: esphome Problem Types: CWE-303 Description: ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or
ss to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/esphome/esphome/security/advisories/GHSA-mxh2-ccgj-8635 - https://github.com/esphome/esphome/commit/2aceb56606ec8afec5f49c92e140c8050a6ccbe5
CVE ID: CVE-2025-57809 State: PUBLISHED Published: 2025-08-25T21:22:00.226Z Last Updated: 2025-08-26T20:19:34.998Z Vendors: mlc-ai Products: xgrammar Problem Types: CWE-674 Description: XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.21, XGrammar has an infinite recursion issue in the grammar. This issue has been resolved in version 0.1.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-5cmr-4px5-23pc - https://github.com/mlc-ai/xgrammar/issues/250 - https://github.com/mlc-ai/xgrammar/commit/b943feacb5a1caf4d39de8ec3bf7c7ce066dcee5
CVE ID: CVE-2025-57810 State: PUBLISHED Published: 2025-08-26T15:37:28.071Z Last Updated: 2025-08-26T15:58:25.184Z Vendors: parallax Products: jsPDF Problem Types: CWE-20, CWE-770 Description: jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of service. The vulnerability was fixed in jsPDF 3.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/parallax/jsPDF/sec
d in jsPDF 3.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/parallax/jsPDF/security/advisories/GHSA-8mvj-3j78-4qmw - https://github.com/parallax/jsPDF/pull/3880 - https://github.com/parallax/jsPDF/commit/4cf3ab619e565d9b88b4b130bff901b91d8688e9 - https://github.com/parallax/jsPDF/releases/tag/v3.0.2
CVE ID: CVE-2025-57811 State: PUBLISHED Published: 2025-08-25T17:52:07.786Z Last Updated: 2025-08-25T18:05:18.176Z Vendors: craftcms Products: cms Problem Types: CWE-1336 Description: Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc - https://github.com/craftcms/cms/pull/17612 - https://gi
ithub.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc - https://github.com/craftcms/cms/pull/17612 - https://github.com/craftcms/cms/commit/e77f8a287dcdda41f1724f525d03542f18566cbc
CVE ID: CVE-2025-57812 State: PUBLISHED Published: 2025-11-12T18:46:52.801Z Last Updated: 2025-11-12T21:04:17.490Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: OpenPrinting Products: libcupsfilters Problem Types: CWE-125, CWE-787 Description: CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vu
d libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They mu
ted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the `imagetoraster` filter or its C-function equivalent `cfFilterImageToRaster()` gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is `_cfImageReadTIFF() in libcupsfilters`. When this function is invoked as part of `cfFilterImageToRaster()`, the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-
essing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in `_cupsImageReadTIFF()`, which is called through `cupsImageOpen()` from the `imagetoraster` tool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-jpxg-qc2c-hgv4 - https://github.com/OpenPrinting/libcupsfilters/commit/b69dfacec7f176281782e2f7ac44f04bf9633cfa - https://github.com/OpenPrinting/cups-filter
penPrinting/libcupsfilters/commit/b69dfacec7f176281782e2f7ac44f04bf9633cfa - https://github.com/OpenPrinting/cups-filters/blob/3c58463e341b12c9d30d7d3807d2bac1bc595a78/cupsfilters/image-tiff.c#L34 - https://github.com/OpenPrinting/cups-filters/blob/3c58463e341b12c9d30d7d3807d2bac1bc595a78/filter/imagetoraster.c#L613 - https://github.com/OpenPrinting/libcupsfilters/blob/33421982e10f6a14bc0bab03b80c9cf4660e8d7d/cupsfilters/image-tiff.c#L32
CVE ID: CVE-2025-57813 State: PUBLISHED Published: 2025-08-26T16:06:41.220Z Last Updated: 2025-08-26T20:37:52.226Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: traPtitech Products: traQ Problem Types: CWE-532 Description: traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, a vulnerability exists where sensitive information, such as OAuth tokens, are recorded in log files when an error occurs during the execution of an SQL query. An attacker could intentionally trigger an SQL error by methods such as placing a high load on the database. This could allow an attacker who has the authority to view the log files to il
h as placing a high load on the database. This could allow an attacker who has the authority to view the log files to illicitly acquire the recorded sensitive information. This vulnerability has been patched in version 3.25.0. If upgrading is not possible, a temporary workaround involves reviewing access permissions for SQL error logs and strictly limiting access to prevent unauthorized users from viewing them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/traPtitech/traQ/security/advisories/GHSA-27r7-3m9x-r533 - https://github.com/traPtitech/traQ/pull/2787 - https://github.com/traPtitech/traQ/commit/ce5da94f5d5a8348f9ecdc82140b6f53b3721698
CVE ID: CVE-2025-57814 State: PUBLISHED Published: 2025-08-25T21:48:09.780Z Last Updated: 2025-08-26T14:39:35.687Z Vendors: azu Products: request-filtering-agent Problem Types: CWE-918 Description: request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Versions 1.x.x and earlier contain a vulnerability where HTTPS requests to 127.0.0.1 bypass IP address filtering, while HTTP requests are correctly blocked. This allows attackers to potentially access internal HTTPS services running on localhost, bypassing the library's SSRF protection. The vulnerability is particularly dangerous when the application accepts user-controlled URLs and in
