Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-47207 State: PUBLISHED Published: 2025-11-07T15:16:08.604Z Last Updated: 2025-11-07T15:56:40.737Z Vendors: QNAP Systems Inc. Products: File Station 5 Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several product versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-38
CVE ID: CVE-2025-47210 State: PUBLISHED Published: 2025-10-03T18:09:58.401Z Last Updated: 2025-10-03T18:52:15.445Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-35
CVE ID: CVE-2025-47211 State: PUBLISHED Published: 2025-10-03T18:10:04.837Z Last Updated: 2025-10-03T18:53:40.403Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/securi
build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-36
CVE ID: CVE-2025-47212 State: PUBLISHED Published: 2025-10-03T18:10:11.466Z Last Updated: 2025-10-04T03:55:30.714Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-78 Description: A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-36
CVE ID: CVE-2025-47213 State: PUBLISHED Published: 2025-10-03T18:10:17.500Z Last Updated: 2025-10-03T18:56:27.652Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
ild 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-36
CVE ID: CVE-2025-47214 State: PUBLISHED Published: 2025-10-03T18:10:26.403Z Last Updated: 2025-10-03T18:57:05.857Z Vendors: QNAP Systems Inc. Products: QTS Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-36
CVE ID: CVE-2025-47219 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-08T15:58:39.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gstreamer.freedesktop.org/security/ - https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md
CVE ID: CVE-2025-47220 State: PUBLISHED Published: 2025-11-13T00:00:00.000Z Last Updated: 2025-11-14T17:59:53.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keyfactor SignServer before 7.3.1 has Incorrect Access Control, issue 1 of 3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.keyfactor.com - https://docs.keyfactor.com/signserver/latest/signserver-7-3-release-notes
CVE ID: CVE-2025-47221 State: PUBLISHED Published: 2025-11-13T00:00:00.000Z Last Updated: 2025-11-14T17:56:37.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keyfactor SignServer before 7.3.1 has Incorrect Access Control, issue 2 of 3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.keyfactor.com - https://docs.keyfactor.com/signserver/latest/signserver-7-3-release-notes
CVE ID: CVE-2025-47222 State: PUBLISHED Published: 2025-11-13T00:00:00.000Z Last Updated: 2025-11-14T16:56:46.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keyfactor SignServer before 7.3.1 has Incorrect Access Control, issue 3 of 3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.keyfactor.com - https://docs.keyfactor.com/signserver/latest/signserver-7-3-release-notes
CVE ID: CVE-2025-47226 State: PUBLISHED Published: 2025-05-02T00:00:00.000Z Last Updated: 2025-05-05T15:36:49.224Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: snipeitapp Products: Snipe-IT Problem Types: CWE-425 Description: Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/grokability/snipe-it/pull/16672 - https://github.com/grokability/snipe-it/compare/v8.0.4...v8.1.0 - https://github.com/grokability/snipe-it/releases/tag/v8.1.0 - https://github.com/koyomihack00/CVE-2025-47226/blob/main/PoC/idor-exploit.md
CVE ID: CVE-2025-47227 State: PUBLISHED Published: 2025-07-05T00:00:00.000Z Last Updated: 2025-07-07T18:35:57.991Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: ScriptCase Products: ScriptCase Problem Types: CWE-684 Description: In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.scriptcase.net/changelog/ - https://www.synacktiv.com/adv
lyst Notes: - CISA ADP Vulnrichment: References: - https://www.scriptcase.net/changelog/ - https://www.synacktiv.com/advisories/scriptcase-pre-authenticated-remote-command-execution - https://github.com/synacktiv/CVE-2025-47227_CVE-2025-47228
CVE ID: CVE-2025-47228 State: PUBLISHED Published: 2025-07-05T00:00:00.000Z Last Updated: 2025-07-07T18:34:55.971Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: ScriptCase Products: ScriptCase Problem Types: CWE-78 Description: In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.scriptcase.net/changelog/ - https://www.synacktiv.com/advisories/scriptcase-pre-authenticated-remote-command-execution - https://github.com/sy
og/ - https://www.synacktiv.com/advisories/scriptcase-pre-authenticated-remote-command-execution - https://github.com/synacktiv/CVE-2025-47227_CVE-2025-47228
CVE ID: CVE-2025-47229 State: PUBLISHED Published: 2025-05-03T00:00:00.000Z Last Updated: 2025-05-05T16:07:25.818Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: GNU Products: PSPP Problem Types: CWE-617 Description: libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet assertion failure and application exit) via crafted input data, such as data that triggers a call from src/data/dictionary.c code into src/data/variable.c code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://savannah.gnu.org/bugs/?67049
CVE ID: CVE-2025-47240 State: REJECTED Published: N/A Last Updated: 2025-05-05T14:14:43.131Z Description: No description available.
