Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156642
CVE ID: CVE-2025-59483 State: PUBLISHED Published: 2025-10-15T13:55:55.498Z Last Updated: 2025-10-16T19:51:09.993Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-73 Description: A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156800
CVE ID: CVE-2025-59484 State: PUBLISHED Published: 2025-09-23T22:08:40.744Z Last Updated: 2025-09-24T14:08:07.973Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: AutomationDirect Products: CLICK PLUS C0-0x CPU firmware, CLICK PLUS C0-1x CPU firmware, CLICK PLUS C2-x CPU firmware Problem Types: CWE-327 Description: The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software uses an insecure implementation of the RSA encryption algorithm. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/ic
thm. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01 - https://www.automationdirect.com/support/software-downloads
CVE ID: CVE-2025-59485 State: PUBLISHED Published: 2025-11-25T07:20:38.296Z Last Updated: 2025-11-25T07:20:38.296Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Intercom, Inc. Products: Security Point (Windows) of MaLion Problem Types: CWE-276 Description: Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an arbitrary file could be placed in the specific folder by a user who can log in to the system where the product's Windows client is installed. If the file is a specially crafted DLL file, arbitrary code could be executed with SYSTEM privilege. References: - https://www.i
ile is a specially crafted DLL file, arbitrary code could be executed with SYSTEM privilege. References: - https://www.intercom.co.jp/information/2025/1125.html - https://jvn.jp/en/jp/JVN76298784/
CVE ID: CVE-2025-59489 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T17:22:11.001Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Unity3D Products: Unity Editor Problem Types: CWE-88 Description: Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status i
, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://unity.com/security#security-updates-and-patches - https://unity.com/security/sept-2025-01 - https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/
CVE ID: CVE-2025-59491 State: PUBLISHED Published: 2025-11-12T00:00:00.000Z Last Updated: 2025-11-12T21:36:30.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://centralsquare.com - https://machevalia.blog/blog/multiple-vulnerabilities-in-centralsquare-etrakit-and-ivr
CVE ID: CVE-2025-59494 State: PUBLISHED Published: 2025-10-14T17:00:52.507Z Last Updated: 2025-11-22T04:08:59.033Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Monitor Problem Types: CWE-284 Description: Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59494
CVE ID: CVE-2025-59497 State: PUBLISHED Published: 2025-10-14T17:01:48.832Z Last Updated: 2025-11-22T04:09:51.715Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Defender for Endpoint for Linux Problem Types: CWE-367 Description: Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Linux allows an authorized attacker to deny service locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59497
CVE ID: CVE-2025-59499 State: PUBLISHED Published: 2025-11-11T17:59:46.405Z Last Updated: 2025-11-21T19:07:08.690Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2019 (CU 32), Microsoft SQL Server 2022 (CU 21) Problem Types: CWE-89 Description: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authori
on: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59499
CVE ID: CVE-2025-59500 State: PUBLISHED Published: 2025-10-23T21:07:30.428Z Last Updated: 2025-11-22T04:09:58.027Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Notification Service Problem Types: CWE-284 Description: Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59500
CVE ID: CVE-2025-59501 State: PUBLISHED Published: 2025-10-31T16:45:40.699Z Last Updated: 2025-11-22T04:09:58.654Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Configuration Manager, Microsoft Configuration Manager 2409 Problem Types: CWE-290 Description: Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59501
CVE ID: CVE-2025-59502 State: PUBLISHED Published: 2025-10-14T17:00:53.100Z Last Updated: 2025-11-22T04:08:59.687Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-400 Description: Uncontrolled resource consumption in Win
indows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-400 Description: Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59502
CVE ID: CVE-2025-59503 State: PUBLISHED Published: 2025-10-23T21:18:06.047Z Last Updated: 2025-11-22T04:09:57.386Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Compute Resource Provider Problem Types: CWE-918 Description: Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59503
CVE ID: CVE-2025-59504 State: PUBLISHED Published: 2025-11-11T17:59:11.909Z Last Updated: 2025-11-21T19:06:35.267Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Monitor Problem Types: CWE-122 Description: Heap-based buffer overflow in Azure Monitor Agent allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59504
CVE ID: CVE-2025-59505 State: PUBLISHED Published: 2025-11-11T17:59:13.264Z Last Updated: 2025-11-21T19:06:36.493Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server C
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-415 Description: Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59505
CVE ID: CVE-2025-59506 State: PUBLISHED Published: 2025-11-11T17:59:14.652Z Last Updated: 2025-11-21T19:06:37.256Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Cor
dows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-362 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59506
CVE ID: CVE-2025-59507 State: PUBLISHED Published: 2025-11-11T17:59:15.696Z Last Updated: 2025-11-21T19:06:37.923Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Cor
dows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-362 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59507
CVE ID: CVE-2025-59508 State: PUBLISHED Published: 2025-11-11T17:59:16.400Z Last Updated: 2025-11-21T19:06:38.698Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Cor
dows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-362 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59508
CVE ID: CVE-2025-59509 State: PUBLISHED Published: 2025-11-11T17:59:17.048Z Last Updated: 2025-11-21T19:06:39.321Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-201 Description: Insertion of sensitive information int
Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-201 Description: Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59509
CVE ID: CVE-2025-59510 State: PUBLISHED Published: 2025-11-11T17:59:17.642Z Last Updated: 2025-11-21T19:06:40.174Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server
Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-59 Description: Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59510
CVE ID: CVE-2025-59511 State: PUBLISHED Published: 2025-11-11T17:59:18.514Z Last Updated: 2025-11-21T19:06:40.671Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-73 Description: External control of file name or path in
indows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-73 Description: External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59511
CVE ID: CVE-2025-59512 State: PUBLISHED Published: 2025-11-11T17:59:19.195Z Last Updated: 2025-11-21T19:06:41.218Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server C
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-284 Description: Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59512
CVE ID: CVE-2025-59513 State: PUBLISHED Published: 2025-11-11T17:59:19.799Z Last Updated: 2025-11-21T19:06:41.805Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server
Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation) Problem Types: CWE-125 Description: Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59513
CVE ID: CVE-2025-59514 State: PUBLISHED Published: 2025-11-11T17:59:35.037Z Last Updated: 2025-11-21T19:06:58.114Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server C
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-269 Description: Improper privilege management in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
ce allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59514
CVE ID: CVE-2025-59515 State: PUBLISHED Published: 2025-11-11T17:59:35.615Z Last Updated: 2025-11-21T19:06:58.750Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-416 Description: Use after free in Windows Broadcast DVR User Service allows an
Windows Server 2025 Problem Types: CWE-416 Description: Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59515
CVE ID: CVE-2025-59518 State: PUBLISHED Published: 2025-09-17T00:00:00.000Z Last Updated: 2025-09-17T13:25:47.958Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: lemonldap-ng Products: LemonLDAP::NG Problem Types: CWE-78 Description: In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ during rule evaluation. Thus, an administrator who can edit a rule evaluated by the Safe jail can execute commands on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/3462 - https://gitlab.ow2.org/lemonldap-ng/l
ment: References: - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/3462 - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/228d01945d48015f3f9ea8a8dc64d7e6a27750e9