Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-5042 State: PUBLISHED Published: 2025-07-22T16:02:51.214Z Last Updated: 2025-10-06T15:21:12.952Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit, Revit LT Problem Types: CWE-125 Description: A maliciously crafted RFA file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-
ent: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0013
CVE ID: CVE-2025-5043 State: PUBLISHED Published: 2025-07-29T17:52:37.857Z Last Updated: 2025-09-25T18:38:18.347Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Shared Components, AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel Problem Types: CWE-122 Description: A maliciously crafted 3DM file, when linked or imported into certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. A
vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE ID: CVE-2025-5046 State: PUBLISHED Published: 2025-08-15T14:37:20.897Z Last Updated: 2025-09-25T18:27:47.323Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel Problem Types: CWE-125 Description: A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analys
o cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0017
CVE ID: CVE-2025-5047 State: PUBLISHED Published: 2025-08-15T14:37:49.550Z Last Updated: 2025-09-25T18:28:23.524Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel Problem Types: CWE-457 Description: A maliciously crafted DGN file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Not
se a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0017
CVE ID: CVE-2025-5048 State: PUBLISHED Published: 2025-08-15T14:38:22.151Z Last Updated: 2025-09-25T18:29:54.361Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel Problem Types: CWE-120 Description: A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0017
CVE ID: CVE-2025-5049 State: PUBLISHED Published: 2025-05-21T18:31:04.367Z Last Updated: 2025-05-21T19:42:10.524Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in FreeFloat FTP Server 1.0. It has been declared as critical. This vulnerability affects unknown code of the component APPEND Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309868 - https://vuldb.com/?ctiid.309868 - https:
st Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309868 - https://vuldb.com/?ctiid.309868 - https://vuldb.com/?submit.581278 - https://fitoxs.com/exploit/e837c056f1ced605a9574541c7bf9861982bbf52ac5da3a5c5b637dbbadb49b7-exploit.txt
CVE ID: CVE-2025-5050 State: PUBLISHED Published: 2025-05-21T18:31:05.548Z Last Updated: 2025-05-21T19:40:36.137Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in FreeFloat FTP Server 1.0. It has been rated as critical. This issue affects some unknown processing of the component BELL Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309869 - https://vuldb.com/?ctiid.309869 - https://
Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309869 - https://vuldb.com/?ctiid.309869 - https://vuldb.com/?submit.581282 - https://fitoxs.com/exploit/exploit-bbcf0f842f1c5385430b6992995a8eb068c58dfbaae38ffb7df1d2c69041bc7c.txt
CVE ID: CVE-2025-5051 State: PUBLISHED Published: 2025-05-21T20:00:07.185Z Last Updated: 2025-05-21T20:15:09.587Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component BINARY Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309870 - https://vuldb.com/?ctiid.309870 - https://vuld
es: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309870 - https://vuldb.com/?ctiid.309870 - https://vuldb.com/?submit.581283 - https://fitoxs.com/exploit/exploit-4c025558ea74cba6eda5d8483c3d65f16de258eef4b3a5fcc50b4278c120e558.txt
CVE ID: CVE-2025-5052 State: PUBLISHED Published: 2025-05-21T21:00:06.694Z Last Updated: 2025-05-22T18:45:34.393Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component LS Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309871 - https://vuldb.com/?ctiid.309871 - htt
alyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309871 - https://vuldb.com/?ctiid.309871 - https://vuldb.com/?submit.581284 - https://fitoxs.com/exploit/exploit-bbcf0f842f1c5385430b6992995a8eb068c58dfbaae38ffb7df1d2c69041bc7c1.txt
CVE ID: CVE-2025-5053 State: PUBLISHED Published: 2025-05-21T21:00:08.171Z Last Updated: 2025-05-22T14:59:43.287Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the component MDIR Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309872 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309872 - https://vuldb.com/?ctiid.309872 - https://vuldb.com/?submit.581285 - https://fitoxs.com/exploit/exploit-844fd54e7c56f8d038fc23d799cbff05d37452bc15f9a7203808d082de4a475f.txt
CVE ID: CVE-2025-5054 State: PUBLISHED Published: 2025-05-30T17:37:01.006Z Last Updated: 2025-11-03T20:05:43.609Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Canonical Products: Apport Problem Types: CWE-362 Description: Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a container, was being called before `consistency_checks`, which attempts to detect if the crashing process had been replaced. Because of this, if a process crashed an
cy_checks`, which attempts to detect if the crashing process had been replaced. Because of this, if a process crashed and was quickly replaced with a containerized one, apport could be made to forward the core dump to the container, potentially leaking sensitive information. `consistency_checks` is now being called before `_check_global_pid_and_forward`. Additionally, given that the PID-reuse race condition cannot be reliably detected from userspace alone, crashes are only forwarded to containers if the kernel provided a pidfd, or if the crashing process was unprivileged (i.e., if dump mode == 1). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https
.e., if dump mode == 1). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-7545-1 - https://ubuntu.com/security/CVE-2025-5054 - https://www.qualys.com/2025/05/29/apport-coredump/apport-coredump.txt
CVE ID: CVE-2025-5055 State: PUBLISHED Published: 2025-05-24T02:23:03.771Z Last Updated: 2025-05-24T10:05:18.759Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: edgarrojas Products: Smart Forms – when you need more than just a contact form Problem Types: CWE-79 Description: The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.98 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pag
ible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7f52cbb4-8fe3-4402-8ece-261d32329a42?source=cve - https://wordpress.org/plugins/smart-forms/