CVE ID: CVE-2025-47241 State: PUBLISHED Published: 2025-05-03T00:00:00.000Z Last Updated: 2025-05-05T15:46:45.254Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: browser-use Products: browser-use Problem Types: CWE-647 Description: In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/browser-use/browser-use/security/advisories/GHSA-x39x-9qw5-ghrf - https://github.com/browser-use/browser-use/releases/tag/0.1.45 - https://github.com/browser-use/browser-use/pull/1561
CVE ID: CVE-2025-47244 State: PUBLISHED Published: 2025-05-03T00:00:00.000Z Last Updated: 2025-05-05T14:21:24.798Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Inedo Products: ProGet Problem Types: CWE-288 Description: Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of service (when an attacker executes a loop calling RestartWeb) or obtaining potentially sensitive information. Exploitation can occur if Anonymous access is enabled, or if there is a successful CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://seclists
if there is a successful CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2025/Apr/30 - https://forums.inedo.com - https://docs.inedo.com/docs/proget/installation/installation-guide - https://my.inedo.com/downloads/installers?product=ProGet
CVE ID: CVE-2025-47245 State: PUBLISHED Published: 2025-05-03T00:00:00.000Z Last Updated: 2025-05-05T14:20:10.531Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BlueWave Products: Checkmate Problem Types: CWE-472 Description: In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bluewave-labs/Checkmate/pull/2160 - https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-7x3q-g6gq-f4mm - https://github.com/bluewave-labs/Checkmate/commit/d4a60723f490502b3fe6f7f780a85d29bf5d1385
CVE ID: CVE-2025-47256 State: PUBLISHED Published: 2025-05-06T00:00:00.000Z Last Updated: 2025-05-06T20:27:26.395Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Libxmp Products: Libxmp Problem Types: CWE-191 Description: Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libxmp/libxmp/blob/ec22d1c7b93c8f681f8504a6c61c6f8a52458a10/src/loaders/prowizard/pha.c#L35 - https://github.com/GCatt-AS/CVE-2025-47256 - https://github.com/libxmp/libxmp/issues/847
CVE ID: CVE-2025-47268 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-07-23T15:11:08.132Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: iputils Products: iputils Problem Types: CWE-190 Description: ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp multiplication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/iputils/iputils/issues/584 - https://github.com/Zephkek/ping-rtt-overflow/ - https://bugzilla.suse.com/show_bug.cgi?id=1242300 - https://g
sues/584 - https://github.com/Zephkek/ping-rtt-overflow/ - https://bugzilla.suse.com/show_bug.cgi?id=1242300 - https://github.com/iputils/iputils/pull/585 - https://github.com/iputils/iputils/releases/tag/20250602
CVE ID: CVE-2025-47269 State: PUBLISHED Published: 2025-05-09T20:59:01.510Z Last Updated: 2025-05-10T01:45:13.443Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: coder Products: code-server Problem Types: CWE-441 Description: code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result in proxying to an arbitrary domain. The malicious URL `https://<code-server>/proxy/test@evil.com/path` would be proxied to `test@evil.com/path` where the attack
malicious URL `https://<code-server>/proxy/test@evil.com/path` would be proxied to `test@evil.com/path` where the attacker could exfiltrate a user's session token. Any user who runs code-server with the built-in proxy enabled and clicks on maliciously crafted links that go to their code-server instances with reference to /proxy. Normally this is used to proxy local ports, however the URL can reference the attacker's domain instead, and the connection is then proxied to that domain, which will include sending cookies. With access to the session cookie, the attacker can then log into code-server and have full access to the machine hosting code-server as the user running code-server. This issue