's SSRF protection. The vulnerability is particularly dangerous when the application accepts user-controlled URLs and internal services are only protected by network-level restrictions. This vulnerability has been fixed in request-filtering-agent version 2.0.0. Users should upgrade to version 2.0.0 or later. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/azu/request-filtering-agent/security/advisories/GHSA-pw25-c82r-75mm - https://github.com/azu/request-filtering-agent-https127-test
CVE ID: CVE-2025-57815 State: PUBLISHED Published: 2025-09-08T21:11:53.369Z Last Updated: 2025-09-09T13:44:06.409Z Vendors: ethyca Products: fides Problem Types: CWE-307 Description: Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or password spraying, which poses a risk to accounts with weak or previously compromised passwords. Version 2.69.1 fixes the issue. For organizations with co
isk to accounts with weak or previously compromised passwords. Version 2.69.1 fixes the issue. For organizations with commercial Fides Enterprise licenses, configuring Single Sign-On (SSO) through an OIDC provider (like Azure, Google, or Okta) is an effective workaround. When OIDC SSO is enabled, username/password authentication can be disabled entirely, which eliminates this attack vector. This functionality is not available for Fides Open Source users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisories/GHSA-7q62-r88r-j5gw - https://github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd557033a5c - https://github.com/e
-7q62-r88r-j5gw - https://github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd557033a5c - https://github.com/ethyca/fides/releases/tag/2.69.1
CVE ID: CVE-2025-57816 State: PUBLISHED Published: 2025-09-08T21:14:06.853Z Last Updated: 2025-09-09T14:19:27.430Z Vendors: ethyca Products: fides Problem Types: CWE-799 Description: Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on directly connected infrastructure IPs rather than client IPs, and stores counters in-memory rather than in a shared store. This allows attackers to bypass intended rate limits and potentially cause denial of service. This vulnerability only affects deployment
ckers to bypass intended rate limits and potentially cause denial of service. This vulnerability only affects deployments relying on Fides's built-in rate limiting for protection. Deployments using external rate limiting solutions (WAFs, API gateways, etc.) are not affected. Version 2.69.1 fixes the issue. There are no application-level workarounds. However, rate limiting may instead be implemented externally at the infrastructure level using a WAF, API Gateway, or similar technology. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisories/GHSA-fq34-xw6c-fphf - https://github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd5
/fides/security/advisories/GHSA-fq34-xw6c-fphf - https://github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd557033a5c - https://github.com/ethyca/fides/releases/tag/2.69.1
CVE ID: CVE-2025-57817 State: PUBLISHED Published: 2025-09-08T21:17:09.105Z Last Updated: 2025-09-09T13:39:00.895Z Vendors: ethyca Products: fides Problem Types: CWE-862 Description: Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the OAuth client creation and update endpoints of the Fides Webserver API do not properly authorize scope assignment. This allows highly privileged users with `client:create` or `client:update` permissions to escalate their privileges to owner-level. Version 2.69.1 fixes the issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisories/GH
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisories/GHSA-hjfh-p8f5-24wr - https://github.com/ethyca/fides/commit/2ffd125e1089a09b84c27fb5279a05960cbf2452 - https://github.com/ethyca/fides/releases/tag/2.69.1
CVE ID: CVE-2025-57818 State: PUBLISHED Published: 2025-08-26T17:52:43.868Z Last Updated: 2025-08-26T20:13:29.759Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: firecrawl Products: firecrawl Problem Types: CWE-918 Description: Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an internal URL and send POST requests with arbitrary headers, which may have allowed access to internal systems. This has been fixed in version 2.0.1. If upgrading is not possible, it
hich may have allowed access to internal systems. This has been fixed in version 2.0.1. If upgrading is not possible, it is recommend to isolate Firecrawl from any sensitive internal systems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/firecrawl/firecrawl/security/advisories/GHSA-p2wg-prhf-jx79 - https://github.com/firecrawl/firecrawl/commit/b15fae51a760e9810a66bbfde5d5693d0df3fbeb - https://github.com/firecrawl/firecrawl/commit/e8cf0985b07968061a6b684b58097732e827ed46 - https://github.com/firecrawl/firecrawl/releases/tag/v2.0.1
CVE ID: CVE-2025-57819 State: PUBLISHED Published: 2025-08-28T16:45:18.749Z Last Updated: 2025-10-21T22:45:20.311Z Vendors: FreePBX Products: security-reporting Problem Types: CWE-89, CWE-288 Description: FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreePBX/security-reporting/security/advisori