CVE ID: CVE-2025-5056 State: PUBLISHED Published: 2025-05-21T22:00:08.380Z Last Updated: 2025-05-22T15:13:53.454Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Shopping Portal Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit-products.php. The manipulation of the argument Category leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309877 - https://vuldb.com/?ctiid.309877 - https://vuldb.com/?submit.581373 - https://github.com/Jacob-z691/CVE/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-5057 State: PUBLISHED Published: 2025-05-21T22:00:10.779Z Last Updated: 2025-05-22T15:14:34.198Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Shopping Portal Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/insert-product.php. The manipulation of the argument Category leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vul
osed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309878 - https://vuldb.com/?ctiid.309878 - https://vuldb.com/?submit.581374 - https://github.com/Jacob-z691/CVE/issues/2 - https://www.campcodes.com/
CVE ID: CVE-2025-5058 State: PUBLISHED Published: 2025-05-24T03:37:32.831Z Last Updated: 2025-05-24T09:59:00.725Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: emagicone Products: eMagicOne Store Manager for WooCommerce Problem Types: CWE-434 Description: The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_image() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This is only exploitable by unauthen
files on the affected site's server which may make remote code execution possible. This is only exploitable by unauthenticated attackers in default configurations where the the default password is left as 1:1, or where the attacker gains access to the credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8a00ece0-6644-4535-86aa-d0802d94a1a7?source=cve - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmconnectorcommon.php#L2115 - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php#L272 - https://github.c
wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php#L272 - https://github.com/d0n601/CVE-2025-5058/ - https://ryankozak.com/posts/cve-2025-5058/
CVE ID: CVE-2025-5059 State: PUBLISHED Published: 2025-05-21T22:31:04.525Z Last Updated: 2025-05-22T15:56:27.081Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Campcodes Products: Online Shopping Portal Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. This affects an unknown part of the file /admin/edit-subcategory.php. The manipulation of the argument productimage1/productimage2/productimage3 leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309879 - https://vuldb.com/?ctiid.309879 - https://vuldb.com/?submit.581391 - https://github.com/snkercyber/CVE/issues/3 - https://www.campcodes.com/
CVE ID: CVE-2025-5060 State: PUBLISHED Published: 2025-08-23T06:43:36.291Z Last Updated: 2025-08-25T18:16:08.627Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bravis-Themes Products: Bravis User Problem Types: CWE-288 Description: The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.0. This is due to the plugin not properly logging a user in with the data that was previously verified through the facebook_ajax_login_callback(). This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site, and access to the administr
ers to log in as administrative users, as long as they have an existing account on the site, and access to the administrative user's email. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c52f1a-2203-4abe-b777-064bd6fd1714?source=cve - https://themeforest.net/item/graviton-construction-wordpress-theme/50429299
CVE ID: CVE-2025-5061 State: PUBLISHED Published: 2025-08-05T07:24:15.571Z Last Updated: 2025-08-05T15:23:55.410Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: vjinfotech Products: WP Import Export Lite Problem Types: CWE-434 Description: The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote co
ermissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 3.9.29. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c0f3248-fef6-48a5-b2e1-f2778528fba1?source=cve - https://plugins.trac.wordpress.org/browser/wp-import-export-lite/trunk/includes/classes/import/class-wpie-upload-validate.php#L24 - https://plugins.trac.wordpress.org/browser/wp-import-export-lite/trunk/includes/classes/import/class-wpie-upload-validate.php#L89 - https://plugins.trac.wordpress.org/changeset/3323402/ - https
cludes/classes/import/class-wpie-upload-validate.php#L89 - https://plugins.trac.wordpress.org/changeset/3323402/ - https://plugins.trac.wordpress.org/changeset/3338701/
CVE ID: CVE-2025-5062 State: PUBLISHED Published: 2025-05-22T03:42:08.044Z Last Updated: 2025-05-22T13:31:43.045Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: automattic Products: WooCommerce Problem Types: CWE-79 Description: The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and including, 9.4.2 due to insufficient input sanitization and output escaping on PostMessage data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking
rary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ee5bb-eeb8-4134-8f3f-b411e56457f0?source=cve - https://github.com/woocommerce/woocommerce/blob/08dbc3b7dea140dd5dc19ee9c9ecd47dac0605b6/plugins/woocommerce/client/admin/client/customize-store/utils.js#L39C1-L56C2 - https://developer.woocommerce.com/2024/12/03/woocommerce-9-4-3-and-woocommerce-9-3-4-available-now/ - https://github.com/woocommerce/woocommerce/pull/53405/files
CVE ID: CVE-2025-5063 State: PUBLISHED Published: 2025-05-27T20:43:02.737Z Last Updated: 2025-07-02T13:23:58.979Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html - https://issues.chromium.org/issues/411573532
CVE ID: CVE-2025-5064 State: PUBLISHED Published: 2025-05-27T20:43:03.557Z Last Updated: 2025-05-28T14:21:03.129Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html - https://issues.chromium.org/issues/40058068
CVE ID: CVE-2025-5065 State: PUBLISHED Published: 2025-05-27T20:43:03.825Z Last Updated: 2025-05-28T14:19:34.067Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html - https://issues.chromium.org/issues/40059071
CVE ID: CVE-2025-5066 State: PUBLISHED Published: 2025-05-27T20:43:04.249Z Last Updated: 2025-05-28T14:19:46.848Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html - https://issues.chromium.org/issues/356658477
CVE ID: CVE-2025-5067 State: PUBLISHED Published: 2025-05-27T20:43:04.916Z Last Updated: 2025-05-28T14:20:31.035Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html - https://issues.chromium.org/issues/40075024