log into code-server and have full access to the machine hosting code-server as the user running code-server. This issue has been patched in version 4.99.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coder/code-server/security/advisories/GHSA-p483-wpfp-42cj - https://github.com/coder/code-server/commit/47d6d3ada5aadef6d221f3d612401eb3dad9299e - https://github.com/coder/code-server/releases/tag/v4.99.4
CVE ID: CVE-2025-47270 State: PUBLISHED Published: 2025-05-12T10:47:44.804Z Last Updated: 2025-05-12T12:14:13.258Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: nimiq Products: core-rs-albatross Problem Types: CWE-400 Description: nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. The `nimiq-network-libp2p` subcrate of nimiq/core-rs-albatross is vulnerable to a Denial of Service (DoS) attack due to uncontrolled memory allocation. Specifically, the implementation of the `Discovery` network message handling allocates a buffer based on a length value provided by the peer, without enf
of the `Discovery` network message handling allocates a buffer based on a length value provided by the peer, without enforcing an upper bound. Since this length is a `u32`, a peer can trigger allocations of up to 4 GB, potentially leading to memory exhaustion and node crashes. As Discovery messages are regularly exchanged for peer discovery, this vulnerability can be exploited repeatedly. The patch for this vulnerability is formally released as part of v1.1.0. The patch implements a limit to the discovery message size of 1 MB and also resizes the message buffer size incrementally as the data is read. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
ntally as the data is read. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-3v6r-9cr8-q433 - https://github.com/nimiq/core-rs-albatross/pull/3384 - https://github.com/nimiq/core-rs-albatross/releases/tag/v1.1.0
CVE ID: CVE-2025-47271 State: PUBLISHED Published: 2025-05-12T10:52:26.916Z Last Updated: 2025-05-12T12:12:40.770Z Vendors: OZI-Project Products: publish Problem Types: CWE-94, CWE-95, CWE-1116 Description: The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13.2 through 1.13.5, potentially untrusted data flows into PR creation logic. A malicious actor could construct a branch name that injects arbitrary code. This is patched in 1.13.6. As a workaround, one may downgrade to a version prior to 1.13.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OZI-Pr
to a version prior to 1.13.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OZI-Project/publish/security/advisories/GHSA-2487-9f55-2vg9 - https://github.com/OZI-Project/publish/commit/abd8524ec69800890529846b3ccfb09ce7c10b5c
CVE ID: CVE-2025-47272 State: PUBLISHED Published: 2025-06-02T10:47:53.761Z Last Updated: 2025-06-02T11:43:22.588Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: CE-PhoenixCart Products: PhoenixCart Problem Types: CWE-306 Description: The CE Phoenix eCommerce platform, starting in version 1.0.9.7 and prior to version 1.1.0.3, allowed logged-in users to delete their accounts without requiring password re-authentication. An attacker with temporary access to an authenticated session (e.g., on a shared/public machine) could permanently delete the user’s account without knowledge of the password. This bypass of re-authentication puts users at risk of account los
the user’s account without knowledge of the password. This bypass of re-authentication puts users at risk of account loss and data disruption. Version 1.1.0.3 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CE-PhoenixCart/PhoenixCart/security/advisories/GHSA-62qj-pvwm-h8cv - https://github.com/CE-PhoenixCart/PhoenixCart/commit/e87162b15d31c4126acfc1aad6108e5b9955bb76
CVE ID: CVE-2025-47273 State: PUBLISHED Published: 2025-05-17T15:46:11.399Z Last Updated: 2025-05-28T15:03:15.516Z Vendors: pypa Products: setuptools Problem Types: CWE-22 Description: setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CV