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h - https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203
CVE ID: CVE-2025-57820 State: PUBLISHED Published: 2025-08-26T22:33:19.100Z Last Updated: 2025-08-27T20:42:46.786Z Vendors: sveltejs Products: devalue Problem Types: CWE-1321 Description: Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv - https://github.com/s
chment: References: - https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv - https://github.com/sveltejs/devalue/commit/0623a47c9555b639c03ff1baea82951b2d9d1132
CVE ID: CVE-2025-57821 State: PUBLISHED Published: 2025-08-27T16:32:36.284Z Last Updated: 2025-08-27T18:53:03.636Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: basecamp Products: google_sign_in Problem Types: CWE-601 Description: Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.0, it is possible to craft a malformed URL that passes the "same origin" check, resulting in the user being redirected to another origin. Rails applications configured to store the flash information in a session cookie may be vulnerable, if this can be chained with an attack that allows injection of arbitrary data into the session cookie. Th
be vulnerable, if this can be chained with an attack that allows injection of arbitrary data into the session cookie. This issue has been patched in version 1.3.0. If upgrading is not possible at this time, a way to mitigate the chained attack can be done by explicitly setting SameSite=Lax or SameSite=Strict on the application session cookie. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/basecamp/google_sign_in/security/advisories/GHSA-7pwc-wh6m-44q3 - https://github.com/basecamp/google_sign_in/pull/73 - https://github.com/basecamp/google_sign_in/commit/85903651201257d4f14b97d4582e6d968ac32f15 - https://github.com/basecamp/google_sign_in/releases/tag/v1.
le_sign_in/commit/85903651201257d4f14b97d4582e6d968ac32f15 - https://github.com/basecamp/google_sign_in/releases/tag/v1.3.0
CVE ID: CVE-2025-57822 State: PUBLISHED Published: 2025-08-29T21:33:15.304Z Last Updated: 2025-09-02T17:26:25.016Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: vercel Products: next.js Problem Types: CWE-918 Description: Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly enc
versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f - https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8 - https://vercel.com/changelog/cve-2025-57822
CVE ID: CVE-2025-57824 State: REJECTED Published: N/A Last Updated: 2025-08-21T02:55:09.403Z Description: No description available.
CVE ID: CVE-2025-57825 State: REJECTED Published: N/A Last Updated: 2025-08-21T02:55:08.939Z Description: No description available.
CVE ID: CVE-2025-57826 State: REJECTED Published: N/A Last Updated: 2025-08-21T02:55:08.463Z Description: No description available.
CVE ID: CVE-2025-57827 State: REJECTED Published: N/A Last Updated: 2025-08-21T02:55:07.920Z Description: No description available.
CVE ID: CVE-2025-57828 State: REJECTED Published: N/A Last Updated: 2025-08-21T02:55:07.450Z Description: No description available.
CVE ID: CVE-2025-57829 State: REJECTED Published: N/A Last Updated: 2025-08-21T02:55:06.991Z Description: No description available.
CVE ID: CVE-2025-57830 State: REJECTED Published: N/A Last Updated: 2025-08-21T02:55:06.540Z Description: No description available.
CVE ID: CVE-2025-57831 State: REJECTED Published: N/A Last Updated: 2025-08-21T02:55:06.059Z Description: No description available.
CVE ID: CVE-2025-57832 State: REJECTED Published: N/A Last Updated: 2025-08-21T02:55:05.455Z Description: No description available.
CVE ID: CVE-2025-57833 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-11-04T21:13:19.662Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: djangoproject Products: Django Problem Types: CWE-89 Description: An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - http
ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/g/django-announce - https://www.djangoproject.com/weblog/2025/sep/03/security-releases/ - https://medium.com/@EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898
CVE ID: CVE-2025-57837 State: PUBLISHED Published: 2025-10-20T08:12:19.416Z Last Updated: 2025-10-20T13:01:50.277Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Honor Products: FCP-AN10 Problem Types: CWE-200 Description: Tileservice module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.honor.com/global/security/cve-2025-57837/
CVE ID: CVE-2025-57838 State: PUBLISHED Published: 2025-10-20T07:58:07.686Z Last Updated: 2025-10-20T13:32:29.053Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Honor Products: MagicOS Problem Types: CWE-200 Description: Some Honor products are affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.honor.com/global/security/cve-2025-57838/
CVE ID: CVE-2025-57839 State: PUBLISHED Published: 2025-10-20T08:04:00.881Z Last Updated: 2025-10-20T13:19:06.045Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Honor Products: MagicOS Problem Types: CWE-200 Description: Photo module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.honor.com/global/security/cve-2025-57839/
CVE ID: CVE-2025-57845 State: REJECTED Published: N/A Last Updated: 2025-08-28T03:05:05.368Z Description: No description available.