cution depending on the context. Version 78.1.1 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf - https://github.com/pypa/setuptools/issues/4946 - https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b - https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
CVE ID: CVE-2025-47274 State: PUBLISHED Published: 2025-05-12T14:57:46.781Z Last Updated: 2025-05-12T22:06:42.029Z Vendors: stacklok Products: toolhive Problem Types: CWE-311 Description: ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Due to the ordering of code used to start an MCP server container, versions of ToolHive prior to 0.0.33 inadvertently store secrets in the run config files which are used to restart stopped containers. This means that an attacker who has access to the home folder of the user who starts the MCP server can read secrets without needing access to the secrets store itself. This only applies to secret
o starts the MCP server can read secrets without needing access to the secrets store itself. This only applies to secrets which were used in containers whose run configs exist at a point in time - other secrets remaining inaccessible. ToolHive 0.0.33 fixes the issue. Some workarounds are available. Stop and delete any running MCP servers, or manually remove any runconfigs from `$HOME/Library/Application Support/toolhive/runconfigs/` (macOS) or `$HOME/.state/toolhive/runconfigs/` (Linux). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stacklok/toolhive/security/advisories/GHSA-xj5p-w2v5-fjm6 - https://github.com/stacklok/toolhive/commit/e8efa1b1d7b0776a393
cklok/toolhive/security/advisories/GHSA-xj5p-w2v5-fjm6 - https://github.com/stacklok/toolhive/commit/e8efa1b1d7b0776a39339257d30bf6c4a171f2b8 - https://github.com/stacklok/toolhive/releases/tag/v0.0.33
CVE ID: CVE-2025-47275 State: PUBLISHED Published: 2025-05-15T21:13:01.150Z Last Updated: 2025-05-22T20:03:34.201Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: auth0 Products: auth0-PHP Problem Types: CWE-287 Description: Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Certain pre-conditions are required to be vulnerable to this issue: Applications using the Auth0-PHP SDK, or the Auth0/symfon
in pre-conditions are required to be vulnerable to this issue: Applications using the Auth0-PHP SDK, or the Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress SDKs that rely on the Auth0-PHP SDK; and session storage configured with CookieStore. Upgrade Auth0/Auth0-PHP to v8.14.0 to receive a patch. As an additional precautionary measure, rotating cookie encryption keys is recommended. Note that once updated, any previous session cookies will be rejected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/auth0/auth0-PHP/security/advisories/GHSA-g98g-r7gf-2r25 - https://github.com/auth0/laravel-auth0/security/advisories/GHSA-9fwj-9mjf-rhj3 - https://githu
ies/GHSA-g98g-r7gf-2r25 - https://github.com/auth0/laravel-auth0/security/advisories/GHSA-9fwj-9mjf-rhj3 - https://github.com/auth0/symfony/security/advisories/GHSA-9wg9-93h9-j8ch - https://github.com/auth0/wordpress/security/advisories/GHSA-2f4r-34m4-3w8q - https://github.com/auth0/auth0-PHP/commit/52a79480fdb246f59dbc089b81a784ae049bd389 - https://github.com/auth0/auth0-PHP/releases/tag/8.14.0
CVE ID: CVE-2025-47276 State: PUBLISHED Published: 2025-05-13T15:34:28.801Z Last Updated: 2025-05-13T19:31:22.672Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: ChewKeanHo Products: Actualizer Problem Types: CWE-328 Description: Actualizer is a single shell script solution to allow developers and embedded engineers to create Debian operating systems (OS). Prior to version 1.2.0, Actualizer uses OpenSSL's "-passwd" function, which uses SHA512 instead of a more suitable password hasher like Yescript/Argon2i. All Actualizer users building a full Debian Operating System are affected. Users should upgrade to version 1.2.0 of Actualizer. Existing OS deployment req